We receive, transmit and store a large volume of personal information in connection with the provision of our products and services. The manner in which we share, store, use, disclose and protect this information is determined by the respective privacy and data security policies of our various businesses, as well as federal, state and foreign laws and regulations and evolving industry standards and practices, which are changing, and in some cases, inconsistent and conflicting and subject to differing interpretations. In addition, new laws, regulations, standards and practices of this nature are proposed and adopted from time to time.
For example, several U.S. territories and all 50 states now have data breach laws that require timely notification to individuals, and at times regulators, the media or credit reporting agencies, if a company has experienced the unauthorized access or acquisition of personal information. Other state laws contain additional disclosure obligations for businesses that collect personal information about residents and afford those individuals additional rights relating to their personal information that may affect our ability to use personal information or share it with our business partners. For example, California's Privacy Rights Act of 2020 ("CPRA") amended certain provisions of the California Consumer Privacy Act which provides California residents with certain privacy rights in connection with the collection and disclosure of their personal information and requires businesses to make certain disclosures and take certain other acts in furtherance of those rights. The CPRA became fully enforceable on July 1, 2023 and further restricts our ability to use personal California user and subscriber information in connection with our various products, services and operations and/or imposes additional operational requirements, which could result in increased costs. Other U.S. states, such as Virginia, Utah, Connecticut, and Colorado, have passed consumer privacy laws that became effective later in 2023 and in 2024. We will continue to monitor and assess the impact of these state laws, which may impose substantial penalties for violations, impose significant costs for investigations and compliance, allow private class-action litigation and carry significant potential liability for our business. Lastly, the Federal Trade Commission has also increased its focus on privacy and data security practices, and we anticipate this focus to continue.
Outside of the U.S., data protection laws also apply to some of our operations. For example, the General Data Protection Regulation (the "GDPR") in the United Kingdom and the European Union imposes, among other things, strict obligations and restrictions on the collection and use of U.K. and European Union personal data, a requirement for prompt notice of data breaches in certain circumstances, a requirement for implementation of certain approved safeguards for transfers of personal data to third countries, and possible substantial fines for any violations. Governmental authorities around the world have enacted similar types of legislative and regulatory requirements concerning data protection, and additional governments are considering similar legal frameworks.
We may be subject to claims of non-compliance with applicable privacy and data protection policies, laws and regulations and industry standards and practices that we may not be able to successfully defend or significant fines and penalties. Moreover, any non-compliance or perceived non-compliance by us (or any third-party we engage to store or process information) or any compromise of security that results in unauthorized access to (or use or transmission of) personal information could result in a variety of claims against us, including governmental enforcement actions, significant fines, litigation (including consumer class actions), claims of breach of contract and indemnity by third parties and adverse publicity. When such events occur, our reputation could be harmed and the competitive positions of our various brands and businesses could be diminished, which could adversely affect our business, financial condition and results of operations. Additionally, to the extent multiple U.S. state (or European Union member-state) laws are introduced with inconsistent or conflicting standards and there is no federal or European Union regulation to preempt such laws, compliance could be even more difficult to achieve and our potential exposure to the risks discussed above could increase.
Lastly, ongoing compliance with existing (and compliance with future) privacy and data protection laws worldwide could be costly. The devotion of significant expenditures to compliance (versus the development of products and services) could result in delays in the development of new products and services, us ceasing to provide problematic products and services in existing jurisdictions and us being prevented from introducing products and services in new and existing jurisdictions, which could adversely affect our business, financial condition and results of operations.