Many local, state, federal, and international laws and regulations apply to the collection, use, retention, protection, disclosure, transfer, and other processing of data collected from and about consumers and devices, and the regulatory framework for privacy issues is evolving worldwide. Various U.S. and foreign governments, consumer agencies, self-regulatory bodies, and public advocacy groups have called for or implemented new regulation directly impacting the digital advertising industry.
A number of states, including California, have enacted comprehensive consumer privacy laws regulating the collection and use of data to target advertisements, and we expect to see more state laws and potentially federal regulation in the future. Such legislation or regulation could affect the costs of doing business online and may adversely affect the demand for or the effectiveness and value of our solution.
These state laws require all businesses that engage in certain advertising uses of consumer personal data to offer and honor an opt-out of such activities, including, in some states, through universal browser or device-based preference signals such as GPC. The implementation of these state laws and any corresponding regulations will cause us to incur additional compliance costs and may impose additional restrictions on us and on our industry partners.
Separate from these comprehensive state consumer privacy laws, lawmakers continue to focus their efforts on data collection, processing, and disclosures by companies that do not have direct relationships with the consumers whose personal data they process. Several states, including California, Oregon, and Texas, have recently enacted or updated laws restricting the activities of "data brokers." Notably, California's Delete Act, dramatically increases obligations and potential penalties relative to the state's preexisting data broker statute. Beyond additional transparency requirements, beginning in August 2026, companies registered as data brokers in California (including Magnite), must honor universal deletion requests consumers make of all data brokers via a deletion mechanism the state will create. These obligations may reduce the data available to Magnite, require us to develop complex and expensive compliance tools and procedures, and may result in reductions in revenue.
In the European Economic Area ("EEA") and the United Kingdom ("UK"), the General Data Protection Regulation, Regulation (EU) 2016/679 ("GDPR") and UK General Data Protection Regulation ("UK GDPR") respectively treat much of the end-user information that is critical to programmatic digital advertising as "personal data", subject to significant conditions and restrictions on its collection, use, transfer and disclosure. The GDPR and UK GDPR also set out substantial potential liabilities for certain data protection violations and create a compliance burden for us in the course of delivering our solution in Europe.
Further, many governments are restricting the transmission or storage of information about individuals beyond their national borders. Such restrictions could, depending upon their scope, limit our ability to utilize technology infrastructure consolidation, redundancy, and load-balancing techniques, resulting in increased infrastructure costs, decreased operational efficiencies and performance, and increased risk of system failure.
These laws and regulations are continually evolving, not always clear, and not always consistent across the jurisdictions in which we do business. Any failure to protect, and comply with applicable laws and regulations or industry standards applicable to, personal data or other data relating to consumers could result in enforcement action against us, including fines, imprisonment of our officers, and public censure, claims for damages by consumers and other affected individuals, damage to our reputation, and loss of goodwill.