We, and our partners, vendors, and other service providers, receive, collect, use, disclose, share, transfer, transmit, store, and otherwise process a large volume of personal information and other sensitive data relating to individuals, such as consumers and our employees. Our collection, use, receipt, and other processing of data in our business subjects us to numerous state, federal, and foreign laws and regulations, addressing privacy, information security, data protection, and the collection, storing, sharing, use, transfer, disclosure, protection, and processing of certain data. Such regulations include, for example, the GLBA, FCRA, California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act (the "CPRA"). These laws, rules, and regulations evolve frequently and their scope may continually change, through new legislation, amendments to existing legislation, and changes in interpretation or enforcement, and may impose conflicting and inconsistent obligations.
For example, in 2021, the Federal Trade Commission ("FTC") amended the GLBA's Safeguards Rule, which requires covered financial services firms, which may include some of our customers, to develop, implement, and maintain a comprehensive information security program. The rule provides more prescriptive security controls that financial services firms must implement and oversight by a designated Qualified Individual who must provide annual written reports to the board of directors or equivalent governing body. The FTC further amended the GLBA's Safeguards Rule in November 2023 to provide for reporting to the FTC certain security incidents in which unencrypted personal information involving 500 or more consumers is acquired without authorization. In addition, the FTC has brought enforcement actions against service providers of financial services firms directly and against financial services firms for failures by service providers to implement appropriate controls to safeguard consumers' personal information.
The CCPA went into effect on January 1, 2020, and, among other things, requires new disclosures to California consumers and affords such consumers new data privacy rights. The California Attorney General can enforce the CCPA, including seeking an injunction and civil penalties of up to $7,500 per violation. The CCPA also provides a private right of action for certain data breaches that may increase data breach litigation. Additionally, the CPRA was approved by California voters in November 2020, and significantly modifies the CCPA, including expanding California consumers' rights with respect to certain personal information and creating a new state agency to oversee implementation and enforcement efforts. The CPRA created obligations relating to consumer data beginning on January 1, 2022 and it became effective on January 1, 2023. Numerous states have proposed, and in certain cases enacted, legislation addressing privacy and data security that in many cases are similar to the CCPA and CPRA. For example, Connecticut, Virginia, Colorado, and Utah have enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that took effect in 2024; Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Tennessee have enacted similar legislation that will take effect in 2025; and Indiana, Kentucky, and Rhode Island have enacted similar legislation that will take effect in 2026. The California Age-Appropriate Design Code Act ("CAADCA"), which expands the CPRA for businesses with websites that are likely to be accessed by children, was signed into law on September 15, 2022 and went into effect on July 1, 2024. The New York governor signed a bill into law in June 2024 that, upon becoming effective on June 20, 2025, would, among other things, prohibit covered "operators" from collecting, using, sharing, and selling personal data of individuals under 18 years of age unless it is strictly necessary, as specified in such legislation, or where informed consent is obtained in accordance with specified requirements. This includes, in the case of individuals under 13 years of age, obtaining parental consent in a manner compliant with the Children's Online Privacy Protection Act ("COPPA").
The CCPA, CPRA, CAADCA, COPPA, other new and evolving state legislation, and other changes in laws or regulations relating to privacy, data protection, and information security, particularly any new or modified laws or regulations, or changes to the interpretation or enforcement of laws or regulations, that require enhanced protection of certain types of data or new obligations with regard to data retention, transfer, or disclosure, could add additional complexity and variations in requirements, restrictions, and legal risks, greatly increase the cost of providing our platform, require significant changes to our operations and additional investment of resources, impact strategies and the availability of previously useful data for processing, or prevent us from providing our platform in jurisdictions in which we currently operate and in which we may operate in the future. Certain other state laws impose similar privacy, data protection, and information security obligations and we also expect that more states may enact new legislation to provide consumers with new privacy rights and increase the privacy, data protection, and information security obligations of entities handling certain personal information of such consumers. In addition, some jurisdictions, such as New York, Massachusetts, and Nevada have enacted more generalized information security laws that apply to certain data that we process. The U.S. federal government also has proposed legislation relating to privacy and data security. We cannot yet fully determine the impact these or future laws, rules, regulations, and industry standards may have on our business or operations. Any such laws, rules, regulations, and industry standards may be inconsistent, subject to differing interpretations, or may conflict, or be alleged to conflict, with our current or future practices. Additionally, our customers may be subject to differing privacy laws, rules, and legislation, or self-regulatory principles, codes, or other obligations, which may cause them to require us to be bound by varying contractual requirements, including certain requirements applicable to other jurisdictions. Adherence to such contractual requirements may impact our collection, use, storage, sharing, disclosure, and processing of various types of information and may mean we become bound by, or voluntarily comply with, self-regulatory or other industry standards, or other actual or asserted obligations, relating to these matters that may further change as laws, rules, and regulations evolve. Complying with these requirements and other actual or asserted obligations, and changing our policies and practices may be onerous and costly, and we may not be able to respond quickly or effectively to regulatory, legislative and other developments. These changes may in turn impair our ability to offer our existing or planned products and services and/or increase our cost of doing business.
Additionally, we have incurred, and may continue to incur, significant expenses in an effort to comply with privacy, data protection, and information security standards and protocols imposed by law, regulation, industry standards, contractual obligations, or other actual or asserted obligations, and may face substantial challenges in our efforts to do so. We may face challenges in addressing their requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so.
As our business grows, we may become subject to privacy, data protection, and information security laws from jurisdictions outside of the United States, potentially including the General Data Protection Regulation ("GDPR"). The GDPR governs the collection, use, disclosure, transfer or other processing of personal data of European persons. Among other things, the GDPR imposes requirements regarding the security of personal data and notification of data processing obligations to competent national data processing authorities, provides for lawful bases on which personal data can be processed, provides for an expansive definition of personal data and requires changes to informed consent practices. In addition, the GDPR provides for heightened scrutiny of transfers of personal data from the European Economic Area ("EEA") to the United States and other jurisdictions that the European Commission does not recognize as having "adequate" data protection laws, and imposes substantial fines for breaches and violations (up to the greater of €20 million or 4% of an enterprise's consolidated annual worldwide gross revenue). The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations. The United Kingdom has implemented legislation that substantially implements the GDPR in the United Kingdom, which legislation provides for penalties for violations of up to the greater of £17.5 million or 4% of an enterprise's consolidated annual worldwide gross revenue. If we expand our business into the EEA and/or the United Kingdom, we will need to comply with the GDPR and data protection laws of the United Kingdom. This will involve significant resources and expense and may also impair our ability to offer our existing or planned features, products and services and/or increase our cost of doing business.
Despite our efforts to comply with applicable laws, regulations, and other obligations relating to privacy, data protection, and information security, it is possible that our interpretations of the law, practices, or platform could be inconsistent with, or fail or be alleged to fail to meet all requirements of, such laws, regulations, or actual or asserted obligations. Our failure, or the failure by our partners, vendors, service providers, or customers, to comply with applicable laws or regulations, policies, documentation, contractual obligations, or any other actual or asserted obligations relating to privacy, data protection, or information security, or any compromise of security that results in unauthorized access to, or use, release, disclosure, or other processing of data relating to consumers or other individuals, or the perception that any of the foregoing types of failure or compromise has occurred, could damage our reputation, discourage new and existing customers and consumers from using our platform, or result in fines, investigations, or proceedings by governmental agencies and private claims and litigation, any of which could adversely affect our business, financial condition, and results of operations. Even if not subject to legal challenge, the perception of privacy, data protection, or information security concerns, whether or not valid, may harm our reputation and brand and adversely affect our business, financial condition, and results of operations.