Food products are extensively regulated in most of the countries in which we sell our products. We are subject to numerous laws and regulations relating to the growing, sourcing, manufacturing, storage, labeling, marketing, advertising and distribution of food products, as well as laws and regulations relating to financial reporting requirements, the environment, consumer protection, product design, competition, anti-corruption, privacy, machine learning and artificial intelligence, relations with distributors and retailers, foreign supplier verification, customs and trade laws, including the import and export of products and product ingredients, employment, and health and safety. Enforcement of existing laws and regulations, including changes in the enforcement priorities of regulators, changes in legal requirements, and/or evolving interpretations of existing regulatory requirements may result in increased compliance costs and create other obligations, financial or otherwise, that could adversely affect our business, financial condition or operating results. Increased regulatory scrutiny of, and increased litigation involving, product claims and concerns regarding the attributes of food products and ingredients may increase compliance costs and create other obligations that could adversely affect our business, financial condition or operating results. Governments may also impose requirements and restrictions that impact our business, such as labeling disclosures pertaining to ingredients. For example, "Proposition 65, the Safe Drinking Water and Toxic Enforcement Act of 1986," in California exposes all food companies to the possibility of having to provide warnings on their products in that state. If we were required to add warning labels to any of our products or place warnings in locations where our products are sold in order to comply with Proposition 65, the sales of those products and other products of our company could suffer, not only in those locations but elsewhere.
In addition, there are various compliance obligations for companies that process personal data of certain individuals, including such obligations required by the European Union's General Data Protection Regulation (GDPR), which affects all member states of the European Economic Area, and the California Consumer Privacy Act (CCPA). These types of data privacy laws create a range of compliance obligations for companies that process personal data of certain individuals and increases financial penalties for non-compliance. Our efforts to comply with these privacy and data protection laws may not be successful, or may be perceived to be unsuccessful, which could adversely affect our business in the United States, the European Union and in other countries.
In the United States, for example, the CCPA imposes requirements on companies that do business in California and collect personal information from certain individuals, including notice, consent and service provider requirements. The CCPA also provides for civil penalties for companies that fail to comply with these requirements, as well as a private right of action for data breaches. Further, the California Privacy Rights Act (CPRA) went into full effect on January 1, 2023 (with a ‘look-back' to January 1, 2022). The CPRA builds on the CCPA and among other things, requires the establishment of a dedicated agency to regulate privacy issues. In 2021, Virginia, Colorado, Connecticut and Utah adopted laws which have now taken effect introducing new privacy obligations, which have required us to develop additional compliance mechanisms and processes. Many other states are considering similar legislation. A broad range of legislative measures also have been introduced at the federal level. There also is a wide range of enforcement agencies at both the state and federal levels that can review companies for privacy and data security concerns based on general consumer protection laws. The Federal Trade Commission and state Attorneys General all are aggressive in reviewing privacy and data security protections for consumers. Accordingly, failure to comply with federal and state laws (both those currently in effect and future legislation) regarding privacy and security of personal information could expose us to fines and penalties under such laws. There also is the threat of consumer class actions related to these laws and the overall protection of personal data. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business.
Similarly, outside of the United States, there are various laws and regulations governing the collection, use, disclosure, transfer, or other processing of personal data. For instance, the GDPR, which applies to the processing of personal data of individuals in the European Union, is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including strict rules on the transfer of personal data to countries outside the European Union, including the United States. Beyond GDPR, there are privacy and data security laws in a growing number of countries around the world (including in the United Kingdom as a result of Brexit). While many loosely follow GDPR as a model, other laws contain different or conflicting provisions. These laws may impact our ability to conduct our business activities and the costs associated with these activities.