Our business relies on collecting, processing, storing, using and sharing data, some of which contains personal information, including the personal information of our users. Our business is therefore subject to a number of federal, state, local and foreign laws, regulations, regulatory codes and guidelines governing data privacy, data protection and security, including with respect to the collection, storage, use, processing, transmission, sharing and protection of personal information. Such laws, regulations, regulatory codes and guidelines may be inconsistent across jurisdictions or conflict with other rules and change regularly.
For example, on July 10, 2023, the European Commission adopted its adequacy decision relating to the new EU-U.S. Data Privacy Framework ("DPF"). This was followed by the UK Government's approval of the UK extension to the DPF, which is effective as of October 12, 2023. The DPF and UK extension are now lawful means for transferring personal data from the European Economic Area ("EEA"), or the UK to the U.S. (in addition to Standard Contractual Clauses ("SCCs")). The DPF (and the associated steps that the U.S. Government has taken in connection with the DPF) should improve the ability for personal data to flow from the EEA or UK to the U.S., however the DPF is likely to be subject to challenge and may be invalidated in the future. While this does not present an immediate risk to our business, monitoring and ensuring compliance with shifting data transfer requirements could result in additional costs incurred.
In addition, the EU General Data Protection Regulation 2016/679 ("GDPR") and the UK General Data Protection Regulation (the "UK GDPR"), incorporating the GDPR into UK law, impose more stringent data protection requirements, provide an enforcement authority which substantially increases compliance costs, and impose large penalties for noncompliance. Such laws and regulations may require companies to implement new privacy and security policies, conduct processing or transfer impact assessments, permit individuals to access, correct and delete personal information stored or maintained by such companies, inform individuals of security breaches that affect their personal information, and, among other things, obtain individuals' consent to use personal information for certain purposes. In addition, some countries have enacted, or are currently considering, legislation that imposes local storage and processing of data to avoid any form of transfer to a third country, or other restrictions on transfer and disclosure of personal data outside of that country which may impact our compliance obligations, potentially exposing us to liability, and increase the cost and complexity of delivering our products and services.
In June 2018, California passed the California Consumer Privacy Act ("CCPA"), effective January 1, 2020. The CCPA is a privacy law that provides consumers significant rights over the use of their personal information, including the right to object to the "sale" of their personal information. Amendments to the CCPA under the California Privacy Rights Act ("CPRA"), effective January 1, 2023, expand some of the CCPA rights to residents to restrict the use of certain information. These laws may restrict our ability to use personal information in connection with our business operations, and along with other state laws, such as the California Online Privacy Protection Act, create compliance obligations. The CCPA also provides a private right of action for certain data breaches.
Additionally, alongside California, several other states have also enacted comprehensive consumer data privacy laws that are currently effective or will become effective in the coming years. Moreover, some U.S. states have more specific consumer data privacy requirements, some with onerous notice, consent, and other obligations. These laws generally place limitations on the collection, processing, and use of consumer personal information and create data privacy and protection compliance obligations for businesses covered under the law (the jurisdictional requirements of which may vary). Some of the laws specifically regulate the processing of information from individuals under the age of 18.
Furthermore, all 50 U.S. states, the District of Columbia, and the U.S. territories have enacted breach notification laws which require notification to individuals (and potentially regulators and other parties) in the event of certain data breaches impacting personal information. In addition, there has been a significant increase in putative class action activity under privacy and privacy-related laws, often with claims for statutory damages and demands for changes in business operations.
Several states have enacted laws requiring businesses subject to the laws to implement cyber and data security programs. For example, New York enacted the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act), effective March 2020, which requires companies with data relating to New Yorkers to adopt comprehensive cybersecurity programs. Since 2010, Massachusetts, through 201 CMR 17.00, has required companies that own or license the personal information of Massachusetts residents to develop, implement, and maintain a Written Information Security Program.
In recent years, the U.S. and European lawmakers, regulators, and plaintiffs' attorneys have voiced concern about electronic marketing and the use of third-party cookies and similar technology for online behavioral advertising. In the EU, marketing is defined broadly to include any promotional material and the rules specifically on e-marketing are currently set out in the ePrivacy Directive which is expected to be replaced by a new ePrivacy Regulation, which will impose strict opt-in e-marketing rules with limited exceptions for business-to-business communications and significantly increases fining powers to the same levels as the GDPR. Regulation of cookies may result in broader restrictions on our online activities, including efforts to understand followers' internet usage and promote ourselves to them.
In addition, Lithuania, Israel, and Norway each have unique data privacy regulations that impact how and what we can do with employee data and require local compliance efforts.
Efforts to comply with these and other data privacy and security restrictions that may be adopted could require us to modify our data processing practices and policies, increasing the cost of our operations. Failure to comply could subject us to criminal and civil sanctions and other penalties. In part due to the uncertainty of the legal climate, complying with regulations, and any applicable rules or guidance from regulatory authorities or self-regulatory organizations relating to privacy, data protection, information security and consumer protection, may result in substantial costs and may require changes to our business practices, which may limit our growth strategy, adversely impact our ability to attract or retain players, and otherwise negatively affect our business, reputation, legal exposure, financial condition and results of operations.
Any failure or perceived compliance failure with our posted privacy policies, our privacy-related obligations to users or other third parties, or any other legal obligations or regulatory requirements relating to privacy, data protection, or information security may result in official investigations or enforcement actions, litigation, legal claims, or negative publicity from consumer advocacy groups or the press and could result in significant liability, cause our users to lose trust in us to the point of severing their relationship with us, and otherwise materially and adversely affect our business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to us may limit the adoption and use of, and reduce the overall demand for, our products and services. Additionally, service providers or other third parties that we work with, violate applicable laws, regulations, or agreements, such violations may put our users' and/or employees' data at risk, could result in formal investigations or enforcement actions, fines, litigation, claims or negative publicity from consumer advocacy groups or the press and could result in significant liability, cause our players to lose trust in us and otherwise materially and adversely affect our reputation and business. Further, public scrutiny of data practices and privacy, or complaints about, such practices, especially when lodged against technology companies, may heighten the chances for an official investigation and result in modifications to existing or the introduction of new regulatory requirements resulting in higher costs and risks.