We collect and maintain significant amounts of personal data and other data relating to our customers and employees. A variety of federal, state and international laws and regulations, and certain industry standards, govern or apply to our collection, use, retention, sharing and security of consumer data. We are subject to certain laws, regulations, contractual obligations and industry standards (including, for example, the Payment Card Industry Data Security Standard, or PCI-DSS) relating to privacy, data protection, information security and consumer protection, which are evolving and subject to potentially differing interpretations. These requirements may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another or may conflict with other rules or our practices. As a result, our practices may not comply or may not comply in the future with all such laws, regulations, requirements and obligations. Any failure, or perceived failure, by us to comply with our privacy policies or with any federal, state or international laws, regulations, industry self-regulatory principles, industry standards or codes of conduct, regulatory guidance, orders to which we may be subject or other legal or contractual obligations relating to privacy, data protection, information security or consumer protection could adversely affect our reputation, brand and business, and may result in claims, proceedings or actions against us by governmental entities or others or other liabilities or require us to change our operations and/or cease or modify our use of certain data sets. Any such claim, proceeding or action could hurt our reputation, brand and business, force us to incur significant expenses in defense of such proceedings, distract our management, increase our costs of doing business, result in a loss of customers and suppliers or an inability to process credit card payments and may result in the imposition of monetary penalties. We may also be contractually required to indemnify and hold harmless third parties from the costs or consequences of non-compliance with any laws, regulations or other legal obligations relating to privacy or consumer protection or any inadvertent or unauthorized use or disclosure of data that we store or handle as part of operating our business.
Foreign laws and regulations relating to privacy, data protection, information security and consumer protection often are more restrictive than those in the United States. The European Union ("EU"), for example, traditionally has imposed stricter obligations under its laws and regulations relating to privacy, data protection and consumer protection than the United States. In May 2018 the European Union's new regulation governing data practices and privacy called the General Data Protection Regulation, or GDPR, became effective and substantially replaced the data protection laws of the individual European Union member states. The law requires companies to meet more stringent requirements regarding the handling of personal data of individuals in the EU than were required under predecessor EU requirements. In the United Kingdom, a Data Protection Bill that substantially implements the GDPR also became law in May 2018. The law also increases the penalties for non-compliance, which may result in monetary penalties of up to €20.0 million or 4% of a company's worldwide turnover, whichever is higher. The GDPR and other similar regulations require companies to give specific types of notice and in some cases seek consent from consumers and other data subjects before collecting or using their data for certain purposes, including some marketing activities. Outside of the European Union, many countries have laws, regulations, or other requirements relating to privacy, data protection, information security, and consumer protection, and new countries are adopting such legislation or other obligations with increasing frequency. Many of these laws may require consent from consumers for the use of data for various purposes, including marketing, which may reduce our ability to market our products. There is no harmonized approach to these laws and regulations globally. Consequently, we increase our risk of non-compliance with applicable foreign data protection laws by operating internationally. We may need to change and limit the way we use personal information in operating our business and may have difficulty maintaining a single operating model that is compliant. In addition, various federal, state and foreign legislative and regulatory bodies, or self-regulatory organizations, may expand current laws or regulations, enact new laws or regulations or issue revised rules or guidance regarding privacy, data protection, information security and consumer protection. For example, California recently adopted the California Consumer Privacy Act of 2018 ("CCPA"), which provides new data privacy rights for consumers and new operational requirements for businesses. The CCPA includes a statutory damages framework and private rights of action against businesses that fail to comply with certain CCPA terms or implement reasonable security procedures and practices to prevent data breaches. The CCPA went into effect in January 2020. The effects of the CCPA potentially are significant, however, and may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. As a general matter, compliance with laws, regulations, and any applicable rules or guidance from self-regulatory organizations relating to privacy, data protection, information security and consumer protection, may result in substantial costs and may necessitate changes to our business practices, which may compromise our growth strategy, adversely affect our ability to acquire customers, and otherwise adversely affect our business, financial condition and operating results.