We rely on a variety of marketing techniques, including email and social media marketing and postal mailings, and we are subject to various laws, regulations and regulatory interpretations that govern such marketing and advertising practices. A variety of federal and state laws, regulations and regulatory interpretations govern the collection, use, retention, sharing and security of consumer data, particularly in the context of online advertising, which we rely upon to attract new consumers.
Laws, regulations and regulatory interpretations relating to privacy, data protection, marketing and advertising, and consumer protection are evolving and subject to potentially differing interpretations, particularly as they involve classes of data deemed to be sensitive. These requirements may be interpreted and applied in a manner that varies from one jurisdiction to another and/or may conflict with other law, regulations and regulatory interpretations. As a result, our practices may not have complied or may not comply in the future with all such laws, regulations, requirements and obligations. Any failure, or perceived failure, by us or any of our third-party partners, data centers, or service providers to comply with privacy policies or federal or state privacy or consumer protection-related laws, regulations, regulatory interpretations, industry self-regulatory principles, industry standards or codes of conduct, regulatory guidance, orders to which we may be subject, or other legal obligations relating to privacy or consumer protection, could adversely affect our reputation, brand and business, and may result in claims, proceedings or actions against us by governmental entities, consumers, suppliers or others. These proceedings may result in financial liabilities or may require us to change our operations, including ceasing the use or sharing of certain data sets, or modifying marketing and other user engagement programs and plans. Any such claims, proceedings or actions could hurt our reputation, brand and business, force us to incur significant expenses in defense of such proceedings or actions, distract our management, increase our costs of doing business, result in a loss of consumers, suppliers, and contracts with PBMs and others and result in the imposition of monetary penalties. We are also contractually required to indemnify and hold harmless certain third parties from the costs or consequences of non-compliance with any laws, regulations, regulatory interpretations, or other legal obligations relating to privacy or consumer protection or any inadvertent or unauthorized use or disclosure of data that we store or handle as part of operating our business.
Federal and state governmental authorities continue to evaluate the privacy implications inherent in the use of third-party cross-site behavioral advertising technologies and other methods of online tracking for behavioral advertising and other purposes. The U.S. federal and state governments have enacted, and may in the future enact legislation, regulations and regulatory interpretations impacting the ability of companies and individuals to engage in these activities, such as by regulating the level of consumer notice and consent required before a company can employ cross-site behavioral advertising technologies or other electronic tracking tools or the use of data gathered with such tools. Additionally, some providers of consumer devices and web browsers have implemented, or announced plans to implement, limits on behavioral or targeted advertising and/or means to make it easier for internet users to prevent the placement of cross-site behavioral advertising technologies or to block other tracking technologies, which could, if widely adopted, result in the decreased effectiveness or use of third-party cross-site behavioral advertising technologies and other methods of online tracking, targeting or re-targeting. The regulation of the use of these cross-site behavioral advertising technologies and other current online tracking and advertising practices or a loss in our ability to make effective use of services that employ such technologies could increase our costs of operations and limit our ability to acquire new consumers on cost-effective terms and consequently, materially and adversely affect our business, financial condition and results of operations.
The CCPA, which became effective on January 1, 2020, creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling certain personal data. For example, the CCPA gives California residents expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. Failure to comply with the CCPA may result in attorney general enforcement action and damage to our reputation. We have enacted and will continue to enact changes to ensure compliance with the CCPA. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that has increased the likelihood of, and risks associated with data breach litigation.
The CPRA significantly amends the CCPA and the majority of its provisions went into effect on January 1, 2023. The CPRA imposes additional data protection obligations on companies doing business in California, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It has also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. Additional compliance investment and potential business process changes may be required. Further, certain states have passed similar laws, and similar laws are also continuing to be proposed at the state and federal level. For example, Washington state's My Health My Data Act ("MHMDA") was recently signed into law and proposes additional obligations and limitations regarding data. The MHMDA differs from other state privacy laws because of its broad definition of health information and a broad private right of action. Other states may be considering similar laws to the MHMDA. Historically, laws with private rights of action have resulted in numerous class action suits under federal and state laws resulting in multi-million-dollar settlements to the plaintiffs. We have been, and in the future may be, subject to such litigation, which could be costly and time-consuming to defend. Private litigants may claim that the notices and disclosures we provide, form of consents we obtain or our general privacy practices are not adequate or violate applicable law. This may in the future result in civil claims against us. The scope and interpretation of the MHMDA will be continuously evolving and developing. If we do not comply with the MHMDA or similar laws or regulations or if we become liable under these laws or regulations, we could face direct liability, could be required to change some portions of our business model, could face negative publicity and our business, financial condition and results of operations could be adversely affected.
