Our business operations involve the collection, transfer, use, disclosure, storage, disposal and other processing of personal or sensitive information around the world, including the United States and the United Kingdom and the European Economic Area ("EEA"). We collect, store, transmit, and use personal information relating to, among others, our employees, consumers, and event participants. As a result, our business is subject to complex and continually evolving (and at times conflicting) U.S. (federal, state and local) and international laws and regulations regarding data privacy and data protection. Many of these laws and regulations are subject to change and uncertain interpretation and could result in claims, changes to our business practices, penalties, increased cost of operations, or otherwise harm our business.
For example, in Europe, member states have adopted or modified data privacy and security laws and regulations that may apply to our business, such as the General Data Protection Regulation 2016/679 and applicable national supplementing laws ("EU GDPR") and in the United Kingdom, the United Kingdom data protection regime consisting primarily of the U.K. General Data Protection Regulation and Data Protection Act of 2018 ("UK GDPR", and together with the EU GDPR, the "GDPR"). The GDPR imposes comprehensive data privacy compliance obligations and creates requirements for in-scope businesses regarding the processing of personal data, broadly defined as information relating to an identifiable person including a principle of accountability and the obligation to demonstrate compliance through policies, procedure, training and audit. EU member states also have some flexibility to supplement the GDPR with their own laws and regulations and may apply stricter requirements for certain data processing activities. As a result of the exit of the United Kingdom from the European Union, the UK GDPR will not automatically incorporate any future changes made to the EU GDPR going forward (which would need to be specifically incorporated by the United Kingdom government). Moreover, the United Kingdom government has publicly announced plans to reform the UK GDPR in ways that, if formalized, are likely to deviate from the EU GDPR in certain areas, which creates a risk of divergent parallel regimes and related uncertainty, along with the potential for increased compliance costs and risks for affected businesses. We are monitoring such developments and the impact this may have on our business.
Under the GDPR, and other privacy regimes globally, we are subject to rules regarding cross-border transfers of personal data. Recent legal developments in Europe have created complexity and uncertainty regarding transfers of personal data from the EEA and United Kingdom to the U.S. and other jurisdictions. For example, in 2020, the Court of Justice of the European Union invalidated the EU-US Privacy Shield Framework, under which personal data could be transferred from the EEA to relevant self-certified U.S. entities, and further noted that reliance on the standard contractual clauses alone (a standard, non-negotiable form of contract approved by the European Commission) may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. Subsequent European court and regulatory decisions have taken a restrictive approach to international data transfers. The UK regulator has adopted a similar approach to data export outside of the UK and, in 2022, the international data transfer agreement and the international data transfer addendum to the European Commission's standard contractual clauses for international data transfers came into force. The UK regulator also recommends, consistent with the European Commission approach, a documented transfer risk assessment is undertaken.
We currently generally rely on the standard contractual clauses issued by the EU Commission and the UK government as well as other data sharing agreements to legitimize transfers of personal information outside the EEA and the UK, including to the United States. A replacement for the Privacy Shield Framework, the EU-US Data Privacy Framework, became effective in 2023; however, this framework is already facing challenges similar to those that resulted in the invalidation of the Privacy Shield Framework. We expect the existing legal complexity and uncertainty regarding international data transfers to continue. As supervisory authorities within the EEA issue further guidance on international data transfers under the GDPR, and as enforcement actions continue, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or it could affect our operations and the manner in which we provide our services (for example, we may have to stop using certain tools and vendors and make other operational changes). ). In particular, given the complexity and constantly evolving nature of our cross-border data transfers, the standard contractual clauses and associated safeguards will need to be updated over time to fully legitimize our data transfers, and a failure to do so could result in enforcement action from regulators. Although the United Kingdom currently has an adequacy decision from the European Commission, such that standard contractual clauses are not required for the transfer of personal data from the EEA to the UK, that decision will sunset in June 2025 unless extended and it may be revoked in the future by the European Commission if the UK data protection regime is reformed in ways that deviate substantially from the EU GDPR. There can be no assurances that we will be successful in our efforts to comply with the GDPR or other privacy and data protection laws and regulations, or that violations will not occur, particularly given the complexity of both these laws and our business, as well as the uncertainties that accompany new laws. In addition, cloud service providers upon which our services depend are experiencing heightened scrutiny from EU regulators, which may lead to significant shifts or unavailability of cloud services to transfer personal information outside the EU, which may significantly impact our costs or ability to operate.
We monitor the regulatory, judicial and legislative environment and have invested in addressing these developments. These new laws may require us to make additional changes to our practices and services to enable us or our customers to meet the new legal requirements, and may also increase our potential liability exposure through new or higher potential penalties for noncompliance. As an example, the Digital Services Act ("DSA") in the EU came into force in November 2022 and the majority of its substantive provisions took effect in February 2024. The DSA imposes new obligations around illegal services or content that may be hosted through our services, traceability of business users, and enhanced transparency measures, and failure to comply can result in fines of up to 6% of total annual worldwide turnover. Another example, is the EU's Data Act, which creates a regulatory framework to govern the sharing, use and re-use of internet of product-generated data and imposes, among other obligations, certain requirements concerning cross-border international transfers of, and governmental access to, non-personal data outside the EEA. Depending on how this Act and any similar laws are implemented and interpreted, we may have to adapt our business practices, and contractual arrangements to comply with such obligations.
