We collect and maintain significant amounts of data relating to our customers, employees and others. We use this information for a variety of business purposes, including to provide services and relevant products to consumers, to support, expand and improve our business, and for marketing and advertising efforts. We store, handle, and process personal data on our own information systems, as well as through arrangements with third-parties and service providers. A variety of European and other region's and countries' laws and regulations, and certain industry standards, govern or apply to our collection, use, retention, sharing and security of personal data. We are subject to certain laws, regulations, contractual obligations and industry standards (including, for example, the PCI-DSS, the GDPR and the German Federal Data Protection Act) relating to privacy, data protection and localization, information security and customer protection. These requirements increase our operating costs and may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another or may conflict with other rules or our practices. As a result, our practices may not have complied or may not comply in the future with all such laws, regulations, requirements and obligations. Existing and future laws and regulations, or the enforcement of such laws and regulations, including with regard to data localization requirements and restrictions on data sharing and cross-border data transfers, could impede the growth of e-commerce or online marketplaces and negatively impact our business and operations. Any failure, or perceived failure, by us to comply with our privacy policies or with any Dutch, German, European, or other regions' or countries' laws, regulations, industry self-regulatory principles, industry standards or codes of conduct, regulatory guidance, orders to which we may be subject or other legal or contractual obligations relating to privacy, data protection and localization, information security or customer protection could adversely affect our reputation, brand and business, and may result in claims, proceedings or actions against us by governmental entities or others or other liabilities or require us to change our operations and/or cease or modify our use of certain data sets. Any such claim, proceeding or action could hurt our reputation, brand and business, force us to incur significant expenses in defense of such proceedings, distract our senior management, increase our costs of doing business, result in a loss of customers and suppliers or an inability to process credit card payments and may result in the imposition of monetary penalties.
In Europe, where we have significant business operations, the data privacy and information security regime has been through a significant change and continues to evolve. The collection and processing of personal data is subject to increasing regulatory scrutiny in the European Union and the United Kingdom. The GDPR and the UK data protection regime ("UK GDPR") have stringent operational requirements for companies, including retailers, regarding information practices, such as expanded disclosures to consumers about how we collect and process their personal data, increased controls on profiling consumers and increased rights for consumers to access, control and delete their personal data. Recent case law has also increased requirements in relation to international transfers of personal data. In addition, there are mandatory data breach notification requirements and significantly increased penalties for non-compliance with each regime. Since January 1, 2021 (when the transitional period following the United Kingdom's withdrawal from the European Union expired), we have been required to comply with GDPR and the UK GDPR. Each regime has the ability to fine us up to the greater of €20 million (£17.5 million) or 4% of global turnover for non-compliance.
In recent years, U.S. and EU lawmakers and regulators have expressed concern over the use of third-party cookies and similar technologies for online behavioral advertising, and enacted and enforced with increasing efforts laws and regulations significantly restricting companies' ability to engage in online behavioral advertising without burdensome and costly compliance measures. In the European Union, regulators are increasingly focusing on compliance with requirements in the online behavioral advertising ecosystem, and current national laws that implement the existing ePrivacy Directive are expected to be supplemented or replaced by an EU regulation known as the ePrivacy Regulation which may increase fines for non-compliance, which are already now significant. In the European Economic Area (EEA) and United Kingdom, informed consent is required for the placement of a cookie on a user's device, unless such cookie is strictly necessary to provide explicitly requested services. Consent is already required for many forms of direct electronic marketing. The GDPR and UK GDPR impose conditions on obtaining valid consent, such as, according to authorities and courts, a prohibition on pre-checked consents and a requirement to ensure separate consents are sought for each type of cookie or similar technology. While the ePrivacy Regulation is still under development, recent European court decisions and regulators' recent guidance are driving increased attention to cookies and tracking technologies. Changes to how we use cookies and related technology could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities. Regulation of cookies and similar technologies may lead to broader restrictions on our marketing and personalization activities and may negatively impact our efforts to understand users' online shopping and other relevant online behaviors, as well as the effectiveness of our marketing and our business generally. The advertising technology ecosystem may not be able to adapt to the legal changes around the use of tracking technologies, which may have a negative effect on businesses, including ours, that collect and use online user information for consumer acquisition and marketing. Any decline of cookies or other online tracking technologies as a means to identify and target potential purchasers may increase the cost of operating our business and lead to a decline in revenues. In addition, uncertainties about the legality of cookies and other tracking technologies may lead to regulatory scrutiny and increase potential civil liability under data protection or consumer protection laws. In response to marketplace concerns about the use of third-party cookies and web beacons to track user behaviors, providers of major browsers have included features that allow users to limit the collection of certain data generally or from specified websites, and the draft ePrivacy Regulation also advocates the development of browsers that block cookies by default. These developments and other privacy-oriented software changes by operating systems or other third-parties, such as Google's and Apple's app tracking transparency features, have impaired our ability to collect user information, including personal data and usage information, that helps us provide more targeted advertising to our current and prospective consumers, and could adversely affect our business, in light of our use of cookies and similar technologies to target our marketing and personalize the customer experience.