Additionally, the interpretations of existing federal and state consumer protection laws relating to online collection, use, dissemination, and security of health related and other personal information adopted by the FTC state attorneys general, private plaintiffs, and courts have evolved, and may continue to evolve, over time. Consumer protection and certain state data privacy laws like the CCPA and CPRA require us to publish statements that describe how we handle personal information and choices individuals may have about the way we handle or provide access to their personal information. If such information that we publish is considered untrue, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Furthermore, the FTC also has authority to initiate enforcement actions against entities that make deceptive statements about privacy and data sharing in privacy policies, fail to limit third-party use of personal health information, fail to implement policies to protect personal health information or engage in other unfair practices that harm customers or that may violate Section 5(a) of the FTC Act. According to the FTC, violating consumers' privacy rights or failing to take appropriate steps to keep consumers' personal information secure may constitute unfair acts or practices in or affecting commerce and thus violate Section 5(a) of the FTC Act. It may also violate one or more FTC-enforced rules. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. The FTC and many state Attorneys General also continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. These consumer protection laws are increasingly being applied by the FTC and state Attorneys General to regulate the collection, use, storage and disclosure of personal or personally identifiable information, through websites or otherwise, and to regulate the presentation of website content. In February 2023, we reached a negotiated settlement with the FTC with respect to an investigation of our privacy and security practices which included a monetary settlement amount of $1.5 million and agreements to effect or maintain, as applicable, certain changes to our business practices, policies and compliance requirements.
As a result of regulatory enforcement proceedings and inquiries, we have been, and may in the future be, subject to related litigation, settlements or enforcement actions that have included or could include monetary penalties and/or compliance requirements that (1) impose significant and material costs, (2) require us to make modifications to our data practices and our marketing programs, (3) result in negative publicity, or (4) have a negative impact on consumer demand for our products and services, or on our commercial or industry relationships. Relatedly, there has also been, and may in the future also be, significant and material resource burdens on us, requirements that certain aspects of our operations to be overseen by an independent monitor, and/or limitations or the elimination of our ability to use certain targeting marketing strategies or work with certain third-party vendors. Even an unsuccessful challenge of our privacy practices by our consumers, regulatory authorities or other third parties could result in negative publicity and could require a costly response from and defense by us. Any of these events could adversely affect our ability to operate our business and our financial results.
In addition, HIPAA, which applies to parts of our business, imposes on entities within its jurisdiction, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information. For example, HIPAA imposes privacy, security and breach reporting obligations with respect to individually identifiable health information upon "covered entities" (health plans, health care clearinghouses and certain health care providers) and their respective business associates, individuals or entities that create, receive, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity. HIPAA mandates the reporting of certain breaches of health information to the U.S. Department of Health and Human Services ("HHS"), affected individuals and if the breach is large enough, the media. We have experienced such breaches in the past and could be exposed to a risk of loss or litigation and potential liability, which could materially adversely affect our business, results of operations and financial condition.
In addition, to the extent we or our other contractors or agents receive or obtain individually identifiable health information from patients, healthcare professionals, pharmacies, or other individuals or entities, we could be subject to criminal penalties if we mishandle individually identifiable health information in a manner that is not authorized or permitted by HIPAA. Claims that we have violated individuals' privacy rights or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business.
In addition, though we have wound down vitaCare Prescription Services, Inc.'s ("vitaCare") principal operations in connection with our Restructuring Plan, vitaCare's past activities could be subject to regulation and enforcement by the federal government and the states in which vitaCare conducted its business, including state licensing of pharmacies and pharmacists.
Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Any failure or perceived failure by us or our employees, representatives, contractors, consultants, collaborators, or other third parties to comply with such requirements or adequately address privacy and security concerns, even if unfounded, could result in additional cost and liability to us, damage our reputation, and adversely affect our business and results of operations.