We collect, process, store, use and share data, some of which contains personal information, including the personal information of our players. Our business is therefore subject to a number of federal, state, local and foreign laws, regulations, regulatory codes and guidelines governing data privacy, data protection and security, including with respect to the collection, storage, use, processing, transmission, sharing and protection of personal information. Such laws, regulations, regulatory codes and guidelines are complex, may be inconsistent across jurisdictions or conflict with other rules and their interpretation is rapidly evolving, making implementation and enforcement, and thus compliance requirements, ambiguous, uncertain, and potentially inconsistent. Compliance with such laws may require changes to our data collection, use, transfer, disclosure, other processing, and certain other related business practices and may thereby increase compliance costs or have other material adverse effects on our business.
As the scope of data privacy and security regulations worldwide continues to evolve, we believe that the adoption of increasingly restrictive regulations in this area is likely within the United States and other jurisdictions. For example, in the United States, a number of state-level data privacy laws have or will soon go into effect that introduce new data privacy rights for consumers and new operational requirements for companies. For instance, the California Consumer Privacy Act ("CCPA") provides data privacy rights for California residents and operational requirements for covered companies. Among other things, companies covered by the CCPA must provide new disclosures to California residents and afford such residents certain privacy rights relating to their personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. In addition, the California Privacy Rights Act ("CPRA"), which took effect in January 2023, expanded the rights granted under the CCPA, created a new enforcement agency, the California Privacy Protection Agency, and imposed additional obligations on covered companies.
Additionally, other U.S. states have implemented, or are in the process of implementing, similar new laws or regulations. For example, the Virginia Consumer Data Protection Act ("VCDPA"), which took effect on January 1, 2023, the Colorado Privacy Act ("CPA") and the Connecticut Data Privacy Act ("CTDPA"), which both took effect on July 1, 2023, and the Utah Consumer Privacy Act ("UCPA"), which took effect on December 31, 2023, similarly impose new privacy rights and obligations on covered companies. In addition to the CCPA, the VCDPA, CPA, CTDPA and UCPA provide for civil penalties for violations that are enforceable by the Attorney General of its respective state, which could range into the millions of dollars. More generally, the enactment of the CCPA, VCDPA, CPA, CTDPA and UCPA could mark the beginning of a trend toward more stringent United States federal privacy legislation, which could increase our potential liability and adversely affect our business. We cannot fully predict the impact of these laws, or subsequent guidance, regulations or rules on our business or operations, including those that are still in draft form, but they may increase our compliance costs and potential liability, particularly in the event of a data breach, and could have a material adverse effect on our business, including how we use personal information, our financial condition, and the results of our operations or prospects. Further, if we become subject to other state-level data privacy laws, guidelines or regulations, we may be required again to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation.
Outside of the United States, many countries have also adopted comprehensive data protection and security laws. In the BVI we are subject to the Data Protection Act, 2021 (the "BVI DPA") The DPA establishes a framework of rights and duties designed to safeguard individuals' personal data, balanced against the need of public authorities, businesses and organizations to collect and use personal data for lawful purposes. The BVI DPA is centered around seven data protection principles (the General Principle, the Notice and Choice Principle, the Disclosure Principle, the Security Principle, the Retention Principle, the Data Integrity Principle and the Access Principle). The BVI DPA is however based on the original UK Data Protection Act 1998 and therefore less comprehensive than the GDPR (defined below) and UK GDPR (defined below) to which we are also subject.
We are also subject to the EU General Data Protection Regulation 2016/679 (the "GDPR") in the European Economic Area (the "EEA"), and, following the withdrawal of the United Kingdom from the European Union, we have had to comply with the GDPR as implemented in the United Kingdom, which together with the amended United Kingdom Data Protection Act 2018 (together, the "UK GDPR"), retains in large part the GDPR in United Kingdom national law. The GDPR and the UK GDPR (collectively, the "Applicable UK/EU Data Protection Laws") impose comprehensive data privacy compliance obligations on controllers and processors of personal data in the EEA and the United Kingdom, including, for example, specific standards for obtaining consent from individuals to process their personal data, robust disclosures to individuals and a comprehensive individual data rights regime, and defined timelines for data breach notifications. The Applicable UK/EU Data Protection Laws create compliance obligations applicable to our business and some of our players, which can be uncertain given rapidly developing guidance and case law, and could change our business practices, expose us to significant reputational damage, regulatory enforcement actions or assessment notices (for a compulsory audit), orders to cease/change our data processing activities, and/or civil lawsuits (including class action or similar representative lawsuits) by consumers or consumer organizations, amongst others, for alleged breach of data protection laws. The Applicable UK/EU Data Protection Laws include financial penalties for noncompliance including possible fines of up to the greater of 4% of global annual revenues for the preceding financial year or €20 million, or £17.5 million in the United Kingdom, for the most serious violations. Many geographies in which we operate, including Australia, Brazil, Canada and India, have passed or are in the process of passing comparable or other robust data privacy legislation or regulation, which may lead to additional costs and increase our overall risk exposure.
