We collect and maintain significant amounts of data relating to our customers and employees, and we face risks inherent in handling large volumes of data, transferring such data to third parties, processing such data for tracking and marketing purposes (or providing such data to third parties for tracking and marketing purposes), and protecting the security of such data. Our actual or perceived failure to comply with any federal, state, or foreign laws and regulations, or applicable industry standards that govern or apply to our collection, use, retention, sharing, and security of data, or any failure by any of our third party service providers to protect such data that they may maintain on our behalf, could result in enforcement actions that require us to change our business practices in a manner that may negatively impact our revenue, result in indemnity obligations to our customers, distract our management, increase our costs of doing business, as well as expose ourselves to litigation, fines, civil, and/or criminal penalties and adverse publicity that could cause our customers to lose trust in us, negatively impacting our reputation and business (including our brand) in a manner that harms our financial position, results in a loss of customers and suppliers or an inability to process credit card payments, and may result in the imposition of monetary penalties. Laws and regulations in the United States and around the world restrict how information about individuals is collected, processed, stored, used, transferred, and disclosed, as well as set standards for its security, implement notice requirements regarding privacy practices, and provide individuals with certain rights regarding the use, disclosure, and sale of their protected personal information. These laws and regulations are still being tested in courts, and they are subject to new and differing interpretations by courts and regulatory officials. We are working to comply with the privacy and data protection laws and regulations that apply to us, and we anticipate needing to devote significant additional resources to complying with these laws and regulations. It is possible that these laws and regulations may be interpreted and applied in a manner that is inconsistent from jurisdiction to jurisdiction or inconsistent with our current policies and practices.
In the United States, both federal and various state governments have adopted, or are considering, laws, guidelines, or rules for the collection, distribution, use, and storage of information collected from or about consumers or their devices. For example, California enacted the California Consumer Privacy Act, or the CCPA, which went into effect on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as statutory damages and a private right of action for data breaches that is expected to increase data breach litigation. Further, in November 2020, California voters passed the California Privacy Rights Act, or CPRA. The CPRA took effect on January 1, 2023 and creates obligations with respect to certain data relating to consumers as of January 1, 2022, significantly expands the CCPA, including by introducing additional obligations such as data minimization and storage limitations, granting additional rights to consumers, such as correction of personal information and additional opt-out rights, and creates a new entity, the California Privacy Protection Agency, to implement and enforce the law. Personal information we handle may be subject to the CCPA and CPRA, which may increase our compliance costs and potential liability. Further, Virginia, Colorado, Utah, and Connecticut have all passed privacy laws that took effect in 2023, but aspects of these state privacy statutes remain unclear, resulting in further legal uncertainty and potentially requiring us to modify our data practices and policies and to incur substantial additional costs and expenses in an effort to comply. Other states have considered similar bills, which could be enacted in the future. In addition to fines and penalties that may be imposed for failure to comply with state law, some states also provide for private rights of action to customers for misuse of or unauthorized access to personal information.
Certain requirements from our third-party technology and platform providers may also cause us to modify our offerings due to privacy concerns or negatively affect our revenue due to reduced availability of information about consumers. For example, Apple iOS 14.5 requires apps in the Apple App Store to opt in to the tracking of users across apps and websites owned by third parties for advertising and measurement purposes. Google introduced a similar feature in early 2022. Changes like this may reduce the quality of the data and related metrics that can be collected or used by us and/or our partners. In addition, such changes could significantly inhibit the effectiveness of our targeted advertising and related activities.
In addition to risks posed by new privacy laws, we could be subject to claims alleging violations of long-established federal and state privacy and consumer protection laws, including those related to telephone and email communications with consumers. As an example, the Telephone Consumer Protection Act, or TCPA, is a federal law that imposes significant restrictions on the ability to make telephone calls or send text messages to mobile telephone numbers without the prior consent of the person being contacted. The TCPA provides for substantial statutory damages for violations, which has generated extensive class action litigation. In addition, class action plaintiffs in the United States are employing novel legal theories to allege that federal and state eavesdropping/wiretapping laws and state constitutions prohibit the use of analytics technologies widely employed by website and mobile app operators to understand how their users interact with their services. Despite our compliance efforts, our use of text messaging communications or similar analytics technologies could expose us to costly litigation, government enforcement actions, damages, and penalties, which could adversely affect our business, financial condition, and results of operations.
Outside of the United States, certain foreign jurisdictions, including the European Economic Area, or EEA, and the United Kingdom, have laws and regulations which are more restrictive in certain respects than those in the United States. For example, the EEA and the United Kingdom have adopted the GDPR, which may apply to our collection, control, use, sharing, disclosure, and other processing of data relating to an identified or identifiable living individual (personal data). The GDPR, and national implementing legislation in EEA member states and the United Kingdom, impose a strict data protection compliance regime including: providing detailed disclosures about how personal data is collected and processed (in a concise, intelligible and easily accessible form); granting new rights for data subjects in regard to their personal data (including the right to be "forgotten" and the right to data portability), as well as enhancing current rights (e.g., data subject access requests); requirements to have data processing agreements in place to govern the processing of personal data on behalf of other organizations; introducing the obligation to notify data protection regulators or supervisory authorities (and in certain cases, affected individuals) of significant data breaches; maintaining a record of data processing; and complying with the principal of accountability and the obligation to demonstrate compliance through policies, procedures, trainings, and audits.
