We regularly collect, obtain, store, handle, transmit, use, and otherwise process business information and information related to individuals, including from and about actual and prospective customers, as well as our employees, suppliers, and vendors in the course of conducting our business through our website, our app, and information technology systems. We also depend on a number of third party vendors in relation to the operation of our business, a number of which process personal information on our behalf. As such, we and our vendors are subject to numerous federal, state, and international data privacy and security laws, rules, regulations, industry standards, and other requirements, including those that apply generally to the handling of information about individuals, and those that are specific to certain industries, sectors, contexts, or locations, governing the collection, use, disclosure, retention, security, transfer, storage, and other processing of personal information. These requirements, and their application, interpretation and amendment are constantly evolving and developing.
In the United States, the FTC and many state regulators are interpreting and enforcing federal and state consumer protection laws to impose standards for the online collection, use, dissemination, and security of personal information. Such standards require us to publish statements that describe how we handle personal information and choices individuals may have about the way we handle their personal information. If such information that we publish is considered untrue or inaccurate, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Moreover, according to the FTC, violating consumers' privacy rights or failing to take appropriate steps to keep consumers' personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. State consumer protection laws provide similar causes of action for unfair or deceptive practices.
In addition, various federal and state legislative and regulatory bodies, or self-regulatory organizations, have (and may continue to) expanded current laws or regulations, enacted new laws or regulations, or issued revised rules or guidance regarding privacy, data protection, consumer protection, and advertising, and as the regulatory environment related to information security, data collection and use, and privacy becomes increasingly rigorous, there are new and changing requirements applicable to our business. For example, the California Consumer Privacy Act ("CCPA") requires covered companies, among other things, to provide disclosures to California consumers regarding the business's collection, use and disclosure of their personal information and provide such consumers certain data protection and privacy rights, including the ability to opt-out of certain disclosure of personal information. The CCPA also provides for civil penalties for violations, as well as a private right of action for certain data breaches. This private right of action may increase the likelihood of, and risks associated with, data breach litigation.
The enactment of the CCPA has prompted a wave of legislation in a number of U.S. states which imposes, or has the potential to impose, additional obligations on companies that collect, store, use, retain, disclose, transfer, and otherwise process confidential, sensitive, and personal information, and will continue to shape the data privacy environment nationally. For example, since the CCPA went into effect, comprehensive privacy statutes that share similarities with the CCPA are now in effect and enforceable in twenty states, and will soon be enforceable in several other states as well. State laws are changing rapidly and there is discussion in Congress of a new federal data protection and privacy law to which we may become subject if it is enacted. Such legislation may add additional complexity, variation in requirements, restrictions, and potential legal risk and could require additional investment in resources to compliance programs, impact strategies and availability of previously useful data, and result in increased compliance costs and changes in business practices and policies. Further, in order to comply with the varying state laws around data breaches, we must maintain adequate security measures, which require significant investments in resources and ongoing attention.
We may also be subject to laws, regulations, and standards in many jurisdictions outside of the United States, which apply broadly to the collection, use, retention, security, disclosure, transfer, and other processing of personal information. For example, data protection laws in the European Economic Area, and United Kingdom, including the General Data Protection Regulation ("GDPR"), impose stringent operational requirements for entities processing personal information and significant penalties for non-compliance. In particular, violations of the GDPR could lead to fines of up to 20 million Euros / £17.5 million, or up to 4% of the annual global revenue of the noncompliant company, whichever is greater. Such penalties are in addition to any civil litigation claims by data subjects and other regulatory actions that may be taken by competent authorities.
In addition, we may also be subject to evolving foreign privacy laws on cookies and e-marketing. In the EU and the UK, informed consent is required for the placement of certain cookies or similar technologies on a customer's or user's device and for direct electronic marketing, and local laws impose conditions on obtaining valid consent, such as a prohibition on pre-checked consents and a requirement to ensure separate consents are sought for each type of cookie or similar technology. Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target customers and users, may lead to broader restrictions and impairments on our marketing and personalization activities and may materially adversely impact our efforts to understand our customers and users and our business, results of operations, and financial condition.
