We are subject to an increasingly complex, and sometimes conflicting, set of legal obligations related to privacy, data protection, information security in the United States, Europe, Canada, and other countries where we do business, and there will continue to be new proposed laws and regulations and changes to existing legal frameworks that could have a significant impact on our current and planned privacy, data protection and information security-related practices, our collection, use, sharing, retention and safeguarding of customer, consumer, employee, and other third-party information we receive, as well as some of our current or planned business activities. New and changing laws, regulations, and industry standards concerning privacy, data protection and information security may also impact the computing services and software industry platforms and data providers we utilize, and thereby indirectly impact our business.We are also subject to contractual obligations from our customers and other third parties related to privacy, data protection and information security, and disclosures and commitments made in our privacy policies.
In the United States, eighteen (18) states have enacted comprehensive consumer privacy laws, with another state law going into effect in 2026, and eleven (11) states with privacy laws under consideration. The California Consumer Privacy Act ("CCPA"), the most stringent state privacy law, grants California residents data privacy rights that include, among other things, the right to request a copy from a covered company of the personal information collected about them, the right to request deletion of such personal information, the right to request to opt-out of certain sales of such personal information, as well as a private right of action for certain data breaches. The European Union adopted the General Data Protection Regulation (the "GDPR") and the United Kingdom enacted the UK General Data Protection Regulation (which implements the GDPR into UK law); both of which impose significant compliance requirements, including extensive documentation requirements and granting certain rights to individuals to control how businesses collect, use, disclose, retain and leverage information about them or how they obtain consent from them. In Canada, the Personal Information Protection and Electronic Documents Act ("PIPEDA"), and various provincial laws require companies to give detailed privacy notices to consumers; obtain consent to use personal information, with limited exceptions; allow individuals to access and correct their personal information; and report certain data breaches.
Any significant change to applicable privacy, data protection, and/or information security laws, regulations or industry practices could increase our costs and require us to modify our services and features, possibly in a material manner, which we may be unable to complete and may limit our ability to store and process user data or develop new services and features. All of these implications could adversely affect our revenue, results of operations, business and financial condition.