Data privacy, data security, AI, marketing and consumer protection laws, rules, and regulations are complex and rapidly evolving and we could be materially adversely affected by new legal requirements or changes to existing requirements including their interpretations and enforcement practices. Compliance with such laws may require changes to our data processing practices, potentially increasing compliance costs or adversely affecting our business. We process personal data, such as names, dates of birth, email addresses, nationality, location information, Social Security numbers, phone numbers, and identity verification information (for example, government issued identification or passport), as well as credit card, bank account or other financial information, from and about hosts and guests, as well as our employees, job applicants, contractors and representatives of our third-party vendors, and other companies we do business with. We utilize third-party vendors, some of whom process data for us and provide various services, including but not limited to digital storage technology, business technology support, and other support functions. We and our vendors must comply with various state, federal, and foreign data privacy and security laws, rules, regulations, industry standards and other requirements, including those that generally require that we implement reasonable measures to keep such information secure and otherwise restrict the ways in which such information can be collected and used. These requirements, and their application, interpretation, and amendment are constantly evolving.
Additionally, we note that as the use of AI and machine learning technologies ("AI and ML Technologies") continues to grow, regulators (including data protection regulators) are expected to take an increased interest in issues, such as how we and our vendors collect, maintain and process and provide transparency on the use of personal data of our users and/ or hosts in that context. Our technology platform incorporates the use of AI and ML Technologies, for example, for fraud detection, search, enabling customized features and enhancing community support. Enhanced scrutiny of the use of AI and ML Technologies means that regulators may increasingly seek advance engagement with businesses like ours in respect of certain types of data processing. In addition, certain existing legal regimes, including those relating to data privacy and consumer protection, regulate certain aspects of AI and ML Technologies, and new laws regulating AI and ML Technologies have been or may be enacted or have entered into force in jurisdictions that we operate. This may affect our use of AI and ML Technologies and our ability to provide, improve or commercialize our services effectively and efficiently and result in increased costs. For example, in the United States, California enacted seventeen new laws in 2024 that further regulate the use of AI and ML Technologies and provide consumers with additional protections around companies' use of AI and ML Technologies, such as requiring companies to disclose certain uses of generative AI. Other states have also passed AI-focused legislation, such as Colorado's Artificial Intelligence Act, which will require developers and deployers of "high-risk" AI systems to implement certain safeguards against algorithmic discrimination, and Utah's Artificial Intelligence Policy Act, which establishes disclosure requirements and accountability measures for the use of generative AI in certain consumer interactions. Other legislation has been introduced or proposed at the federal and state level, and there remains uncertainty at the federal level regarding the regulation of AI and ML Technologies. Further, the EU Artificial Intelligence Act (the "EU AI Act") entered into force in August 2024, and establishes a comprehensive, risk-based governance framework for AI in the EU market. The majority of the substantive requirements will apply from August 2026. The EU AI Act applies to companies that develop, use and/or provide AI in the EU and – depending on the AI use case – includes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security, accuracy, general purpose AI and foundation models, and fines for breach of up to 7% of worldwide annual turnover. These regulations may impact our ability to use, procure and commercialize AI and ML Technologies in the future, and we may need to expend resources to adjust our products or services, including if the laws are not consistent across jurisdictions.
In the European Union and the UK, we are subject to the European Union General Data Protection Regulation (the "EU GDPR") and to the UK General Data Protection Regulation and Data Protection Act 2018 (the "UK GDPR"), respectively (the EU GDPR and UK GDPR together referred to as the "GDPR"), both of which have resulted, and will continue to result, in significantly greater compliance burdens and costs for companies like ours. The GDPR comprehensively regulates our use of personal data, including cross-border transfers of personal data out of Europe. Many large geographies in which we operate, including Australia, Brazil, Canada, China, India, and South Korea have passed or are in the process of passing comparable or other robust data privacy and security legislation or regulation, which may lead to additional costs and increase our overall risk exposure.