In addition, in recent years, in the United States certain states have adopted or modified data privacy and security laws and regulations that may apply to our business. For example, the CCPA requires businesses that process the personal information of California residents to among other things provide certain disclosures to California residents regarding the business's collection, use and disclosure of their personal information; receive and respond to requests from California residents to access, delete, and correct their personal information, and opt-out of certain disclosures of their personal information; and enter into specific contractual provisions with service providers that process California resident personal information on the business's behalf. The effects of this legislation are far-reaching and have required and may continue to require us to modify our data processing practices and policies and to incur significant costs and expenses in an effort to comply. The enactment of the CCPA has also prompted a wave of similar data privacy laws in other states across the United States. For example, since the CCPA went into effect, general data privacy statutes that share similarities with the CCPA are now in effect and enforceable in Virginia, Colorado, Connecticut, Utah, Florida, Texas, Montana, Oregon, Delaware, Iowa, New Hampshire, Nebraska and New Jersey, and will soon be enforceable in several other states as well. Similar laws have been proposed in many other states and at the federal level as well. Recent, new, and proposed state and federal legislation relating to data privacy may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional compliance programs, could impact strategies and availability of previously useful information, and could result in increased compliance costs and/or changes in business practices and policies.
Besides the UK, EEA and the United States, our global reach means we may be or become subject to other privacy regimes, and new laws are being enacted regularly, including laws which may have potentially conflicting requirements that would make compliance challenging. If the trend of increasing enforcement by regulators of such laws as reflected in recent guidance and decisions continues, this could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities. For example, UFC operates a UFC Performance Institute, among other significant operations, in China. As such, we may be subject to various aspects of the country's onerous data compliance regime, which can include the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law ("PIPL"). In addition, the relevant government authorities of China promulgated several regulations or released a number of draft regulations for public comments that are designed to provide further implementation guidance in accordance with these laws. We cannot predict what impact the new laws and regulations or the increased costs of compliance, if any, will have on our operations in China, in particular the Data Security Law or PIPL, due to their recent enactment and the limited guidance available. It is also generally unclear how the laws will be interpreted and enforced in practice by the relevant government authorities as these laws are drafted broadly and, thus, leave great discretion to the relevant government authorities to exercise.
Further, we are subject to laws, regulations and standards in the United States covering marketing, advertising, cookies, tracking technologies, e-marketing, and other activities conducted by telephone, email, mobile devices and the internet, such as the Federal Communications Act, the Federal Wiretap Act, the Electronic Communications Privacy Act, the Telephone Consumer Protection Act, the Children's Online Privacy Protection Act, the Controlling the Assault of Non-Solicited Pornography and Marketing Act, the Video Privacy Protection Act (the "VPPA"), and similar state consumer protection and communication privacy laws. Numerous class-action suits under federal and state laws have been filed in recent years against companies who conduct telemarketing and/or SMS texting programs, with many resulting in multi-million-dollar settlements to the plaintiffs. We have received one or more claims of violation of the VPPA, though none resulting in significant liability or expense.
Finally, regulation of cookies and similar technologies, and any use of cookies or similar online tracking technologies as a means to identify and potentially target users, may lead to broader restrictions and impairments on our marketing and personalization activities and may negatively impact our efforts to better understand users. Recent U.S. and European court and regulator decisions are driving increased attention to cookies and tracking technologies and privacy activists are referring non-compliant companies to regulators. In the EU and the UK, informed consent is required for the placement of certain cookies or similar technologies on a customer's or user's device and for direct electronic marketing. The GDPR also imposes conditions on obtaining valid consent, such as a prohibition on pre-checked consents and a requirement to ensure separate consents are sought for each type of cookie or similar technology. Regulators are increasingly focusing on compliance with current national laws that implement the ePrivacy Directive. If the trend of increasing enforcement by regulators of the strict approach including opt-in consent for all but essential use cases, as seen in recent guidance and decisions continues, this could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, and subject us to additional liabilities.
The effects of any applicable U.S. federal, state and local laws and regulations, and international laws and regulations that are currently in effect or that may go into effect in the future, are significant (and penalties for non-compliance may be assessed based on a percentage of revenue) and may require us to modify our data processing practices and policies and to incur substantial costs and potential liability in an effort to comply with such laws and regulations. Responding to allegations of non-compliance, whether or not true, could be costly, time consuming, distracting to management, and cause reputational harm. In addition to government regulation, privacy advocates and industry groups may propose new and different self-regulatory standards. Because the interpretation and application of privacy and data protection laws are still uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent with one another or inconsistent with our existing data management practices or the features of our products and services. Any actual or perceived failure to comply with these and other data protection and privacy laws and regulations could result in regulatory scrutiny and increased exposure to the risks of litigation (including class action lawsuits) or the imposition of consent orders, enforcement notices, assessment notices (for a compulsory audit), resolution agreements, orders to cease/change our processing of personal data, requirements to take particular actions with respect to training, policies or other activities, and civil and criminal penalties, including fines, which could harm our business. In addition, we or our third-party service providers could be required to fundamentally change our business activities and practices or modify our products and services, which could harm our or our third-party service providers' businesses. Any of the foregoing could result in additional cost and liability to us, damage our reputation, inhibit sales, and harm our business.