There are a growing number of data privacy and protection laws and regulations in the digital advertising industry that apply to our business. We have dedicated, and expect to continue to dedicate, significant resources in our efforts to comply with such laws and regulations. For example, we have implemented policies and procedures to comply with applicable data privacy laws and regulations, we complete several external privacy-related audits each calendar year and we rely on contractual representations made to us by customers and partners that the information they provide to us and their use of our solutions do not violate these laws and regulations or their own privacy policies. However, the application, interpretation and enforcement of these laws and regulations are often uncertain and continue to evolve, particularly in the new and rapidly evolving industry in which we operate, and may be interpreted and applied inconsistently between states within a country or between countries, and our current policies and practices may be found not to comply, which could subject us to legal or regulatory action. Additionally, if our customers and partners' representations are false or inaccurate, or if our customers and partners do not otherwise comply with applicable privacy laws, we could face adverse publicity and possible legal or regulatory action. Conversely, our partners and communications services providers have adopted their own policies based on their own perceptions of legal requirements or other policy determinations, and these policies have in the past temporarily prevented us, and may again in the future prevent us, from operating on their platforms and possibly result in loss of business or litigation. Any perception of our practices, platform or solutions delivery as a violation of privacy rights may subject us to public criticism, loss of customers or partners, class action lawsuits, reputational harm, or investigations or claims by regulators, industry groups or other third parties, all of which could significantly disrupt our business and expose us to liability in ways that negatively affect our business, results of operations and financial condition.
In addition, U.S. and foreign governments have enacted or are considering enacting new legislation related to privacy, data protection, data security and digital advertising and we expect to see an increase in, or changes to, legislation and regulation that affects our industry. For example, the EU GDPR, which became effective on May 25, 2018, and has resulted and will continue to result in significantly greater compliance burdens and costs for companies with users and operations in the EU and European Economic Area ("EEA"). In addition, the UK GDPR, which became effective in January 2021, imposes similar requirements as the EU GDPR. Under the EU GDPR and UK GDPR, fines of up to 20 million Euros or 17.5 million Pounds, respectively, or up to 4% of the annual global revenues of the infringing party, whichever is greater, can be imposed for violations. The EU GDPR and UK GDPR impose several stringent requirements for controllers and processors of personal data and could make it more difficult and/or more costly for us to use and share personal data. In addition, the CCPA, which went into effect on January 1, 2020, limits how we may collect and use personal data. The effects of the CCPA potentially are far-reaching and may require us to modify our data processing practices and policies and incur substantial compliance-related costs and expenses. In November 2020, California voters passed the CPRA, which expands the CCPA with additional data privacy compliance requirements that went into effect in 2023 and may impact our business, and establishes a regulatory agency dedicated to enforcing those requirements. Other states have also recently introduced or enacted comprehensive consumer privacy laws that broadly protect personal data, including the right to opt out of targeted advertising and certain profiling activities, and more states are expected to follow. It remains unclear how various provisions of the CCPA, CPRA and other state laws will be interpreted and enforced. Further, the COPPA applies to websites and other online services that are directed to children under thirteen (13) years of age and imposes certain restrictions on the collection, use and disclosure of personal information from these websites and online services. The Data Privacy Framework, or DPF, recently adopted by the EU, UK and Switzerland to support data transfers to the United States, which DV relies on, has been challenged by European privacy activists. Additionally, as backup should the DPF be invalidated, we rely on a data transfer mechanism called Standard Contractual Clauses that has also been subjected to regulatory and judicial scrutiny, although they remain valid. In 2022, EU and U.S. officials announced that an agreement had been reached on a framework for data transferred from the EU to the United States referred to as "Privacy Shield 2.0", but it has not yet been officially adopted by the European Union. The continued uncertainty around the feasibility of onward transfers from the EU to the United States has the potential to adversely affect our operations and business. These and other data privacy laws and their interpretations continue to develop and may be inconsistent from jurisdiction to jurisdiction. Noncompliance with these laws could result in penalties or significant legal liability. Our efforts to comply with all applicable laws and regulations may be ineffective, and there can be no assurance that we will not be subject to regulatory action, including fines, in the event of an incident. We or our third-party service providers could be adversely affected if legislation or regulations are expanded to require changes in our or our third-party service providers' business practices or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively affect our or our third-party service providers' business, results of operations or financial condition. These federal, state and foreign laws and regulations, which in some cases can be enforced by private parties in addition to government entities, are increasingly restricting the collection, processing and use of personal data.
These laws are constantly evolving and can be subject to significant change or interpretive application. We continue to monitor changes in laws and regulations, and the costs of compliance with, and the other burdens imposed by, these and other new laws or regulatory actions may increase our costs. Our AI initiatives may also subject us to increased compliance costs associated with future laws and regulations. In addition, failure to comply with these and other laws and regulations may result in, among other things, administrative enforcement actions and significant fines, class action lawsuits, significant legal fees, and civil or criminal liability. Any regulatory or civil action that is brought against us, even if unsuccessful, may distract our management's attention, divert our resources, negatively affect our public image or reputation among our customers and partners and within our industry, and, consequently, harm our business, results of operations and financial condition.