Our business is subject to regulation by various federal, state, local and foreign governmental agencies, including agencies responsible for monitoring and enforcing employment and labor laws, workplace safety, product safety, environmental laws (including new laws related to climate change), consumer protection laws, privacy, data protection, telecommunications, anti-bribery laws such as the U.S. Foreign Corrupt Practices Act, import/export controls and sanctions, conflict minerals, federal securities laws and tax laws and regulations. In addition, emerging tools and technologies we utilize in providing our products, like AI and machine learning, may also become subject to regulation under new laws or new applications of existing laws. Violations of these laws and regulations could result in fines and penalties, criminal sanctions against us, our officers or our employees, prohibitions on the conduct of our business, and damage to our reputation.
From time to time, we may receive inquiries from governmental agencies, or we may make voluntary disclosures regarding our compliance with applicable governmental regulations or requirements relating to various matters, including import/export controls, federal securities laws and tax laws and regulations which could lead to formal investigations. Actual or alleged noncompliance with applicable laws, regulations or other governmental requirements could lead to regulatory investigations, enforcement actions, and other proceedings, private claims and litigation, and potentially may subject us to sanctions, mandatory product recalls, enforcement actions, disgorgement of profits, fines, damages, civil and criminal penalties or injunctions. If any governmental fines, penalties, or other sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business, financial condition, results of operations and prospects could be materially adversely affected. In addition, responding to any investigation, action or other proceeding will likely result in a significant diversion of management's attention and resources and an increase in professional fees. Enforcement actions, investigations, fines, penalties, and other sanctions could harm our business, financial condition, results of operations and prospects.
Privacy Laws
Many jurisdictions have passed new laws and regulations relating to privacy, data protection, and other matters, and other jurisdictions are considering imposing additional restrictions. These laws continue to develop and may be inconsistent. For example, the California Consumer Privacy Act ("CCPA") became operative on January 1, 2020 and was amended by the California Privacy Rights Act ("CPRA") going into effect over time through July 1, 2023. Aspects of the CCPA/CPRA and its interpretation remain uncertain and are likely to remain uncertain for an extended period and may require us to incur additional costs and expenses in an effort to comply. In addition to the CCPA/CPRA, numerous other states have enacted or are considering similar laws that will require ongoing compliance efforts and investment. More recently, the Department of Justice issued a final rule that places limitations, and in some cases prohibitions, on access to, or certain transfers of, sensitive personal data to business partners located in China or with other specified links to China (and other designated countries).
In addition, in certain jurisdictions, these regulatory requirements may be more stringent than those in the United States, such as the EU's General Data Protection Regulation ("GDPR"). The GDPR provides for substantial obligations relating to the handling, storage and other processing of data relating to individuals and administrative fines for violations, which can be up to four percent of the previous year's annual revenue or €20 million, whichever is higher. In the past, we relied on the E.U.-U.S. and Swiss-U.S. Privacy Shield programs, and/or the use of standard contractual clauses approved by the European Commission ("SCCs"), to legitimize transfers of data out of the EU. EU courts later invalidated the E.U.-U.S. Privacy Shield and imposed additional obligations in connection with use of the SCCs. The European Commission subsequently issued new SCCs. The continued validity of these new SCCs for cross-border data transfer is uncertain and difficult to predict. Among other effects, we may experience additional costs associated with increased compliance burdens and new contract negotiations with third parties that process data on our behalf. Further, the United Kingdom ("UK") has implemented legislation that substantially mirrors the GDPR, and provides for fines of up to the greater of 17.5 million British Pounds or four percent of the previous year's annual revenue, whichever is higher. The relationship between the UK and the EU in relation to certain aspects of data protection law remains unclear following the UK's exit from the EU, including with respect to regulation of data transfers between EU member states and the UK. The UK has issued new standard contractual clauses that, like the SCCs, are required to be implemented.
We may experience reluctance or refusal by current or prospective customers in the European Economic Area (the "EEA"), the UK, or other regions to use our products, and we may find it necessary or desirable to modify our handling of personal data of residents of the EEA, UK, or other regions. The regulatory environment applicable to the handling of personal data of EEA and UK residents, and our actions taken in response, may cause us to assume additional liabilities or incur additional costs and could result in our business, operating results and financial condition being harmed. Additionally, we and our customers may face a risk of enforcement actions by data protection authorities relating to personal data transfers. Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results, and financial condition.
Among other emerging laws relating to privacy and data protection globally, India has released its Digital Personal Data Protection Act 2023, and India's Ministry of Electronics and Information Technology released finalized Draft Digital Personal Data Protection Rules on November 13, 2025, addressing various matters under this law, but the full scope of the implementation remains subject to some uncertainty. We maintain an employee and operational presence in India, and this act may require us to modify our policies and practices and incur increased costs in our efforts to comply.
We also expect laws, regulations, industry standards and other obligations worldwide relating to privacy, data protection and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. For example, the Network and Information Security Directive II, or NIS2, adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the EU. It expands the scope of the 2016 NIS Directive to include additional sectors while enforcing stricter governance and accountability requirements. NIS2 requires all 27 EU member states to issue implementing legislation by October 2024; however, several EU member states have not finalized their respective legislation and guidance. Additionally, the Digital Operational Resiliency Act, or DORA, became effective in January 2025, and aims to establish a universal framework for managing and mitigating information and communication technology risks that will apply to entities in the financial sector and their third-party cloud service providers.
