We collect, store, use and process personal information and other user data, including financial information, credit report information and other sensitive information for our users. We rely on this data provided to us by users and third parties to offer, improve and innovate our products. If we are unable to maintain and grow such data we may be unable to provide consumers with a platform experience that is relevant, efficient and effective, which could adversely affect our business, financial condition and results of operations.
There are numerous federal, state and local laws and regulations regarding data privacy and the storing, sharing, use, processing, disclosure and protection of personal information and other user data, the scope of which are changing and subject to differing interpretations. In addition, as we continue to expand internationally, we are subject to foreign data privacy and security laws and regulations. These data privacy laws and regulations are complex, continue to evolve, and on occasion may be inconsistent between jurisdictions leading to uncertainty in interpreting such laws. We are also subject to the terms of our privacy policies and privacy-related obligations to third parties, and, given the evolving regulatory environment, we expect a heightened level of scrutiny on the data we handle. It is possible that these laws, regulations, and other obligations may be interpreted and applied in a manner that is inconsistent from one regulatory body to another and may conflict with other rules or our practices.
Most of the jurisdictions in which we operate have established their own data privacy and security legal frameworks. For example, in the U.S., we are subject to the Gramm–Leach–Bliley Act (GLBA) which governs non-public personal information of individuals who obtain financial products or services from financial institutions primarily for personal, family or household purposes, as well as the Fair Credit Reporting Act (FCRA) which generally governs the collection of credit information and access to credit reports. These laws restrict the collection, use, storage and disposal of information about individuals that we may collect during the provision of our products and impose certain disclosure obligations on us. Failure to comply with these laws can result in regulatory fines or penalties. Certain of our products that are not otherwise subject to the GLBA or FCRA may be subject to additional laws and regulations. For example, the California Consumer Privacy Act (CCPA) created new data privacy rights for California-resident users that were expanded when the California Privacy Rights Act (CPRA) went into effect in 2023. In addition, a growing number of states have passed or are expected to pass their own respective privacy laws. These laws, as well as any associated regulations, create a patchwork that poses challenges for our business and may increase our operating costs and potential liability (particularly in the event of a data breach), delay or impede the development of new products, and have a material adverse effect on our business, including how we use information about individuals, our financial condition and the results of our operations or prospects.
As we expand internationally, we will also be subject to international laws regarding privacy and the storing, sharing, use, processing, disclosure and protection of personal information and other user data. For example, following our expansion into the UK market, we became subject to the privacy, data security, and data protection requirements of the UK's data protection regime, consisting primarily of the Data Protection Act 2018 and the Data Protection, Privacy and Electronic Communications Regulations 2019 as amended by the Data Protection, Privacy and Electronic Communications Regulations 2020, or the UK GDPR, and other data protection regulations. Among other stringent requirements, the UK GDPR (like its EU counterpart) restricts transfers of data from the UK to third countries deemed to lack adequate privacy protections (such as the U.S.), unless an appropriate safeguard is implemented.
In the aftermath of the UK's withdrawal from the EU in January 2020 (an event commonly referred to as Brexit), there was uncertainty with regard to the regulation of data protection in the UK. Since then, the UK has undergone efforts to introduce post-Brexit data protection reform in the form of the Data Protection and Digital Information (No. 2) Bill (the "Bill") which is intended to supersede the UK's version of the GDPR. As of December 2023, the Bill was at the Committee Stage of the House of Lords and further progress is expected during the course of 2024. While the Bill has largely remained consistent with the spirit of the EU's GDPR, there are few instances where changes have been made, and more changes are possible during the course of the legislative process. As a result, we may face challenges in addressing and implementing the requirements of the proposed new law in light of uncertainty over its interpretation and application to data transfer, privacy, data protection, and information security in the UK, and may incur significant costs and expenses in an effort to do so. Any failure or perceived failure by us to comply with applicable laws and regulations or any of our other legal obligations relating to privacy, data protection, or information security may result in governmental investigations or enforcement actions, litigation, claims, or public statements against us. Any of the foregoing could result in significant liability or cause our users to lose trust in us, any of which could have an adverse effect on our reputation, operations, financial performance and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our customers may limit the adoption and use of, and reduce the overall demand for, our products and services.
We are also subject to and actively taking steps to comply with evolving UK privacy laws on cookies and e-marketing. In the UK, informed consent is required for the placement of certain cookies or similar technologies on a user's device and for direct electronic marketing and valid consent is tightly defined, including, a prohibition on pre-checked consents and, in the context of cookies, a requirement to obtain separate consents for each type of cookie or similar technology. Strict enforcement of these requirements could lead to substantial costs, require significant systems changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities. Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target users, may negatively impact our efforts to understand users and match them with products.
Any failure or perceived failure by us to comply with our privacy policies, our privacy-related obligations to users or other third parties, or our privacy-related legal obligations, or any compromise of security that results in the unauthorized release or transfer of personally identifiable information or other user data, may result in governmental enforcement actions, litigation or negative publicity and could cause our users and financial partners to lose trust in us, which would have a material and adverse effect on our business. We may also be subject to remedies that may harm our business, including fines, demands or orders that we modify or cease existing or planned business practices.