In addition, we have in the past been subject to various other data privacy and security laws and regulations of other foreign jurisdictions, including those in China and South Korea. As there remains significant uncertainty in the interpretation and enforcement of the laws and regulations in foreign jurisdictions, we cannot assure you that we will comply with such regulations in all respects. Any non-compliance may subject us to fines, orders to remediate or terminate any actions that are deemed illegal by regulatory authorities, as well as damage to our reputation, or legal proceedings against us, which may affect our business, financial condition, or results of operations.
We also may be subject to European Union rules with respect to cross-border transfers of personal data out of the EEA. Recent legal developments in Europe have created complexity and uncertainty regarding transfers of personal data from the EEA to the United States. We may make use of alternative data transfer mechanisms such as standard contractual clauses, or SCCs, approved by the European Commission on June 4, 2021. These new SCCs may require us to expend significant resources to update our contractual arrangements and to comply with such obligations. Further, data protection authorities may require measures to be put in place in addition to SCCs for transfers to countries outside of the EEA, as well as Switzerland and the United Kingdom. Our third-party service providers may also be affected by these changes. In addition to other impacts, we may experience additional costs to comply with these changes, and we and our customers face the potential for regulators in the EEA, Switzerland, or the United Kingdom to apply different standards to the transfer of personal data to the United States and other non-EEA countries, and to block, or require ad hoc verification of measures taken with respect to certain data flows to the United States and other non-EEA countries. We also may be required to engage in new contract negotiations with third parties that aid in processing data on our behalf, to the extent that any of our service providers or consultants have been relying on invalidated or insufficient contractual protections for compliance with evolving interpretations of and guidance for cross-border data transfers pursuant to the GDPR. In such cases, we may not be able to find alternative service providers, which could limit our ability to process personal data from the EEA, Switzerland, or the United Kingdom and increase our costs.
These recent developments may require us to review and amend the legal mechanisms by which we make and/or receive personal data transfers to/in the United States. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the standard contractual clauses cannot be used and/or start taking enforcement action, we could suffer additional costs, complaints, and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our business, financial condition, and results of operations.
Fines for certain breaches of the GDPR are up to the greater of 20 million euros or 4% of total global annual turnover. In addition to the foregoing, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease/change our processing of our data, enforcement notices, and/or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm.
The United Kingdom has implemented legislation similar to the GDPR, including the U.K. Data Protection Act and legislation similar to the GDPR referred to as the U.K. GDPR, which provides for fines of up to the greater of 17.5 million British Pounds or 4% of a company's worldwide turnover, whichever is higher. Additionally, the relationship between the United Kingdom and the European Union in relation to certain aspects of data protection law remains unclear following the United Kingdom's exit from the European Union, including with respect to regulation of data transfers between E.U. member states and the United Kingdom. On June 28, 2021, the European Commission announced a decision of "adequacy" concluding that the United Kingdom ensures an equivalent level of data protection to the GDPR, which provides some relief regarding the legality of continued personal data flows from the EEA to the United Kingdom. Some uncertainty remains, however, as this adequacy determination must be renewed after four years and may be modified or revoked in the interim. We cannot fully predict how the Data Protection Act, the U.K. GDPR, and other U.K. data protection laws or regulations may develop in the medium to longer term nor the effects of divergent laws and guidance regarding how data transfers to and from the United Kingdom will be regulated.
We are also subject to evolving E.U. privacy laws on cookies and e-marketing. In the European Union, regulators are increasingly focusing on compliance with requirements in the online behavioral advertising ecosystem, and current national laws that implement the ePrivacy Directive will be replaced by an E.U. regulation known as the ePrivacy Regulation which will significantly increase fines for non-compliance. In the European Union, informed consent is required for the placement of a cookie or similar technologies on a user's device and for direct electronic marketing. The GDPR also imposes conditions on obtaining valid consent, such as a prohibition on pre-checked consents and a requirement to ensure separate consents are sought for each type of cookie or similar technology. While the text of the ePrivacy Regulation is still under development and not expected to take effect until sometime in 2023, a European court decision and regulators' recent guidance are driving increased attention to cookies and tracking technologies. If regulators start to enforce the strict approach in recent guidance, this could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs, and subject us to additional liabilities. Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target individuals, may lead to broader restrictions and impairments on our marketing and personalization activities, and may negatively impact our efforts to understand users.
Furthermore, compliance with legal and contractual obligations may require us to make public statements about our privacy and data security practices, including the statements we make in our online privacy policy. Although we endeavor to comply with these statements, should they prove to be untrue or be perceived as untrue, even through circumstances beyond our reasonable control, we may face litigation, claims, investigations, inquiries, or other proceedings by the U.S. Federal Trade Commission, state attorneys general, and other federal, state, and foreign regulators and private litigants alleging violations of privacy or consumer protection laws.
Any actual or perceived non-compliance with these rapidly changing laws, regulations, or standards or our contractual obligations relating to privacy, data protection, and consumer protection by us or the third-party companies we work with could result in litigation and proceedings against us by governmental entities, consumers, or others, fines and civil or criminal penalties for us or company officials, obligations to cease offerings or to substantially modify our business in a manner that makes it less effective in certain jurisdictions, negative publicity, and harm to our brand and reputation, and reduced overall demand for our products, any of which could have an adverse effect on our business, financial condition, and results of operations.