In addition, some countries are considering or have enacted legislation requiring local storage and processing of data that could increase the cost and complexity of delivering our services. Accordingly, we cannot predict the full impact of other evolving privacy and data protection obligations on our business or operations. Complying with emerging and changing legal and regulatory requirements relating to privacy, data protection and other matters may cause us to incur costs or require us to change our business practices, which could harm our business, financial condition, results of operations and prospects.
Environmental Laws
We are also subject to environmental laws and regulations governing the management and disposal of hazardous materials and wastes, including the hazardous material content of our products and laws relating to the collection, recycling and disposal of electrical and electronic equipment. Our failure, or the failure of our partners, including our contract manufacturers, to comply with past, present and future environmental laws could result in fines, penalties, third-party claims, reduced sales of our products, re-engineering our products, substantial product inventory write-offs and reputational damage, any of which could harm our business, financial condition, results of operations and prospects. We also expect that our business will be affected by new environmental laws and regulations on an ongoing basis applicable to us and our partners, including our contract manufacturers. To date, our expenditures for environmental compliance has not had a material effect on our results of operations or cash flows. Although we cannot predict the future effect of such laws or regulations, they will likely result in additional costs or require us to change the content or manufacturing of our products, which could have a material adverse effect on our business, financial condition, results of operations and prospects.
Export Controls
Our products are subject to various export controls and because we incorporate encryption technology into certain of our products, certain of our products may be exported from various countries only with government authorization. If we were to fail to comply with the applicable export control laws, customs regulations, economic sanctions or other applicable laws, we could be subject to monetary damages or the imposition of restrictions which could be material to our business, operating results and prospects and could also harm our reputation. Further, there could be criminal penalties for knowing or willful violations, including incarceration for culpable employees and managers. Obtaining the necessary export authorizations for a particular sale may be time-consuming and may result in the delay or loss of sales opportunities.
Furthermore, certain export control and economic sanctions laws prohibit the shipment of certain products, technology, software and services to embargoed countries and sanctioned governments, entities, and persons. The U.S. government also continues to add additional entities to restricted party lists impacting the ability of U.S. companies to provide products, and in certain cases services, to these entities and, in some cases, receive products or services from these entities.
Additionally, the U.S. government continues to expand controls enacted in October 2022 restricting the ability to export, reexport and transfer certain products and technology related to semiconductors, semiconductor manufacturing, and supercomputing. Although new regulations introduced in January 2025 which further expanded the controls to impose a worldwide licensing requirement on certain integrated circuits and computing resources that are used for training of AI models were rescinded prior to the scheduled compliance date, we expect the U.S. government may issue new controls on similar technologies in the future. The U.S. government also expanded the scope of restrictions on the development or production of advanced integrated circuits and certain semiconductor manufacturing equipment and the restrictions on supercomputing in China and other countries. Other foreign governments may in turn impose similar or more restrictive controls. These controls or any additional restrictions may impact our ability to export certain products to China or other countries, prohibit us from selling our products to certain of our customers, restrict our ability to use certain ICs in our products, or impact our suppliers who may utilize facilities or equipment described in these controls. However, certain U.S. export controls have been the subject of bilateral trade negotiations between the U.S. and China and have been partially relaxed since May 2025, with further changes possible.
It also is possible that the Chinese government will retaliate to these export controls in ways that could impact our business. For example, China has announced controls on both the use of Micron products and export controls on certain materials used, among other things, in the production of semiconductors, optical components, and other electronic devices including germanium and gallium. These Chinese export controls have been the subject of bilateral trade negotiations between the U.S. and China and have been partially relaxed since May 2025, though further changes are possible. Further, the Chinese government has responded to U.S. actions by adding U.S. entities to an unreliable entity list, which limits the ability of companies on the list to engage in business with Chinese customers. These restrictions could disrupt the ability of China to procure or produce semiconductors and other electronics and impact our ability to source components from China and could impact the cost of components or inputs used to produce our products.
Any deterioration in relations between Taiwan and China could lead to additional sanctions or export controls on China, on specific individuals or entities, or otherwise in the region which could impact our ability to sell to certain of our customers, source components from China, or otherwise negatively impact our business.
The United States may also continue to leverage the use of "secondary tariffs" and/or "secondary sanctions" to achieve certain foreign policy goals, or increase its enforcement of such tools, which may directly or indirectly affect our business (see also the "Escalated or escalating U.S. tariffs, as well as countermeasures taken by affected countries may have a negative effect on global economic conditions, financial markets and our business, as may retaliatory actions by other countries, including China, in response to these U.S. policies" risk factor above). Even though we take precautions to ensure that we and our channel partners comply with all relevant regulations, any failure by us or our channel partners to comply with such regulations could have negative consequences, including reputational harm, government investigations and penalties. In addition, economic sanctions that are vague and not subject to guidance by regulators lead to heightened compliance risk.
Although we have developed policies and procedures to comply with export control and other applicable laws, historically, we have had some instances where we, or a business that we acquired, inadvertently did not fully comply with certain trade laws, but we made relevant disclosures to the appropriate government agencies and implemented corrective actions.
In addition, various countries regulate the import of certain encryption technology, including through import permit and license requirements, and have enacted laws that could limit our ability to distribute our products or could limit our customers' ability to implement our products in those countries. Any change in export or import regulations, economic sanctions or related legislation, shift in the enforcement or scope of existing regulations or change in the countries, governments, persons or technologies targeted by such regulations could result in decreased use of our products by, or in our decreased ability to export or sell our products to, existing or potential customers with international operations or create delays in the introduction of our products into international markets. Any decreased use of our products or limitation on our ability to export or sell our products could adversely affect our business, financial condition, results of operations and prospects.