In relation to cross-border transfers of personal data outside of Europe, we expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, the European Commission approval of the current EU-US Data Privacy Framework for data transfers to certified entities in the United States may be challenged, which could also lead to challenges to, or impact the effectiveness of, other data transfer mechanisms such as the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism). In general, we expect that international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators and we cannot guarantee the ongoing efficacy of our data transfer mechanisms. It is also possible that transfers of personal data outside the United States could be restricted or impacted by developments at the federal level. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints, and/or regulatory investigations or fines, we may have to stop using certain tools and vendors and make other operational changes, including updating agreements or implementing additional safeguards which could otherwise affect the manner in which we provide our services, our ability to provide our services and adversely affect our business, results of operations, and financial condition.
From time to time, we receive correspondence, and are subject to more formal inquiries, from regulators including the Irish Data Protection Commission, our lead EU data protection regulator, regarding our personal data processing activities. To date, we have not received any fines in respect of statutory inquiries and have in place an internal process to review and process such inquiries to ensure we respond appropriately and update our privacy compliance with any findings.
In the United States, there are numerous federal and state data privacy and security laws, rules, and regulations governing the collection, maintenance, disclosure and processing of personal data, including federal and state data privacy laws, data breach notification laws, electronic communications laws, and marketing and consumer protection laws. For example, the Federal Trade Commission ("FTC") and state regulators enforce a variety of data privacy issues, such as misrepresentations in privacy policies or failures to appropriately protect information about individuals, as unfair or deceptive acts or practices in or affecting commerce in violation of the FTC Act or similar state laws. Additionally, the GLBA and its implementing regulations, restrict and impose certain requirements on the processing of personal data, including notice to individuals of privacy practices and requirements for the safeguarding and proper destruction of personal data. Moreover, as we send marketing messages via email and short message service, or SMS, text messages, we are subject to the CAN-SPAM Act, which imposes certain obligations regarding the content of emails and providing and honoring opt-outs, and the Telephone Consumer Protection Act, which imposes restrictions on the ability to send text messages without prior consent.
The U.S. government, including Congress, the FTC, the CFPB and the Department of Commerce, has announced that it is reviewing the need for greater regulation for the collection of information concerning personal data processing practices and consumer behavior on the Internet, including regulation aimed at restricting certain targeted advertising practices. In addition, numerous states have enacted or are in the process of enacting state level data privacy laws and regulations governing the processing of state residents' personal data that have and may continue to require us to modify our data processing practices and policies and incur related costs and expenses. For example, the California Consumer Privacy Act ("CCPA") provides enhanced data privacy rights to California residents, such as affording residents the right to access and delete their data and to opt out of certain sharing and sales of personal data. The CCPA imposes a range of other compliance obligations and imposes severe statutory damages, which could lead to injunctive relief or agreed settlements providing for ongoing audit and reporting requirements, as well as a private right of action, for certain data breaches. This private right of action has increased the risks associated with data breach litigation. The enactment of the CCPA prompted a wave of similar legislative developments in other states, which creates a patchwork of overlapping but different state laws. For example, since the CCPA went into effect, comprehensive privacy statutes that share similarities with the CCPA are now in effect and enforceable in other states. Many other states have passed or proposed similar laws and there remains increased interest at the federal level as well.
We are also subject to evolving EU and UK privacy laws on cookies, tracking technologies and e-marketing. In the European Union and United Kingdom, informed consent is required for the placement of certain cookies or similar tracking technologies on an individual's device and for direct electronic marketing. Recent European court and regulator decisions are driving increased attention to cookies and similar tracking technologies, which may lead to additional costs and increase our overall risk exposure.
