Various local, state, federal, and international laws, directives, and regulations apply to our collection, use, retention, protection, disclosure, transfer, and any other processing of personal data. There is uncertainty and inconsistency in how these data protection and privacy laws and regulations are interpreted and applied, and they continue to evolve in ways that could adversely impact our business. These laws have a substantial impact on our operations directly as a data controller/business and as a data processor/service provider and handler for various offshore entities.
In the United States, state and federal lawmakers and regulatory authorities have increased their attention on the collection and use of consumer data. While our current product offering does not target retail consumers, some of our prior products have been offered to retail consumers. In the United States, non-sensitive consumer data generally may be used under current rules and regulations, subject to certain restrictions, so long as the consumer does not affirmatively "opt out" of the collection or use of such data. If an "opt-in" model or additional required "opt-outs" were to be adopted in the United States, less data could be available, and the cost of data would be higher.
California has enacted the California Consumer Privacy Act, or the CCPA, along with related regulations, in 2020 and the California Privacy Rights Act, or the CPRA, which has been passed and became effective on January 1, 2023. The CCPA gives California residents new rights to access and request deletion of their personal data, opt out of the sale of personal data, and receive detailed information about how their personal data is processed. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that involving the loss of personal data. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. The CPRA significantly modifies the CCPA, including by expanding consumers' rights with respect to certain personal data and creating a new state agency to oversee implementation and enforcement efforts. The CCPA and CPRA may increase our compliance costs and potential liability, particularly in the event of a data breach, and could have a material adverse effect on our business, including how we use personal data, our financial condition, and our operating results.
Additionally, the CCPA has prompted a number of proposals for new federal and state-level privacy legislation, such as in Nevada, Virginia, Colorado, and others. Virginia's legislation, the Consumer Data Protection Act, or CDPA, passed and becomes effective January 1, 2023. On June 8, 2021, the state of Colorado passed its bill, which is pending signature by the state governor. As of June 11, 2021, five states have proposed legislation under consideration in the local legislatures. As each new state law is passed, it could add increasing complexity to and significantly expand the scope of our compliance efforts, impact our business strategies, increase our potential liability, increase our compliance costs, and adversely affect our business.
As a result of our presence in Europe and our service offering in the European Union, we are subject to the European General Data Protection Regulation, which imposes stringent EU data protection requirements, and could increase the risk of non-compliance and the costs of providing our products and services in a compliant manner. A breach of the GDPR could result in regulatory investigations, reputational damage, fines and sanctions, orders to cease or change our processing of our data, enforcement notices, or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm.
Additionally, the UK Data Protection Act contains provisions, including its own derogations, for how GDPR is applied in the UK. We have to continue to comply with the GDPR and also the Data Protection Act, with each regime having the ability to fine up to the greater of €20 million (£17 million) or 4% of annual global turnover. The relationship between the UK and the EU remains uncertain, for example how data transfers between the UK and the EU and other jurisdictions will be treated and the role of the UK's supervisory authority. On June 28, 2021, the European Commission issued the UK with an "adequacy decision" to facilitate the continued free flow of personal data from EU member states to the UK. However, this adequacy decision has a limited duration of four years in case there is a future divergence between EU and UK data protection laws. In the event that the UK maintains an equivalent standard.at the end of the four year period, it is open to the European Commission to renew its finding. In the event that the adequacy decisions is not renewed after this time, the adjustments required to facilitate data transfers from EU member states to the UK will lead to additional costs as we try to ensure compliance with new privacy legislation and will increase our overall risk exposure.
In addition, the GDPR imposes strict rules on the transfer of personal data out of the EU to a "third country", including the United Kingdom or the United States. These obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other requirements or our practices. On July 16, 2020, the Court of Justice of the European Union invalidated the European Union-United States "Privacy Shield" (under which personal data could be transferred from the EU to U.S. entities that had self-certified under the Privacy Shield scheme) on the grounds that the Privacy Shield failed to offer adequate protections to EU personal data transferred to the United States. In addition, while the ECJ upheld the adequacy of the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield), it made clear that reliance on them alone may not necessarily be sufficient in all circumstances.
Use of the standard contractual clauses must now be assessed on a case by case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals. The use of standard contractual clauses for the transfer of personal data specifically to the United States remains under review by a number of European data protection supervisory authorities, along with those of some other E.U. member states.
German and Irish supervisory authorities have indicated, and enforced in recent rulings, that the standard contractual clauses alone provide inadequate protection for E.U.-U.S. data transfers. As supervisory authorities continue to issue further guidance on personal data, we could suffer additional costs, complaints, or regulatory investigations or fines, and if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.
We are also subject to evolving EU privacy laws on cookies and e-marketing. In the European Union, regulators are increasingly focusing on compliance with requirements in the online behavioral advertising ecosystem, and an EU regulation known as the ePrivacy Regulation will significantly increase fines for non-compliance once in effect. In the European Union informed consent, including a prohibition on pre-checked consents and a requirement to ensure separate consents for each cookie, is required for the placement of a cookie or similar technologies on a user's device and for direct electronic marketing. As regulators start to enforce the strict approach in recent guidance, this could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, negatively impact our efforts to understand customers, adversely affect our margins, increase costs, and subject us to additional liabilities.
As these and other laws and regulations may continue to evolve and be enacted, or new interpretations of existing laws and regulations apply, it may require us to modify our data-processing practices, agreements and policies and to incur substantial costs in order to comply with this evolving regulatory landscape. Restrictions on the collection, use, sharing or disclosure of personal information or additional requirements and liability for security and data integrity could require us to materially modify our solutions and features, could limit our ability to develop new services and features and could subject us to increased compliance obligations and regulatory scrutiny. We use a variety of technical and organizational security measures and other measures to protect the data we process, in particular personal data pertaining to our customers, employees and business partners. Despite measures we put in place, we may be unable to anticipate or prevent unauthorized access to such personal data.
There is a risk that as we expand, we may assume liabilities for breaches experienced by the companies we acquire. Despite our efforts to comply with applicable laws, regulations and other obligations relating to privacy, data protection, and information security, it is possible that our practices or technology could fail, or be alleged to fail to meet applicable requirements. For instance, the overall regulatory framework governing the application of privacy laws to blockchain technology is still highly undeveloped and likely to evolve. Despite our efforts to choose vendors that meet applicable laws, regulations and other obligations relating to privacy, data protection, and information security and maintain robust security controls, it is possible that a vendor could fail to comply or experience a data breach impacting our data and our business. Our failure, or the failure by our third-party providers or partners, to comply with applicable laws or regulations and to prevent unauthorized access to, or use or release of personal data, or the perception that any of the foregoing types of failure has occurred, could damage our reputation or result in fines or proceedings by governmental agencies and private claims and litigation, any of which could adversely affect our business, operating results, and financial condition.