We rely on a variety of marketing techniques, including social media marketing, targeted online advertisements, and sales representatives], and we are or may become subject to various laws and regulations that govern such marketing and advertising practices. A variety of federal and state laws and regulations, including those enforced by various federal government agencies such as the Federal Trade Commission, Federal Communications Commission, and state and local agencies, govern the collection, use, retention, sharing, and security of personal data, particularly in the context of online advertising, which we utilize to attract new customers.
The legislative and regulatory bodies or self-regulatory organizations in various jurisdictions inside the United States may expand current laws or regulations, enact new laws or regulations, or issue revised rules or guidance regarding privacy, data protection, consumer protection, information security, and online advertising. California has enacted the California Consumer Privacy Act of 2018 (the "CCPA"), which became operative on January 1, 2020, and its implementing regulations took effect in August 2020. The CCPA requires companies that process personal information on California residents to make new disclosures to consumers about such companies' data collection, use, and sharing practices and inform consumers of their personal information rights such as deletion rights, allows consumers to opt out of certain data sharing with third parties, and provides a new cause of action for data breaches. In November 2020, California enacted the California Privacy Rights Act of 2020 (the "CPRA"), which amends and expands the scope of the CCPA, while introducing new privacy protections that extend beyond those included in the CCPA and its implementing regulations. The CCPA, as amended and expanded by the CPRA, is one of the most prescriptive general privacy laws in the United States and may lead to similar laws being enacted in other U.S. states or at the federal level. For example, the State of Nevada also passed a law effective on October 1, 2019, that amends the state's online privacy law to allow consumers to submit requests to prevent websites and online service providers ("Operators") from selling personally identifiable information that Operators collect through a website or online service.
Further, on March 2, 2021, the Governor of Virginia signed into law the Virginia Consumer Data Protection Act (the "VCDPA"). The VCDPA creates consumer rights, similar to the CCPA, but also imposes security and assessment requirements for businesses. In addition, on July 7, 2021, Colorado, the state in which we are headquartered, enacted the Colorado Privacy Act ("CoCPA"), becoming the third comprehensive consumer privacy law to be passed in the United States (after the CCPA and VCDPA). Although the CoCPA closely resembles the VCDPA, both of which do not contain a private right of action and will instead be enforced by the respective states' Attorney General and district attorneys, the two differ in many ways and once they become enforceable in 2023, we will have to comply with each if our operations fall within the scope of these newly enacted comprehensive mandates. Nevada and Maine have also adopted similar legislation designed to protect the personal information of consumers and penalize companies that fail to comply. Prior efforts undertaken to comply with other recent privacy-related laws have proven that these initiatives require time to carefully plan, assess gaps in current compliance mechanisms, and implement new policies, processes and remediation efforts. Additionally, the Federal Trade Commission and state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination, and security of data. Each of these privacy, security, and data protection laws and regulations, and any other such changes or new laws or regulations, could impose significant limitations, require changes to our business model or practices, or restrict our use or storage of personal information, which may increase our compliance expenses and make our business more costly or less efficient to conduct. In addition, any such changes could compromise our ability to develop an adequate marketing strategy and pursue our growth strategy effectively, which, in turn, could adversely affect our business, financial condition, and results of operations.
While we intend to strive to comply with applicable laws and regulations relating to privacy, data security, and data protection, given that the scope, interpretation, and application of these laws and regulations are often uncertain and may be in conflict across jurisdictions, it is possible that these obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules or our practices. Any failure or perceived failure by us or third party service providers to comply with privacy or security policies or privacy-related legal obligations, or any compromise of security that results in the unauthorized release or transfer of personal data, may result in governmental enforcement actions, litigation, or negative publicity, and could have an adverse effect on our operating results and financial condition.