We and our customers are subject to a number of laws and regulations in the United States and abroad, including laws related to conducting business on the internet and on mobile devices, such as laws regarding data privacy, data protection, information security, cybersecurity, restrictions or technological requirements regarding the collection, use, storage, protection, disposal, transfer or other processing of consumer data, content, consumer protection, internet (or net) neutrality, advertising, electronic contracts, taxation, provision of online payment services (including credit card processing), and intellectual property rights, which are continuously evolving and developing. Because our services are accessible worldwide, certain foreign jurisdictions may claim that we are required to comply with their laws, even if we do not have a local entity, employees or infrastructure. Foreign data protection, privacy, and other laws and regulations may often be more restrictive than those in the United States. The scope and interpretation of the laws and other obligations that apply to us, including those related to user privacy and data security, are often uncertain and may be conflicting, particularly laws and obligations outside the U.S. There is a risk that these laws may be interpreted and applied differently in any given jurisdiction in a manner that is not consistent with our current practices, which could cause us to incur substantial cost and could negatively impact our brand, reputation and business.
Businesses using our products and services may collect data from their users. Various federal, state and foreign government bodies and agencies impose laws regarding collection, use, storage, retention, disposal, transfer or other processing of data from website visitors. We offer our customers a variety of data security procedures and practices, such as encryption for data at rest and masking algorithms for sensitive data prior to transfer to our database, in an effort to protect information. Changes to applicable laws and how they are interpreted relating to privacy and data security could significantly increase the cost to us and our customers of regulatory compliance and could negatively impact our business.
For instance, some states in the U.S. have enacted legislation designed to protect consumer privacy by prohibiting the distribution of "spyware" over the internet. Such legislation typically focuses on restricting the proliferation of software that, when installed on an end user's computer, is used to intentionally and deceptively take control of the end user's machine. We do not believe that the data monitoring methods that we employ constitute "spyware" or are prohibited by applicable laws. However, federal, state and foreign laws and regulations, many of which can be enforced by government entities or private parties, are constantly evolving and can be subject to significant changes in application and interpretation. If, for example, the scope of the previously mentioned "spyware" legislation were changed to include web analytics, such legislation could apply to the technology we use and potentially restrict our ability to conduct our business.
Similarly, some U.S. courts have interpreted certain two-party consent wiretap statutes, such as the California Invasion of Privacy Act, to require the collection of prior consent from consumers who engage in a dialogue with chatbots. If the scope of such laws or newly enacted legislation were interpreted to apply to our services, we and/or our customers may be required to obtain the express consent of web visitors in order for our technology to perform its intended functions. Requirements that a website must first obtain consent from its web visitors before using our technology could reduce the amount and value of the services we provide to customers, which might impede sales and/or cause some existing customers to discontinue using our services or could subject us to fines and/or proceedings by governmental agencies, regulatory bodies, and/or private litigation, which could materially and adversely affect our business, financial condition and results of operations.
There has been an increased focus in 2024 on laws and regulations related to AI. For example, states, regions and supranational bodies, including the European Union and the United States, have passed or proposed new rules and regulations related to the development and use of AI technology, which cover, among other things, consumer protection, algorithmic accountability, privacy and transparency. In the United States, there is uncertainty at the federal level regarding applicable regulations that will apply to the development and use of AI. In January 2025, the Trump administration rescinded an Executive Order implemented by the Biden administration in 2023 aimed at establishing new standards for AI safety and security, privacy, consumer and employee protection and innovation and competition associated with the use of AI. The Trump administration then issued a new Executive Order that, among other things, directed the heads of various federal governmental bodies to review actions taken under the Biden Executive Order and develop a new action plan with respect to AI-related matters. In Europe, the EU AI Act, enacted on August 1, 2024, began to apply in February 2025, with the remaining requirements to become effective on a staggered basis through August 2027. The EU AI Act establishes, among other things, a risk-based governance framework for regulating AI systems operating in the EU. This framework categorizes AI systems, based on the risks associated with such AI systems' intended purposes, as creating unacceptable or high risks, with all other AI systems being considered low risk. The EU AI Act prohibits certain uses of AI systems and places numerous obligations on providers and deployers of permitted AI systems, with heightened requirements based on AI systems that are considered high risk. The EU AI Act establishes requirements for the provision and use of products that leverage AI, machine learning, and similar technologies, including chatbots, with potential fines reaching up to the greater of €35 million and 7% of global income. We may not be able to anticipate how to respond to these rapidly evolving frameworks, which could impact our ability to develop and deploy AI-powered features in a timely manner. Compliance with evolving regulatory requirements may increase our operational costs, and we may need to expend additional resources to adjust our operations or offerings in certain jurisdictions if the legal frameworks are inconsistent across jurisdictions. This could include requirements to retrain our algorithms, disclose or provide greater transparency regarding the nature of our AI systems and the data we have employed to train them, or prevent or limit our use of AI. Any failure to comply with these regulations or delays in adapting to new requirements could result in penalties, loss of market access, competitive disadvantages, or reputational harm. Furthermore, because AI technology itself is highly complex and rapidly developing, it is not possible to predict all of the legal, operational or technological risks that may arise relating to the use of AI. Additionally, other countries have proposed legal frameworks on AI, which is a trend that is expected to increase, and existing laws and regulations may be interpreted in ways that may affect our use of AI. Any failure or perceived failure by us to comply with such requirements could have an adverse impact on our business. Our competitors may be developing their own AI products and technologies, which may be superior in features, functionality, compliance readiness, or cost efficiency compared to our offerings, potentially impacting our competitive position. Any of these factors could adversely affect our business, reputation, or operating results.
Further, various federal, state and foreign government bodies and agencies are highly focused on consumer protection initiatives, particularly in light of the increase in new technologies and services that incorporate or use bots, AI and/or machine learning. For example, the California B.O.T. Act requires that companies using bots on platforms with more than ten million unique monthly visitors from the U.S. use clear and conspicuous disclosure to inform consumers that they are not speaking to a human. Similar bills have been introduced from time to time at the state and federal level in recent years. Further, the use of certain AI and machine learning may be subject to laws and evolving regulations, controlling for, among other things, data bias and antidiscrimination. For example, the Federal Trade Commission ("FTC") enforces consumer protection laws such as Section 5 of the FTC Act, which prohibits unfair and deceptive practices, including use of biased algorithms in AI. The European Commission's EU AI Act imposes additional restrictions and obligations on providers of AI systems, including increasing transparency so consumers know they are interacting with an AI system, requiring human oversight in AI, and prohibiting certain practices of AI that could lead to physical or psychological harm. Given the increased focus by the FTC and other regulators on the use of AI, it is likely that additional laws, regulations, and standards related to AI may be introduced in the future. Regulation in this area could impact how businesses use our products and services to interact with consumers and how we provide our services to our customers. As regulatory scrutiny of AI continues to grow, we may need to modify or restrict certain AI-driven functionalities in our products or services, which could impact their adoption or effectiveness.
AI tools can also present unique technological and legal challenges, such as the possibility of insufficient data sets, or data sets that contain biased or inaccurate information, which can negatively impact the decisions, predictions or analyses that AI applications produce. AI algorithms or automated processing of data may be flawed, and datasets may be insufficient or contain inaccurate, incomplete, poor-quality or biased information, which can create discriminatory outcomes or reduce the effectiveness of AI-driven insights. Deficiencies such as these could cause us reputational harm and subject us to legal liability, including claims of product liability, breach of warranty, or negligence. Additionally, AI-generated content and AI-assisted decision-making may raise unresolved intellectual property concerns, including uncertainty regarding ownership, licensing rights, and third-party claims over training data. The scope of these laws and regulations is rapidly evolving, subject to differing interpretations, may be inconsistent among jurisdictions, or conflict with other rules and is likely to remain uncertain for the foreseeable future. Evolving regulations, legal uncertainties, and enforcement actions could increase our compliance burden, limit our ability to deploy AI-driven solutions, and create additional operational challenges. We also expect that there will continue to be new laws, regulations, and industry standards concerning AI and machine learning proposed and enacted in various jurisdictions. If we fail to stay ahead of these developments, we may face additional costs, disruptions in our product development roadmap, and potential competitive disadvantages.
