We rely on, among other things, commercially available systems, software, tools and monitoring to provide security for processing, transmission and storage of confidential information of customers, associates and third parties, such as payment cards and personal information. The systems currently used for transmission and approval of payment card transactions, and the technology utilized in payment cards themselves, all of which can put payment card data at risk, are central to meeting standards set by the payment card industry ("PCI"). We continue to evaluate and modify these systems and protocols for PCI compliance purposes, and such PCI standards may change from time to time. At our customers' request, we also use our proprietary Streem technology to capture key information about our customers' appliances, HVAC and other home systems and may, through these video chat sessions, capture additional information related to our customer or their home.
Activities by third parties, or our utilization of advances in computer and software capabilities and other technology, new tools and discoveries, as well as other events or developments may facilitate or result in a compromise or breach of these systems. Any compromises, breaches or errors in applications related to these systems or failures to comply with standards set by the PCI could cause damage to our reputation and interruptions in our operations, including customers' ability to pay for services and products by credit card or their willingness to purchase our services and products and could result in a violation of applicable laws, regulations, orders, industry standards or agreements and subject us to costs, penalties and liabilities. We are subject to risks caused by data breaches and operational disruptions, particularly through third-party criminal activity including "ransomware" or other malware, cyber-attack or cyber-intrusion, including by computer hackers, foreign governments and cyber terrorists.
These risks include potential damage and disruption from traditional cyber criminals, malicious code (such as viruses and worms), employee theft, misuse, social engineering, denial-of-service attacks, as well as sophisticated nation-state and nation-state-supported actors, including advanced persistent threat intrusions. Any cyber or similar attack or unauthorized access to our software or systems that we experience could damage our technology systems and infrastructures, lead to the loss, compromise or corruption of data, prevent us from providing our services, erode our reputation and those of our various brands, lead to the termination of advantageous contracts, result in inaccurate reporting of financial information, result in the disclosure of confidential consumer and professional contractor information, result in erroneous payments to malicious actors, expose us to significant liabilities for the violation of data privacy laws, result in the disclosure of confidential and sensitive business information or intellectual property, result in claims or litigation against us and/or otherwise be costly to mitigate or remedy. The frequency of data breaches of companies and governments has increased in recent years as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. The occurrence of any of these events could have a material adverse impact on our reputation, business, financial position, results of operations and cash flows. In addition, although we have insurance to mitigate some of these risks, such policies may not cover the particular cyber or similar attack experienced and, even if the risk is covered, such insurance coverage may not be adequate to compensate for related losses.
The impact of cybersecurity events experienced by third parties with whom we do business (or upon whom we otherwise rely in connection with our day-to-day operations) could have similar effects on us. Moreover, even cyber or similar attacks that do not directly affect us or third parties with whom we do business may result in a loss of consumer confidence in online and/or technology-reliant businesses generally, which could make consumers and professional contractors less likely to use or continue to use our services. The occurrence of any of these events could adversely affect our business, financial position, results of operations and cash flows.
Data protection legislation is also becoming increasingly common in the United States at both the federal and state level. For example, the State of California enacted the California Consumer Privacy Act of 2018 (the "CCPA"), which became effective on January 1, 2020. The CCPA requires companies that process information of California residents to make disclosures to consumers about their data collection, use and sharing practices, allows consumers to opt out of certain data sharing with third parties and provides a new cause of action for data breaches. Additionally, the California Privacy Rights Act (the "CPRA"), which became effective January 1, 2023, revised and significantly expanded the scope of the CCPA. The CPRA also creates a new California data protection agency authorized to implement and enforce the CCPA and the CPRA, which could result in increased privacy and information security enforcement.
Additional U.S. states have passed their own comprehensive consumer privacy laws, some of which went into effect in 2023 or will go into effect in 2024, and other states are considering doing so. Additionally, the Federal Trade Commission and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination and security of data. The burdens imposed by the CCPA, CPRA and other similar laws that may be enacted at the federal and state level may require us to further modify our data processing practices and policies and to incur substantial expenditures in order to comply.