The legislative, enforcement policy and regulatory framework for privacy, data protection and cybersecurity issues worldwide is rapidly evolving and complex and is likely to remain uncertain for the foreseeable future. We collect and otherwise process data, including personal data and other regulated or sensitive data, as part of our business processes and activities. This data is subject to a variety of U.S. and international laws and regulations, including oversight by various regulatory or other governmental bodies. Regulators in the United States are increasingly scrutinizing personal data transfers. For example, on December 27, 2024 the Department of Justice issued a final rule to implement Executive Order 14117 of February 28, 2024 ("Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern") implementing a new framework to protect the privacy of personal data shared between the U.S. and Europe, which may, in effect, impact privacy laws with "countries of concern" such as China or Russia. If we fail to comply with such regulation, it might impact our business to satisfy any fines or additional actions to remain compliant.
Many foreign countries and governmental bodies, including China, the European Union and other relevant jurisdictions where we conduct business, have laws and regulations concerning the collection and use of personal data, and other data obtained from their residents or by businesses operating within their jurisdictions that are currently more restrictive than those in the U.S. These laws may require that our overall information technology security environment meet certain standards and/or be certified. For example, effective May 2018, the European Union adopted the General Data Protection Regulation, or GDPR, that imposed stringent data protection requirements and provided for greater penalties for noncompliance. The United Kingdom has adopted legislation that substantially implements the GDPR and provides for a similar penalty structure. Similarly, California has adopted the California Consumer Privacy Act of 2018, or CCPA, which took effect in 2020. The CCPA gives California residents the right to access, delete and opt out of certain sharing of their information, and imposes penalties for failure to comply. California has adopted a new law, the California Privacy Rights Act of 2020 that substantially expands the CCPA and was effective as of January 1, 2023. Additionally, other U.S. states continue to propose and enact privacy and security-focused legislation. In addition, governments around the world continue to enact laws relating to privacy and data security. For example, in 2021, the National People's Congress passed the Data Security Law of the People's Republic of China, or the Data Security Law and the Personal Information Protection Law of the People's Republic of China, or PIPL. The Data Security Law is the first comprehensive data security legislation in the People's Republic of China, or China, and aims to regulate a wide range of issues in relation to the collection, storage, processing, use, provision, transaction and publication of any kind of data. In March 2024, the Cyberspace Administration of China published the Provisions on Promoting and Standardizing Cross-Border Data Flows to implement the mechanisms for the cross-border data transfers, including the security assessment. These regulations contain provisions that allow substantial government oversight and include fines for failure to obtain required approval from China's cyber and data protection regulators for cross-border personal data-related data transfers. However, there is still some uncertainty in how regulators will interpret and enforce these laws.
There are also many new and evolving laws and regulations focused on the use of AI. For example, the EU's Artificial Intelligence Act, or AI Act, was enacted on August 1, 2024. Certain of its obligations entered into effect on February 2, 2025, and the majority of its applicable provisions are currently due to become effective by August 2, 2026, although the EU's legislature may vary this date for certain obligations. The AI Act proposes a framework of prohibitions as well as disclosure, transparency, and other regulatory obligations based on various levels of risk for businesses introducing AI systems in the EU. Provisions of the AI Act could require us to alter or restrict our use of AI both in features or products available to our users and in our systems that interact with our users, depending on respective levels of risk-categorization, types of systems, and manner of use, as set forth in the AI Act. The AI Act also may require us to comply with monitoring and reporting requirements. As a result, we may need to devote substantial time and resources to evaluate our obligations under the AI Act and to develop and execute a plan designed to promote compliance. Noncompliance with the AI Act could result in fines of up to €35 million or 7% of annual global turnover for the previous year, whichever is higher. There have been numerous other laws and bills proposed at the domestic and international level aimed at regulating the deployment or provision of AI systems and services. These include, among others, the Texas Responsible Artificial Intelligence Governance Act which became effective January 1, 2026, and focuses on prohibiting harmful uses of AI, and the Colorado AI Act, which will become effective June 30, 2026, and, similar to the AI Act, provides for a regulatory risk-based framework.
The laws outlined above are only a sample of the governmental laws, regulations and other legal obligations related to privacy, data protection, cybersecurity, and AI to which we are subject. Various aspects of these laws, including their interpretation and enforcement, remain unclear, resulting in further uncertainty and potentially requiring us to modify our data practices and policies and to incur substantial additional costs and expenses in an effort to comply. Because the interpretation and application of many such laws and regulations, remain uncertain and continue to evolve, it is possible that these laws and regulations may be interpreted and applied in a manner that is inconsistent with our data management practices or the features of our products or solutions, and we could face fines, lawsuits, regulatory investigations, and other claims and penalties, and we could be required to fundamentally change our products or our business practices, all of which could have a material adverse effect on our business. Any inability, or perceived inability, to adequately address privacy and data protection concerns, or to comply with applicable laws, regulations, policies, industry standards, contractual obligations or other legal obligations, even if unfounded, could result in additional cost and liability to us, damage our reputation, inhibit sales and have a material adverse effect on our business, results of operations, and financial condition.