In the United States, which is also a significant market for our goods and services, federal and state governments have adopted and are considering, laws, guidelines or rules for the collection, distribution, use and storage of information collected from or about consumers or their devices. For example, California has enacted the California Consumer Privacy Act ("CCPA") which went into effect on January 1, 2020. The law imposes new requirements on companies doing business in California and meeting other size or scale criteria for collecting or using information collected from or about California residents, affords California residents the ability to opt out of certain disclosures of personal information, and grants rights to access or request deletion of personal information. The CCPA implementing regulations are being supplemented by the California Privacy Protection Agency, which was established in 2021 based on the 2020 ballot initiative to enact the California Privacy Rights Act ("CPRA"). CPRA imposes additional data protection obligations on companies doing business in California, including additional consumer rights processes and opt-outs for certain uses of sensitive data and sharing of personal data for cross-context behavioral advertising. CPRA was signed into law on December 16, 2020 with most provisions not coming into effect until January 2023. The CCPA, as amended by the CPRA, and similar laws passed by other U.S. states, including Nevada, Virginia, Colorado, Utah and Connecticut could have an adverse effect on our business, results of operations, and financial condition.
The effects of the CCPA and similar state laws are potentially significant and may require us to modify our data collection or processing practices and policies, may incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement or litigation. Similar laws have been proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that could make compliance with such laws challenging.
The People's Republic of China (the "PRC") have enacted numerous laws, regulations and guidelines concerning data security (collectively "Data Security Law") to regulate data activities, safeguard data security, promote data development and usage, protect individuals and entities' legitimate rights and interests, and safeguard state sovereignty, state security and development interests. The Data Security Law applies to a broad range of activities that involve "data" (not only personal or sensitive data).
The evolving data security landscape and potential for heightened government enforcement actions could lead to compliance risks and increased costs in our operations in the PRC. Failure to comply with such requirements may adversely affect our business and operations in the PRC region.
In addition to the privacy, data protection and data security laws discussed above, many other countries and jurisdictions continue to pass laws related to data protection, such as data privacy and data breach notification laws, resulting in a diverse set of requirements across states, countries and regions. The complexity of navigating these varying data protection laws is particularly acute for our business due to our global reach. In addition, the legal landscape relating to the transfer of personal data continues to evolve and remains uncertain in many jurisdictions. Many data protection regimes apply based on where the consumer is located, and as we expand and new laws are enacted or existing laws change, we may be subject to new laws, regulations or standards or new interpretations of existing laws, regulations or standards, including those in the areas of data security, data privacy and regulation of email providers and those that require localization of certain data (such as in Russia, the PRC and Indonesia), which could require us to incur additional costs and restrict our business operations.
Failures or perceived failures by us to comply with rapidly evolving privacy or security laws, policies (including our own stated privacy policies), legal obligations or industry standards or any security incident that results in the unauthorized release or transfer of personally identifiable information or other personal or consumer data may result in governmental enforcement actions, litigation (including consumer class actions), fines and penalties or adverse publicity and could cause our consumers to lose trust in us, which could have a material adverse effect on our business, results of operations, financial condition and prospects.