We are also subject to EU and UK rules with respect to cross-border transfers of personal data out of the EEA and the UK, respectively, and recent legal developments and guidance have created complexity and uncertainty regarding such transfers to other countries, in particular in relation to transfers to the United States. In July 2020, the Court of Justice of the European Union ("CJEU") invalidated the EU-US Privacy Shield and further noted that reliance on the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism and potential alternative to the Privacy Shield) alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. A replacement for the Privacy Shield Framework was introduced, the EU-US Data Privacy Framework ("DPF"); however, this framework may also face challenges. The European Commission adopted its adequacy decision in 2023 rendering the DPF effective as an EU GDPR transfer mechanism to U.S. entities self-certified under the DPF. On October 12, 2023, the UK Extension to the DPF came into effect (as approved by the UK Government) as a UK GDPR data transfer mechanism to U.S. entities self-certified under the UK Extension to the DPF. There has been increased regulatory action and attention in relation to international data transfers.
We currently rely on the standard contractual clauses to transfer personal information outside the EEA and the UK, including to the United States, with respect to both intragroup and third party transfers. As the enforcement landscape further develops, and supervisory authorities issue further decisions and guidance on personal information export mechanisms, we could suffer additional costs, complaints and/or regulatory investigations or fines, we may have to stop using certain tools and vendors and make other operational changes, we have had to and will have to implement revised standard contractual clauses for existing intragroup, customer and vendor arrangements within required time frames, and/or if we are otherwise unable to transfer personal information between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could materially adversely affect our business, results of operations and financial condition. In particular, given the complexity and constantly evolving nature of our cross-border data transfers, our standard contractual clauses will need to be updated over time to fully legitimize our data transfers, and a failure to do so could result in enforcement action from regulators. There can be no assurances that we will be successful in our efforts to comply with the GDPR or other privacy and data protection laws and regulations, or that violations will not occur, particularly given the complexity of both these laws and our business, as well as the uncertainties that accompany new laws.
Our business also increasingly relies on machine learning, artificial intelligence and automated decision making to improve our services and tailor our interactions with our customers (see "-Risks Related to the Company's Intellectual Property-Use of generative artificial intelligence tools in our business may result in significant reputational harm and liability"). However, in recent years use of these methods has come under increased regulatory scrutiny. New laws, guidance and/or decisions in this area may limit our ability to use our machine learning and artificial intelligence, or require us to make changes to our platform or operations that may decrease our operational efficiency, result in an increase to operating costs and/or hinder our ability to improve our services. For example, there are specific rules on the use of automated decision making under the Applicable UK/EU Data Protection Laws that require the existence of automated decision making to be disclosed to the data subject with a meaningful explanation of the logic used in such decision making in certain circumstances, and safeguards must be implemented to safeguard individual rights, including the right to obtain human intervention and to contest any decision. Equally, the regulatory framework around the development and use of machine learning, artificial intelligence and automated decision making is evolving. In Europe, European Union legislators recently reached a political agreement on the EU Artificial Intelligence Act ("EU AI Act"), which establishes a comprehensive, risk-based governance framework for artificial intelligence in the EU market. The EU AI Act is expected to enter into force in 2024, and the majority of the substantive requirements will apply two years later. The EU AI Act will apply to companies that develop, use and/or provide artificial intelligence in the EU and includes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security, accuracy, general purpose artificial intelligence and foundation models, and proposes fines for breach of up to 7% of worldwide annual turnover. In addition, on September 28, 2022, the European Commission proposed two Directives seeking to establish a harmonized civil liability regime for artificial intelligence in the EU in order to facilitate civil claims in respect of harm caused by artificial intelligence and to include artificial intelligence-enabled products within the scope of the EU's existing strict liability regime. Once fully applicable, the EU AI Act will have a material impact on the way artificial intelligence is regulated in the EU, and together with developing guidance and/or decisions in this area, may affect our use of artificial intelligence and our ability to provide and to improve our services, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, operations and financial condition.
