Service providers are subject to government regulation in a number of jurisdictions in which we sell our products. There are several existing regulations and proposals in the United States, Europe and elsewhere for regulating service providers' ability to prioritize applications in their networks. Some advocates for regulating this industry claim that collecting premium fees from certain "preferred" applications would distort the market for Internet applications in favor of larger and better-funded content providers. They also claim that this would impact end-users who already purchased broadband access only to experience response times that differ based on content provider. Some opponents believe that content providers who support bandwidth-intensive applications should be required to pay service providers a premium in order to support further network investments.
On December 14, 2017 the United States Federal Communications Commission (the "FCC") announced that it voted to repeal the Open Internet Report and Order on Remand, Declaratory Ruling, and Order (the "Open Internet Order"). The Open Internet Order was issued by the FCC and went into effect on June 12, 2015. The Open Internet Order set forth rules, grounded, among others, on Title II of the Communications Act of 1934; the Open Internet Order regulated both fixed and mobile Internet Service Providers (ISPs) and prohibited them, subject to reasonable network management, from blocking and/or throttling of lawful content, applications, services, or non-harmful devices, and from unreasonably interfering or disadvantaging of (i) end users' ability to select, access service of the lawful Internet content, applications, services, or devices of their choice or (ii) edge providers' ability to make lawful content, applications, services, or devices available to end users. The Open Internet Order also prohibited paid prioritization of content. The repeal largely reversed the Open Internet Order, including the classification of broadband Internet service as a telecommunications service, which is subject to certain common carrier regulations, and restored the regulatory framework that preceded the Open Internet Order. Because our products allow ISPs to identify network traffic and facilitate traffic management, the reinstatement of this traditional regulatory framework has not, to date, affected but may in the future affect ISP's demand for certain of our products. The repeal of the Open Internet Order was upheld by a federal appeals court in October 2019, however, the repeal does not preclude state and local governments from enacting their own net neutrality rules and certain U.S. states have already implemented net neutrality protections. Therefore, the impact of the FCC's repeal on the demand for our products is uncertain and difficult to assess at this time.
On April 30, 2016, Regulation (EU) 2015/2120 of the European Parliament and of the Council came into effect, setting forth the first EU-wide Net Neutrality ("Open Internet") rules. Under these rules, blocking, throttling and discrimination of internet traffic by ISPs is prohibited in the EU, with three exceptions: (i) compliance with legal obligations; (ii) integrity of the network; and (iii) congestion management in exceptional and temporary situations. Outside these exceptions, there can be no prioritization of traffic within an internet access service. However, equal treatment permits reasonable day-to-day traffic management according to objectively justified technical requirements, and which must be independent of the origin or destination of the traffic and of any commercial considerations. These rules also allow internet access providers, as well as content and applications providers, to offer special services with specific quality requirements (provided the Open Internet is not negatively affected by the provision of these services). Such specialized services cannot be a substitute to internet access services, can only be provided if there is sufficient network capacity to provide them in addition to any internet access service and must not be to the detriment of the availability or general quality of internet access services for end-users.
Such regulation of both fixed and mobile ISPs, in European Economic Area (EEA) Member States, may limit ISPs' ability to manage, prioritize and monetize their network. Additionally, these regulations may attract growing public debate and attention of regulators in other jurisdictions we operate in. Demand from service providers, in affected jurisdictions, for the traffic management and subscriber management features of our products may be adversely affected by such regulations. To date, we have not experienced any material decrease in demand for these features; however, a decrease in demand in the future could adversely impact sales of our products and could have a material adverse effect on our business, financial condition or results of operations.
In addition, strict data privacy laws regulating the collection, transmission, storage and use of employee data and consumers' personally-identifying information applicable to ISPs are evolving in the US, European Union and other jurisdictions in which we sell our products. For example, in the U.S., legislation has in recent years been proposed regarding restrictions on the use of geolocation information collected by mobile devices without consumer consent and California's California Consumer Privacy Act, which grants expanded rights to access and delete personal information and opt out of certain personal information sharing, among other things, became effective on January 1, 2020 Similarly, the General Data Protection Regulation ("GDPR"), enforcement of which began on May 25, 2018, creates a range of new compliance obligations, increases financial penalties for non-compliance and extends the scope of the EU data protection law to all companies established in the EEA, and all companies established outside the EEA that either: (a) offer goods or services to individuals in the EEA; or (b) monitor the behavior of individuals in the EEA. The GDPR imposes a strict data protection compliance regime and includes enhanced rights for individuals. It applies to the collection, use, retention, security, processing, transfer and deletion of personally identifiable information of individuals, and creates a range of new compliance obligations. Implementation of, and compliance with, the GDPR has increased, and could continue to increase, our cost of doing business. In addition, the GDPR may be interpreted or applied in a manner that is unforeseen by, or adverse to, us. Violations of the GDPR may result in significant fines (up to four percent of worldwide annual turnover or EUR 20.0 million, whichever is greater) and reputational harm. Such regulations may increase our compliance and administrative burden significantly and may require us to invest resources and management attention in order to update our IT systems to meet the new requirements.
The GDPR and other privacy and data protection laws may be interpreted and applied differently from country to country and may create inconsistent or conflicting requirements. Such regulations increase our customers' compliance and administrative burden significantly and may require us to adapt certain of our products, if necessary, to different requirements in EEA Member States, as well as in the US, in order to allow our customers in such jurisdictions, to comply with such regulations. There is also no assurance that we will be able to adapt our products sufficiently in order to allow our customers in various jurisdictions to comply with such regulatory requirements in each jurisdiction.
As data protection and privacy-related laws and regulations continue to evolve, these changes may result in increased regulatory and public scrutiny, escalating levels of enforcement and sanctions and increased costs of compliance. Therefore, we may be required to modify the features and functionalities of certain of our products, in a manner that is less attractive to customers. Such adjustments of our products, if required, may require extensive financial investments and may take long periods of time, leading to delay in sales cycles, deployment of our products and recognition of related revenues.