Our operations may from time to time involve cross-border transfer of data, which may subject us and our customers that use our products to privacy, cybersecurity and data protection-related laws and regulations that impose obligations in connection with the collection, processing and use of personal data, financial data, health or other similar data and general cybersecurity. Multiple jurisdictions have adopted or proposed limitations on, or requirements regarding, the collection, distribution, use, security and storage of information, including personally identifiable information of individuals.
In the United States, the U.S. Federal Trade Commission and numerous state attorneys general are applying federal and state consumer protection laws to impose standards on the online collection, use and dissemination of data, and to the security measures applied to such data. We continue to see increased regulation of privacy cybersecurity and data protection, including the adoption of more stringent subject matter specific state laws in the United States. For example, in 2018, California enacted the California Consumer Privacy Act, or the CCPA, which took effect on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability, and we may be required to modify our practices and take additional steps in an effort to comply with the CCPA. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent state privacy legislation in the United States, which could increase our potential liability and adversely affect our business.
Similarly, many other countries and governmental bodies, including the EU member states, have laws and regulations concerning the collection and use of personal data obtained from individuals located in the EU or by businesses operating within their jurisdiction, which are often more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure and security of personal data that identifies or may be used to identify an individual, such as names, telephone numbers, email addresses and, in certain circumstances, IP addresses and other online identifiers. For example, the EU has adopted the GDPR, which enhances data protection obligations for businesses and requires service providers (data processors) processing personal data on behalf of customers to cooperate with European data protection authorities, implement security measures and keep records of personal data processing activities. The GDPR also extends the geographical scope of EU data protection law to non-EU entities under certain conditions, tightens existing EU data protection principles and creates new obligations for companies and new rights for individuals. Noncompliance with the GDPR can trigger fines equal to or greater of €20 million or 4% of global annual revenues. Given the breadth and depth of its obligations, working to meet the requirements of the GDPR has required significant time and resources, including a review of our technology and systems currently in use against the requirements of the GDPR. There are also additional EU laws and regulations (and member states implementations thereof) which govern the protection of consumers and of electronic communications. We have taken measures to address certain obligations under the GDPR and to make us GDPR compliant, but we may be required to take additional steps in order to comply with the GDPR. If our efforts to comply with GDPR or other applicable EU laws and regulations are not successful, we may be subject to penalties and fines that would adversely impact our business and operating results, and our ability to conduct business in the EU could be significantly impaired.
We also continue to see jurisdictions imposing data localization laws, which require personal information, or certain subcategories of personal information to be stored in the jurisdiction of origin. These regulations may inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant additional costs.
Additionally, although we endeavor to have our products and platform comply with applicable laws and regulations, these and other obligations may be modified, they may be interpreted and applied in an inconsistent manner from one jurisdiction to another, and they may conflict with one another, other regulatory requirements, contractual commitments or our practices. We expect that there will continue to be new proposed laws, rules of self- regulatory bodies, regulations and industry standards concerning privacy, data protection and information security in the United States, the EU and other jurisdictions, and we cannot yet determine the impact such future laws, rules, regulations and standards may have on our business. The uncertainty and changes in the requirements of multiple jurisdictions may increase the cost of compliance, delay or reduce demand for our services, restrict our ability to offer services in certain locations, impact our customers' ability to deploy our products and solutions in certain jurisdictions, or subject us to claims and litigation from private actors and investigations, proceedings, and sanctions by data protection regulators, all of which could harm our business, financial condition and operating results.
We also may be bound by contractual obligations relating to our collection, use and disclosure of personal, financial and other data or may find it necessary or desirable to join industry or other self-regulatory bodies or other privacy, cybersecurity or data protection-related organizations that require compliance with their rules pertaining to privacy and data protection.
Any failure or perceived failure by us, our products or our platform to comply with new or existing U.S., EU or other foreign privacy, cybersecurity or data protection laws, regulations, policies, industry standards or legal obligations, any failure to bind our suppliers and contractors to appropriate agreements or to manage their practices or any systems failure or security incident that results in the unauthorized access to, or acquisition, release or transfer of, personally identifiable information or other data relating to customers or individuals may result in governmental investigations, inquiries, enforcement actions and prosecutions, private claims and litigation, fines and penalties, adverse publicity or potential loss of business.