Numerous state, federal and international laws, rules and regulations govern privacy, data protection and the collection, use and protection of personal information and other types of data we collect, use, disclose and otherwise process. These laws, rules and regulations are constantly evolving, and we expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the EU and other jurisdictions. For example, the California Consumer Privacy Act (the "CCPA"), requires covered companies to provide disclosures to California consumers and afford such consumers qualified privacy rights, such as rights of access, deletion and to opt-out of the sales and "sharing" of their personal information, which relates to "cross context behavioral advertising" or more commonly known as targeted advertising. The CCPA was amended by the California Privacy Rights Act (the "CPRA"), which went into effect on January 1, 2023. The CCPA, as amended, removes the exclusion of employment data from its auspices, adds new consumer privacy rights (such as the right to correct inaccurate personal information, or the right to opt out of the "sharing" of personal information for the purposes of cross-context behavioral advertising), expands business's obligations to secure contractual obligations from service providers and third parties, and expands business's obligations with respect to automated opt-out preference signals. The new California Privacy Protection Agency completed its first round of rulemaking but has left many new requirements, such as data privacy and security risk assessments and the right to opt out of certain data profiling activities, for its second round of rulemaking, which began in March 2023 and has yet to be finalized. It remains unclear how these new amendments will be interpreted or when the second round of rulemaking activity will conclude. The CCPA may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. Similarly, several other U.S. states, including Virginia, Connecticut, Colorado, Utah, Delaware, Iowa, Indiana, Maryland, Montana, Minnesota, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee and Texas have passed similar consumer data privacy laws that impose general data minimization obligations on covered businesses and also extend privacy rights to individuals, including the rights to opt out of targeted advertising and respect automated opt-out preference signals. Finally, the European Commission adopted a General Data Protection Regulation that became fully effective on May 25, 2018, imposing stringent EU data protection requirements. Recent litigation in the EU has driven significant changes in enforcement and interpretation, and we cannot yet fully determine the impact these or future laws, rules and regulations may have on our business or operations.
Given the increased regulatory focus on the use of data for advertising, we may be subject to new and unexpected regulatory interpretations and rulemaking efforts, including proposals for regulation of artificial intelligence or other automated decision making processes. Future laws, regulations, standards and other obligations could, for example, impair our ability to collect or use information that we utilize to create targeted marketing and advertising and offer certain bespoke product features and other capabilities to drive efficiencies in our merchandising operations, thereby impairing our ability to maintain and attract new consignors and buyers, which could have a material adverse effect on our business and operating results.
These laws, rules and regulations may be inconsistent from one jurisdiction to another, subject to differing interpretations and may be interpreted to conflict with our practices. Any failure or perceived failure by us or any third parties with which we do business to comply with these laws, rules and regulations, or with other obligations to which we or such third parties are or may become subject, may result in actions against us by governmental entities, or litigation, and the expenditure of legal and other costs and of substantial time and resources, and fines, penalties or other liabilities.
Further, in view of new or modified federal, state or foreign laws and regulations, industry standards, contractual obligations and other legal obligations, or any changes in their interpretation, we may find it necessary or desirable to change our business activities and practices or to expend significant resources to modify our product or services and otherwise adapt to these changes. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited.