A variety of federal, state and foreign laws and regulations govern the collection, use, retention, sharing and security of consumer data. Laws and regulations relating to privacy, data protection and consumer protection are evolving and subject to potentially differing interpretations. These requirements may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another or may conflict with other rules or our practices. As a result, our practices may not comply with all such laws, regulations, requirements and obligations. Any failure, or perceived failure, by us to comply with any federal, state or foreign privacy or consumer protection-related laws, regulations, industry self-regulatory principles, industry standards or codes of conduct, regulatory guidance, orders to which we may be subject or other legal obligations relating to privacy or consumer protection could adversely affect our reputation, brand and business, and may result in claims, investigations, proceedings or actions against us by governmental entities or others or other liabilities or require us to change our operations.
We collect, store, process, and use personal information and other customer data, and will rely on third parties that are not directly under our control to manage certain of these operations and to collect, store, process and use payment information. Our customers' personal information may include names, addresses, phone numbers, email addresses, payment card data, and payment account information, as well as other information. Due to the volume and sensitivity of the personal information and data we and these third parties manage, the security features of our information systems are critical. If our security measures, some of which are managed by third parties, are breached or fail, unauthorized persons may be able to access sensitive customer data, including payment card data. If we or our independent service providers or business partners experience a breach of systems that collect, store or process our members' and customers' sensitive data, our brand could be harmed, sales of our products could decrease, and we could be exposed to claims, losses, administrative fines, litigation or regulatory and governmental investigations and proceedings. Any such claim, investigation, proceeding or action could hurt our reputation, brand and business, force us to incur significant expenses in defense of such proceedings, distract our management, increase our costs of doing business, result in a loss of customers and suppliers and may result in the imposition of monetary penalties and administrative fines. Depending on the nature of the information compromised, we may also have obligations to notify users, law enforcement, or payment companies about the incident and may need to provide some form of remedy, such as refunds, for the individuals affected by the incident.
Privacy laws, rules, and regulations are constantly evolving in the United States and abroad and may be inconsistent from one jurisdiction to another. We expect that new industry standards, laws and regulations will continue to be proposed regarding privacy, data protection and information security in many jurisdictions, including privacy acts previously adopted by the states of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia, certain of which are already effective, and certain of which become effective during 2023, and from 2024 to 2026. We cannot yet determine the impact such future laws, regulations and standards may have on our business. Complying with these evolving obligations is costly. For instance, expanding definitions and interpretations of what constitutes "personal data" (or the equivalent) within the United States and elsewhere may increase our compliance costs. Any failure to comply could give rise to unwanted media attention and other negative publicity, damage our customer and consumer relationships and reputation, and result in lost sales, claims, administrative fines, lawsuits or regulatory and governmental investigations and proceedings and may harm our business and results of operations.