Further, the majority of the substantive provisions of the DSA took effect in February 2024. The DSA governs, among other things, our potential liability for illegal services/products or content on our platform, obligations around traceability of business users, and requires enhanced transparency measures. In particular our obligations to diligence the services offered on our platform could require significant additional resources. Further, the DSA contains general requirements that user interfaces may not deceive or manipulate users which are yet to be clarified further by guidance. The DSA may increase our compliance costs, require changes to our user interfaces, processes, operations, and business practices which may adversely affect our ability to attract, retain and provide our services to customers, and may otherwise adversely affect our business, operations and financial condition. Failure to comply with the DSA can result in fines of up to 6% of total annual worldwide turnover and recipients of services have the right to seek compensation from providers in respect of damage or loss suffered due to infringement by the provider to comply with the DSA. Similarly, in the United Kingdom, the Online Safety Act 2023, or the OSA, establishes an extensive regulatory framework for certain user-to-user and search services and imposes obligations to protect users from illegal content which, if applicable, may increase compliance costs and may otherwise adversely affect our business, operations and financial condition. Failure to comply with the OSA can result in fines of up to 10% of total annual worldwide turnover or £18 million (whichever is greater).
Various other governments and consumer agencies around the world have also called for new regulation and changes in industry practices for protecting personal information collected and maintained electronically. Together, these existing and proposed laws add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment in resources to compliance programs and cybersecurity, which could impact strategies, and could result in increased compliance costs and/or changes in business practices and policies. Compliance with numerous and often contradictory requirements of different jurisdictions is particularly difficult for an online business such as ours, which collects personal information from hosts, guests, and other individuals in multiple jurisdictions. If any jurisdiction in which we operate adopts new laws or changes its interpretation of its laws, rules, or regulations relating to data residency or localization such that we are unable to comply in a timely manner or at all, we could risk losing our rights to operate in such jurisdictions. As in many cases these laws are relatively new and the interpretation and application of these laws is uncertain. There may be litigation, claims and enforcement relating to data privacy, and the processing of personal data may involve new interpretations of privacy laws. For example, there has been a noticeable increase in class actions in the United States where plaintiffs have utilized a variety of laws, including state wiretapping laws, in relation to the use of tracking technologies, such as cookies and pixels.
Furthermore, to help improve the trust and safety on our platform, we conduct certain verification procedures aimed at our hosts, guests, and listings in certain jurisdictions. Such verification procedures may include utilizing public information on the Internet, accessing public databases such as court records, utilizing third-party vendors to analyze host or guest data, or physical inspection. These types of activities expose us to requirements of other laws and regulations, and to the risk of regulatory engagement and/or enforcement from privacy regulators, consumer protection agencies, consumer credit reporting agencies, and civil litigation.
When we are required to disclose personal data to government agencies, such as tax authorities and law enforcement agencies, this could be perceived by third parties as non-compliance with data privacy and security laws, potentially leading to legal proceedings or actions against us. Conversely, if we refuse to provide requested information due to a disagreement, such as on the interpretation of the law, we may face actions, litigation, and increased regulatory scrutiny, which could harm our relationships with governments and limit our ability to operate in certain regions. Any of the foregoing could materially adversely affect our brand, reputation, business, results of operations, and financial condition.
Any failure or perceived failure by us and/or our vendors or third-party providers to comply with data privacy and data security laws, rules, or regulations could expose us to material penalties, significant legal liability, changes in how we operate or offer our products, and interruptions or cessation of our ability to operate in key geographies, any of which could materially adversely affect our business, results of operations, and financial condition. For example, as we are subject to both the EU GDPR and the UK GDPR, we could be fined under each regime independently in respect of the same breach. Penalties for certain breaches are up to the greater of €20 million or £17.5 million, or up to 4% of the annual global revenue of the infringer, whichever is greater.
In addition, any failure or perceived failure to comply with consumer protection, marketing, data privacy or data security laws, rules, and regulations; policies; industry standards; or enforcement notices and/or assessment notices (for a compulsory audit) could lead to legal actions by individuals, consumer rights groups, government agencies, or others. We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation, injunctive relief, or damages liabilities, as well as associated costs, and diversion of internal resources or other regulatory orders adversely impacting the ways our business can use personal data. These proceedings could be costly to litigate, whether or not they have merit, and result in negative publicity and erode trust, potentially requiring us to make costly changes to our business practices. If these events occur, they could materially and adversely impact our business operations, financial condition, and overall results.