In addition to the GDPR, we are also subject to laws in China. Under China's Cybersecurity Law, any collection, use, transfer, and storage of personal information of a Chinese citizen through a network by the network operator should be based on the three principles of legitimacy, justification, and necessity and requires the consent of the data subject. The rules, purposes, methods, and ranges of such collection should also be disclosed to the data subject. China's data localization requirements are becoming increasingly common in sector-specific regulations. For example, China's Cybersecurity Law requires operators of critical information infrastructure ("CIIOs") to store personal information and important data collected and generated from the critical information infrastructure within China. Non-compliance with China's Cybersecurity Law as recently amended effective as of January 1, 2026, can result in fines of up to RMB 10 million (approximately US$1.43 million) for violations that cause particularly serious consequences and RMB 1 million (approximately US$143,000) for the violator's directly responsible personnel and potentially five times the illegal gains where the illegal gains exceed RMB 100,000 (approximately US$14,300.
Building on this, China's Data Security Law ("Data Security Law") aims to regulate data activities, safeguard data security, promote data development and usage, protect individuals and entities' legitimate rights and interests, and safeguard state sovereignty, state security, and development interests. The Data Security Law applies extraterritorially and to a broad range of activities that involve "data" (not only personal or sensitive data). Under the Data Security Law, entities and individuals carrying out data activities must abide by various data security obligations. For example, the Data Security Law proposes to classify and protect data based on the importance of data to the state's economic development, as well as the degree of harm it will cause to national security, public interests, or legitimate rights and interests of individuals or organizations when such data is tampered with, destroyed, leaked, or illegally acquired or used. The appropriate level of protective measures is required to be taken for each respective class of data. The Data Security Law also echoes the data localization requirement in the Cybersecurity Law and requires important data to be stored locally in China. Such important data may only be transferred outside of China subject to compliance with certain data transfer restrictions, such as passing a security assessment organized by the relevant authorities.
Additionally, China's Personal Information Protection Law ("PIPL") clarifies the scope of application, the definitions of personal information and sensitive personal information, the legality of personal information processing, and the basic requirements of notice and consent, among other things. The PIPL also sets out data localization requirements for CIIOs and personal information processors who process personal information above a certain threshold prescribed by the relevant authorities. The PIPL also requires data processors to rely on a data export mechanism and comply with certain requirements prior to the transfer of personal information outside of China, such as compliance with a security assessment ("Security Assessment") or certification by an agency designated by the relevant authorities ("Certification") or entering into standard form model contracts approved by the relevant authorities ("SCCs") with the overseas recipient, unless an exemption under the Provisions for Promoting and Regulating Cross-Border Data Flows ("Provisions") applies, such as the transfer being necessary for the performance of a contract which the individual is a party to or necessary for cross-border HR management or the number of individuals' whose personal information is transferred is less than 100,000 since January 1st of the current year.
According to the Provisions published by the CAC on March 22, 2024, a data processor must apply for the Security Assessment organized by the CAC under any of the following circumstances and receive an approval from the relevant authorities before the information may be transferred outside of the PRC: (i) where a data processor or a CIIO provides important data overseas, (ii) where a CIIO transfers personal information overseas (unless an exemption applies), or (iii) where a personal information processor either transfers more than 1 million individuals' personal information or more than 10,000 individuals' sensitive personal information overseas since January 1st of the current year, in each case unless an exemption applies. Additionally, a data processor must enter into the SCCs with the overseas recipient and file this with the local CAC and obtain a pass result or obtain a Certification before transferring information overseas if the data processor either transfers more than 100,000 but less than 1 million individuals' personal information or transfers less than 10,000 individuals' sensitive personal information since January 1st of the current year, unless an exemption applies.
