Information technology is a critically important part of our business operations. We depend on information systems to process transactions, manage inventory, operate our websites, manage consumer databases, purchase, sell and ship goods on a timely basis, and maintain cost-efficient operations. There is a risk that we could experience a business interruption, theft of information, or reputational damage as a result of a cyber-attack, such as an infiltration of a data center, or data leakage of confidential information either internally or at our third-party providers. We may experience operational problems with our information systems as a result of system failures, system implementation issues, viruses, malicious hackers, sabotage, code anomalies, "Acts of God," human error or other causes.
Our business involves the storage and transmission of consumers' personal information, such as personal preferences and credit card information. We invest in industry-standard security technology to protect our data and business processes against the risk of data security breaches and cyber-attacks. Our data security management program includes identity, trust, vulnerability and threat management business processes, as well as enforcement of standard data protection policies such as Payment Card Industry compliance. We measure our data security effectiveness through industry accepted methods and remediate critical findings. Additionally, we certify our major technology suppliers and any outsourced services through accepted security certification measures. We maintain and routinely test backup systems and disaster recovery, along with external network security penetration testing by an independent third party as part of our business continuity preparedness. Internet privacy is a rapidly changing area and we may be subject to future requirements and legislation that are costly to implement and may negatively impact our results.
While we believe that our security technology and processes are adequate in preventing security breaches and in reducing cyber security risks, given the ever-increasing abilities of those intent on breaching cyber security measures and given our reliance on the security and other efforts of third-party vendors, the total security effort at any point in time may not be completely effective, and any such security breaches and cyber incidents could adversely affect our business. Failure of our systems, including failures due to cyber-attacks that would prevent the ability of systems to function as intended, could cause transaction errors, loss of consumers and sales, and could have negative consequences to us, our employees, and those with whom we do business. In addition, our workforce's combination of remote work, hybrid, and flexible work schedules opening us up for cyber-security threats and potential breaches as a result of increased employee usage of networks other than company-managed. Any security breach involving the misappropriation, loss, or other unauthorized disclosure of confidential information could also severely damage our reputation, expose us to the risks of litigation and liability, and harm our business. While we carry insurance that would mitigate the losses to an extent, such insurance may be insufficient to compensate us for potentially significant losses.
We currently obtain and retain personal information about our website users, store shoppers and loyalty program members. Federal, state and foreign governments have enacted or may enact laws or regulations regarding the collection and use of personal information, with particular emphasis on the collection of information regarding minors. Such regulation may also include enforcement and redress provisions. We have a stringent, comprehensive privacy policy covering the information we collect from our guests and have established security features to protect our consumer database and websites. While we have implemented programs and procedures designed to protect the privacy of people from whom we collect information which may include information regarding their children, and we intend for our websites to be fully compliant with all applicable regulations including the Federal Children's Online Privacy Protection Act, there can be no assurance that such programs will conform to all applicable laws or regulations. If we fail to fully comply, we may be subjected to liability and damage to our reputation. In addition, because our guest database primarily includes personal information of the parents of children and children frequently interact with our websites, we are potentially vulnerable to charges from parents, children's organizations, governmental entities, and the media of engaging in inappropriate collection, distribution or other use of data collected from children. Additionally, while we have security features, our security measures may not protect users' identities and our online safety measures may be questioned, which may result in negative publicity or a decrease in visitors to our sites. If site users act inappropriately or seek unauthorized contact with other users of the site, it could harm our reputation and, therefore, our business and we could be subject to liability. For example, the EU General Data Protection Regulation - 2016/679 ("EU GDPR") and related guidance together with the UK General Data Protection Regulation ("UK GDPR," collectively with the EU GDPR, the "GDPR"), and the California Consumer Privacy Act 2018, as amended by the California Privacy Rights Act 2020 (collectively "CCPA"), greatly increase the jurisdictional reach of EU and California law, respectively, and adds a broad array of requirements related to personal data, including individual notice and opt-out preferences and the public disclosure of significant data breaches. Additionally, violations of GDPR can result in fines calculated as a percentage of a company's annual revenue and CCPA provides civil penalty violations, as well as a private right of action for data breaches. Other governments have enacted or are expected to enact similar data protection laws and are considering data localization laws that require data to stay within their borders. All of these evolving compliance and operational requirements impose significant costs and regulatory risks that are likely to increase over time.
A determination that there have been violations of laws relating to our practices under communications-based laws could also expose us to significant damage awards, fines and other penalties that could, individually or in the aggregate, materially harm our business. In particular, because of our marketing and other promotional texts, emails and other communications we send to our users, communications laws that provide a specified monetary damage award or fine for each violation (such as those described below) could result in particularly large awards or fines. For example, the Federal Communications Commission amended certain of its regulations under the Telephone Consumer Protection Act, or TCPA, in 2012 and 2013 in a manner that has increased our exposure to liability for certain types of telephonic communication with customers, including but not limited to text messages to mobile phones. Under the TCPA, plaintiffs seek actual monetary loss or statutory damages of $500 per violation, whichever is greater, and courts could treble the damage award for willful or knowing violations. Given the varied number of communications we send to our users, a determination that there have been violations of the TCPA, or other communications-based statutes, has exposed us to significant damage awards that could, individually or in the aggregate, materially harm our business. In 2021, a putative class action lawsuit was filed against us asserting claims under the TCPA which was ultimately dismissed after we reached a settlement with the plaintiff and an insurance carrier.