In addition, regulatory authorities and governments around the world are considering a number of legislative and regulatory proposals concerning privacy, collection and use of website visitor data, data storage, data protection, the "right to be forgotten," content regulation, cybersecurity, government access to personal information, online advertising, email and other categories of electronic spam, and other matters that may be applicable to our business. Compliance with these laws may require substantial investment or may be technologically challenging for us. For example, some jurisdictions, including in the United States, are considering whether the collection of anonymous data may invade the privacy of website visitors. If laws or regulations are enacted that limit data collection or use practices related to anonymous data, we and/or our customers may be required to obtain the express consent of web visitors in order for our technology to perform certain basic functions that are based on the collection and use of technical data. Requirements that a website must first obtain consent from its web visitors before using our technology could reduce the amount and value of the services we provide to customers, which might impede sales and/or cause some existing customers to discontinue using our services.
It is also likely that, as our business evolves, an increasing portion of our business shifts to mobile, and our solutions are offered and used in a greater number of countries, we will become subject to laws and regulations in additional jurisdictions. We may need to expend considerable effort and resources to develop new product features and/or procedures to comply with any such legal requirements. It is difficult to predict how existing laws will apply to our business and what new laws and legal obligations we may become subject to. If we are not able to comply with these laws or other legal obligations, or if we become liable under them, we may be forced to implement material changes to our business practices, delay release of new and enhanced services and expend substantial resources, which would negatively affect our business, financial condition and results of operations. In addition, any increased attention focused on liability issues, or as a result of regulatory fines or lawsuits, could harm our reputation or otherwise impact our business, results of operations and financial condition. Any costs incurred as a result of this potential liability could harm our business and operating results.
We monitor pending legislation and regulatory initiatives to ascertain relevance, analyze impact and develop strategic direction surrounding regulatory trends and developments. Due to shifting economic and political conditions, tax policies or rates in various jurisdictions may be subject to significant change. A range of other proposed or existing laws and new interpretations of existing laws could have an impact on our business. For example:
Government agencies and regulators have reviewed, are reviewing and will continue to review, the personal data handling practices of companies doing business online, including privacy and security policies and practices. This review may result in new laws or the promulgation of new regulations or guidelines that may apply to our products and services. For example, the State of California and other states have passed laws relating to disclosure of companies' practices with regard to global opt-out signals from internet browsers, the ability to delete information of minors, age appropriate design obligations for companies that offer online services, products or features "likely to be accessed" by children, and new data breach notification requirements. Washington State recently enacted the "My Health, My Data Act," which broadly protects the privacy of certain personal health information and generally requires consent for the collection, use, or sharing of any such information. Similarly, outside the E.U. and the U.S., a number of countries have adopted or are considering privacy laws and regulations that may result in significant greater compliance burdens. Existing and proposed laws and regulations regarding cybersecurity and monitoring of online behavioral data, such as proposed "Do Not Track" regulations, regulations aimed at restricting certain targeted advertising practices and collection and use of data from mobile devices, new and existing tools that allow consumers to block online advertising and other content, and other proposed online privacy legislation could potentially apply to some of our current or planned products and services. Existing and proposed laws and regulations related to email and other categories of electronic spam could impact the delivery of commercial email and other electronic communications by us or on behalf of customers using our services.
The FTC in particular has aggressively investigated and brought enforcement actions against companies that fail to comply with their privacy or data security commitments to consumers, or fail to comply with regulations or statutes such as the Children's Online Privacy Protection Act. Any investigation or review of our practices may require us to make changes to our products and policies, which could harm our business. Currently there are many proposals by lawmakers and industry groups in this area, both in the United States and overseas, which address the collection, maintenance and use of personal information, web browsing and geolocation data, and establish data security and breach notification requirements. Further, regulators and industry groups have also released self-regulatory principles and guidelines for various data privacy and security practices. Given that this is an evolving and unsettled area of regulation, the imposition of any new significant restrictions or technological requirements could have a negative impact on our business.
Various governmental bodies and many customers and businesses are increasingly focused on environmental, social and governance issues, which has in the past resulted, and may in the future continue to result, in the adoption of new laws and regulations and changing buying practices. If we fail to keep pace with these developments, our reputation and results of operations could be adversely impacted.
We might unintentionally violate such laws now or in the future; such laws or their interpretation or application may be modified; and new laws may be enacted in the future. Any such developments could subject us to legal liability exposure, and harm our business, operating results and financial condition.