Any failure or perceived failure by us to comply with our posted privacy policies, our privacy-related obligations to players or other third parties, or any other legal obligations or regulatory requirements relating to privacy, data protection, or information security may result in governmental investigations or enforcement actions, litigation, claims (including class actions), or public statements against us by consumer advocacy groups or others and could result in significant liability, cause our players to lose trust in us, and otherwise materially and adversely affect our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to us may limit the adoption and use of, and reduce the overall demand for, our games. Additionally, if third parties we work with, such as our service providers or data sharing partners, violate applicable laws, regulations, or agreements, such violations may put our players' and/or employees' data at risk, could result in governmental investigations or enforcement actions, fines, litigation, claims (including class action claims) or public statements against us by consumer advocacy groups or others and could result in significant liability, cause our players to lose trust in us and otherwise materially and adversely affect our reputation and business. Further, public scrutiny of, or complaints about, technology companies or their data handling or data protection practices, even if unrelated to our business, industry or operations, may lead to increased scrutiny of technology companies, including us, and may cause government agencies to enact additional regulatory requirements, or to modify their enforcement or investigation activities, which may increase our costs and risks.
In addition, in some cases, we are dependent upon our platform providers to solicit, collect and provide us with information regarding our players that is necessary for compliance with these various types of regulations. Our business, including our ability to operate and expand internationally, could be adversely affected if laws or regulations are adopted, interpreted or implemented in a manner that is inconsistent with our current business practices and that require changes to these practices, the design of our games, features or our privacy policy. These platform providers may dictate rules, conduct or technical features that do not properly comply with federal, state, local and foreign laws, regulations and regulatory codes and guidelines governing data privacy, data protection and security, including with respect to the collection, storage, use, processing, transmission, sharing and protection of personal information and other consumer data. In addition, these platforms may dictate rules, conduct or technical features relating to the collection, storage, use, transmission, sharing and protection of personal information and other consumer data, which may result in substantial costs and may necessitate changes to our business practices, which in turn may compromise our growth strategy, adversely affect our ability to attract, monetize or retain players, and otherwise adversely affect our business, reputation, legal exposures, financial condition and results of operations. Any failure or perceived failure by us to comply with these platform-dictated rules, conduct or technical features may result in platform-led investigations or enforcement actions, litigation, or public statements against us, which in turn could result in significant liability or temporary or permanent suspension of our business activities with these platforms, cause our players to lose trust in us, and otherwise compromise our growth strategy, adversely affect our ability to attract, monetize or retain players, and otherwise adversely affect our business, reputation, legal exposures, financial condition and results of operations.
Player interaction with our games is subject to our privacy policy and terms of service. If we fail to comply with our posted privacy policy or terms of service or if we fail to comply with existing privacy-related or data protection laws and regulations, it could result in complaints by data subjects or proceedings or litigation against us by governmental authorities or others, which could result in fines or judgments against us, damage our reputation, non-availability of our services, impact our financial condition and harm our business. If regulators, the media or consumers raise any concerns about our privacy and data protection or consumer protection practices, even if unfounded, this could also result in fines or judgments against us, damage our reputation, and negatively impact our financial condition and damage our business.
In the area of information security and data protection, many jurisdictions have passed laws requiring notification when there is a security breach for personal information or requiring the adoption of minimum information security standards that are often vaguely defined and difficult to implement. Our security measures and standards may not be sufficient to protect personal information and we cannot guarantee that our security measures will prevent security breaches, cyber-attacks, acts of vandalism, computer viruses, malware, ransomware, denial-of-service attacks, human error issues or other similar events that lead to misplaced or lost information, programming and/or other similar issues. A security breach that compromises personal information could harm our reputation and result in a loss of player and/or employee confidence in our games and ultimately in a loss of players, which could adversely affect our business and impact our financial condition. A security breach could also involve loss or unavailability of business-critical data, and could require us to spend significant resources to mitigate and repair the breach, which in turn could compromise our growth and adversely affect our ability to attract, monetize or retain players. These risks could also subject us to liability under applicable security breach-related laws and regulations and could result in additional compliance costs, costs related to regulatory inquiries and investigations, and an inability to conduct our business. See "-If we sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences."