Federal, state, and international laws and regulations govern the collection, use, retention, disclosure, sharing and security of data that we receive from and about our users. The use of consumer data by online service providers is a topic of active interest among federal, state, and international regulatory bodies, and the regulatory environment is unsettled. Many states have passed laws requiring notification to users where there is a security breach for personal data, such as California's Information Practices Act. We face similar risks in international markets where our products and services are offered. Any failure, or perceived failure, by us to comply with or make effective modifications to our policies, or to comply with any applicable federal, state, or international privacy, data-retention or data-protection-related laws, regulations, orders or industry self-regulatory principles could result in proceedings or actions against us by governmental entities or others, a loss of user confidence, damage to our business and brand, and a loss of users, which could potentially have an adverse effect on our business.
In addition, various federal, state and foreign legislative or regulatory bodies may enact new or additional laws and regulations concerning privacy, data retention, data transfer and data protection issues, including laws or regulations mandating disclosure to domestic or international law enforcement bodies, which could adversely impact our business, our brand or our reputation with users. For example, some countries are considering or have enacted laws mandating that user data regarding users in their country be maintained in their country. In addition, there currently is a data protection regulation applicable to member states of the European Union that includes operational and compliance requirements that are different than those currently in place and that also includes significant penalties for non-compliance.
The interpretation and application of privacy, data protection, data transfer and data retention laws and regulations are often uncertain and in flux in the United States and internationally. These laws may be interpreted and applied inconsistently from country to country and inconsistently with our current policies and practices, complicating long-range business planning decisions. If privacy, data protection, data transfer or data retention laws are interpreted and applied in a manner that is inconsistent with our current policies and practices, we may be fined or ordered to change our business practices in a manner that adversely impacts our operating results. Complying with these varying international requirements could cause us to incur substantial costs or require us to change our business practices in a manner adverse to our business and operating results.