Notably, the PIPL, similar to the GDPR, applies extraterritorially. Failure to comply with PIPL can result in fines of up to RMB 50 million or 5% of the prior year's total annual revenue for the personal information processor and/or a suspension of services or data processing activities. Other potential penalties include a fine of up to RMB 1 million on the person in charge or directly responsible personnel and, in serious cases, individuals and entities may be exposed to criminal liabilities under other local Chinese law, such as the Criminal Law of the People's Republic of China. The PIPL also prohibits responsible personnel for violations of the PIPL from holding high level management or data protection officer positions in relevant enterprises.
In addition to China's Cybersecurity Law, the Data Security Law, and the PIPL, the relevant government authorities of the People Republic of China promulgated several regulations or released a number of draft regulations for public comments which are designed to provide further implemental guidance in accordance with the laws mentioned above. For example, recently, the Regulations on Network Data Security Management ("Regulations") took effect on January 1, 2025 in China and have extraterritorial effect. The Regulations apply broadly to any network data processing activities (not only personal information processing activities) and reiterate and expand on the existing obligations on data processors under the Cybersecurity Law, Data Security Law, and the PIPL and introduce new network and data security obligations, such as a requirement to report any risks arising from network products and services that may endanger national security or public interest to the relevant authorities within 24 hours.
We cannot predict what impact the new laws and regulations or the increased costs of compliance, if any, will have on our operations in China, in particular the Data Security Law or PIPL and its implementation regulations, or the increased costs of compliance, if any, will have on our operations in China due to their recent enactment and the limited guidance available, particularly on PIPL, which entities are awaiting further guidance on. It is also generally unclear how the laws will be interpreted and enforced in practice by the relevant government authorities as often the above mentioned laws are drafted broadly and thus leaves great discretion to the relevant government authorities to exercise.
Finally, we make public statements about our use and disclosure of personal information through our privacy policy, information provided on our website, and press statements. Any failure or perceived failure by us to ensure that our public statements are complete, accurate, and fully implemented may result in regulatory investigations and enforcement, claims or proceedings, fines and penalties, and negative reputational impacts or other legal action if such policies or statements are found to be deceptive, unfair, or misrepresentative of our actual practices. In addition, from time to time, concerns may be expressed about whether our products and services compromise the data privacy of our users and others. Any concerns about our data privacy and security practices (even if unfounded), or any failure, real or perceived, by us to comply with our posted privacy policies or public statements or with any legal or regulatory requirements, standards, certifications or orders, or other privacy or consumer protection-related laws and regulations applicable to us, may result in regulatory investigations and enforcement, claims or proceedings, fines and penalties, and negative reputational impacts and could cause our users to reduce their use of our products and services. Any or all of the foregoing could materially adversely affect our business, results of operations, and financial condition.
We may be subject to claims that we have violated applicable laws or codes of conduct, and there is no assurance that we will be able to successfully defend against such claims or that we will not be subject to significant fines and penalties in the event of non-compliance. Additionally, in the United States, to the extent multiple state-level laws are introduced with inconsistent or conflicting standards and there is no federal law to preempt such laws, compliance with such laws could be difficult and costly to achieve and we could be subject to fines and penalties in the event of non-compliance. Further, we may incur significant costs to comply with laws regarding the protection and unauthorized disclosure of personal information. Any failure or perceived failure by us to comply with applicable privacy, security, and data protection laws, rules, regulations, and standards, or with other obligations to which we may be or may become subject, may result in proceedings, investigations, or actions against us by individuals, consumer rights groups governmental entities or regulators. We could incur significant costs in investigating and defending such claims and, if found liable, pay significant damages, fines, penalties, or other liabilities or result in orders or consent decrees forcing us to modify our business practices. Any such action and any subsequent adverse outcomes could be expensive to defend, damage our reputation, and materially adversely affect our business, results of operations, and financial condition.