Concerns about our practices with regard to the collection, use, retention, transfer, disclosure, processing and security of personal information or other privacy-related matters, such as cybersecurity breaches, misuse of personal data and data sharing without necessary safeguards, even if unfounded, could damage our reputation and operating results. MENA is our key market, and we have data centers with servers that collect and process our user data mainly in Germany and the United States. In addition, we also store data locally in Oman, Qatar and UAE. As of December 31, 2023, our platform was available in over 160 countries. The United Arab Emirates issued Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data which came into effect on January 2, 2022. See "Item 4. Information on the Company-B. Business Overview-Regulation-United Arab Emirates-Regulations Relating to Technology Media and Telecommunications-Data protection laws" for details. Furthermore, the regulatory frameworks regarding privacy issues in many jurisdictions are constantly evolving and can be subject to significant changes from time to time, and therefore we may not be able to comprehensively assess the scope and extent of our compliance responsibility at a global level. For example, the PRC regulatory frameworks with regard to data security and data protection is evolving. The PRC Civil Code, the PRC Cyber Security Law, the Personal Information Protection Law, the Provisions on the Cyber Protection of Children's Personal Information, the Regulation on the Protection of Minors in Cyberspace and the PRC Data Security Law set forth the regime to protect individual privacy and personal data security in general by requiring internet service providers to collect data in accordance with the laws and in proper manner, and obtain consents from internet users prior to the collection, use or disclosure of internet users' personal data, and the PRC Cyber Security Law sets high requirements for the operational security of facilities deemed to be part of China's "critical information infrastructure." Furthermore, the Cybersecurity Review Measures, the Measures for the Security Assessment of Data Cross-border Transfer and the Provisions on Promoting and Regulating Cross-border Data Flow require that a "network platform operator" that possesses personal information of more than one million users apply for a cybersecurity review when seeking overseas listing, and that a data processor apply for security assessment for its cross-border data transfer based on the importance and amount of the data transferred. See "Item 4. Information on the Company-B. Business Overview-Others-Regulations Relating to Personal Privacy and Data Protection." The developing requirements relating to clear and prominent privacy notices (including in the context of obtaining informed and specific consents to the collection and processing of personal data, where applicable) may potentially deter users from consenting to certain uses of their personal information. In general, negative publicity of us or our industry regarding actual or perceived violations of our users' privacy-related rights, including fines and enforcement actions against us or other similarly placed businesses, may also impair users' trust in our privacy practices and make them reluctant to give their consent to share their data with us.
This risk is enhanced in certain jurisdictions with stringent, extra-territorial data protection laws, and the three regulations that have significant impacts on our industry are the General Data Protection Regulation (EU) 2016/679 that became applicable on May 25, 2018, or the GDPR, the California Consumer Privacy Act that became effective on January 1, 2020, or the CCPA, and the California Privacy Right Act that became effective on January 1, 2023, or the CPRA. The GDPR places stringent obligations and operational requirements on processors and controllers of personal data, including, for example, requiring expanded disclosures to data subjects about how their personal data is to be used, limitations on retention of information, mandatory data breach notification requirements, and higher standards for data controllers to demonstrate that they have obtained either valid consent or have another legal basis in place to justify their data processing activities. The GDPR also enhances the rights of data subjects, who may, for example, request access to their personal data, the deletion and amendment of their personal data, or to have their personal data transferred to another service provider. Data subjects also have the right to be compensated for any material or non-material damage suffered as a result of a controller or processor's non-compliance with the GDPR. Under the GDPR, data protection supervisory authorities are also given various enforcement powers, including that they can levy fines of up to EUR20 million or up to 4% of an organization's total worldwide annual turnover for the preceding financial year, whichever is higher, for non-compliance, which significantly increases our potential financial exposure for non-compliance. While the GDPR provides a more harmonized approach to data protection regulation across the EU member states, it also gives EU member states certain areas of discretion and therefore laws and regulations in relation to certain data processing activities may differ on a member state by member state basis, which could further limit our ability to use and share personal data and could require localized changes to our operating model. The EU has also released a proposed Regulation on Privacy and Electronic Communications 2002, or the ePrivacy Regulation, to replace the EU's current Privacy and Electronic Communications Directive, or the ePrivacy Directive, to, among other things, achieve a greater harmonization among EU member states and better align the rules governing online tracking technologies and electronic communications (for example, in relation to the use of cookies and similar technologies and protection against email spam) with the requirements of the GDPR. While the ePrivacy Regulation was originally intended to be adopted on May 25, 2018 (alongside the GDPR), it is currently going through the European legislative process. The current draft of the ePrivacy Regulation significantly increases fining powers to the same levels as GDPR and may lead to broader restrictions on our online activities, including efforts to understand followers' Internet usage and promote ourselves to them.
Outside of the EU, many jurisdictions have adopted or are adopting new data privacy and data protection laws, which may result in additional expenses to us and increase the risk of non-compliance. For example, the CCPA creates new data privacy rights for users and new operational requirements for businesses. The CCPA gives California residents rights to access and delete their personal information, opt out of sales of personal information and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CPRA builds on the CCPA and further supplements and strengthens the compliance requirements within CCPA in many aspects. For example, the CPRA expands the scope of information that consumers can request from companies, further allows California residents to opt out of both personal data sales and data sharing, supplements a 12-month waiting period to re-obtain the consent for the right of opt-in of minors, and entitles California residents to correct their personal information, restrict the processing of, access to, and opt-out of automated decision making for sensitive personal information, and request the company to transfer their personal information to another service provider. The CPRA also imposes greater penalties for violations involving the personal information of minors. Fines for such violations can be up to three times the amount of the standard penalties under the law. Furthermore, we may need to comply with regulations in other territories that may impose further onerous compliance requirements, such as data localization, which prohibits companies from storing data relating to resident individuals in data centers outside the jurisdiction. The proliferation of such laws within jurisdictions and countries in which we operate may result in conflicting and contradictory requirements.
While we strive to comply with our data privacy guidelines as well as all applicable data protection laws and regulations or contract obligations, any failure or perceived failure to comply, including in relation to lawful basis of data processing and providing users with sufficient information with respect to our use of their personal data, may result in proceedings or actions against us, including fines and penalties on us, by government entities or proceedings or actions against us by our business partners or others (including enforcement orders requiring us to cease collecting or processing data in a certain way), and could damage our reputation and discourage current and future users from using our mobile applications. In addition, compliance with applicable laws on data privacy requires substantial expenditure and resources, including to continually evaluate our policies and processes and adapt to new requirements that are or become applicable to us on a jurisdiction-by-jurisdiction basis, which would impose significant burdens and costs on our operations or may require us to alter our business practices. Concerns about the security of personal data could also lead to a decline in general Internet usage, which could lead to lower registered, active or paying user numbers on our platform. Furthermore, if the local government authorities in our target markets require real-name registration for users of our platform, the growth of our user numbers may slow down and our business, financial condition and results of operations may be adversely affected. A significant reduction in registered, active or paying user numbers could lead to lower revenues, which could have a material and adverse effect on our business, financial condition and results of operations.