We collect, store, disclose and process personal information and other data. There are numerous federal and state laws, as well as regulations and industry guidelines and standards, regarding privacy and the collection, storing, use, processing, disclosure, and protection of personal information, the scope of which are continually changing, subject to differing interpretations, and may be inconsistent among countries and states or conflict with other laws, regulations, guidelines, and standards. Additionally, laws, regulations, guidelines and standards covering marketing and advertising activities conducted by telephone, email, mobile devices, and the internet, may be applicable to our business, such as the Telephone Consumer Protection Act (the "TCPA") (as implemented by the Telemarketing Sales Rule), the CAN-SPAM Act, and similar state consumer protection laws. We are also subject to the terms of our own privacy policies and certain privacy-related obligations to third parties. We strive to comply with all applicable laws, regulations, policies, legal obligations and industry guidelines and standards relating to privacy, data protection and marketing and advertising activities to the extent possible. However, it is possible that these laws, regulations, policies, legal obligations, and industry guidelines and standards may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other laws, regulations, policies, legal obligations, and industry guidelines and standards, making enforcement, and thus compliance requirements, ambiguous, uncertain, and potentially inconsistent. It is possible we may not be in full compliance with certain laws, regulations, policies, legal obligations, industry guidelines and standards, and any failure or perceived failure by us to comply with these requirements may result in governmental investigations or enforcement actions, litigation, loss of business and unfavorable publicity. Any of these events could cause us to incur significant costs in investigating and defending such claims and, if found liable, pay significant damages. Further, these proceedings and any subsequent adverse outcomes may cause significant reputational harm to our brand and our customers to lose trust in us, which could have an adverse effect on our reputation and business.
Any significant change to applicable laws, regulations or industry guidelines and standards regarding the collection, use processing or disclosure of personal information, could require us to modify our products and features, possibly in a material manner and subject to increased compliance costs, which may limit our ability to develop new products and features that make use of the personal information that we collect, use, process, and disclose. For example, the California Consumer Privacy Act (the "CCPA"), which took effect on January 1, 2020, imposes obligations and restrictions on companies regarding their collection, use, processing and disclosure of personal information and provides new and enhanced data privacy rights to California residents. The CCPA imposes a severe statutory damages framework that could result in significant costs if a business violates the law. Since the enactment of the CCPA, new privacy and data security laws have been proposed in more than half of the states in the U.S. In California, voters approved a ballot initiative from privacy rights advocates that augments and expands the CCPA, the California Privacy Rights Act (the "CPRA"), on November 3, 2020, which took effect on January 1, 2023 (with a look back to data collected, on or after January 1, 2022). The CPRA significantly modifies the CCPA, including by creating a new state agency that vested with the authority to implement and enforce California's privacy laws, the California Privacy Protection Agency. Additionally, Nevada enacted a law that requires companies to honor consumers' requests to no longer sell their data. Violators may be subject to injunctions and civil penalties of up to $5,000 per violation. Numerous other states have already enacted, and are actively considering enacting privacy laws, which may impose substantial penalties for violations, impose significant costs for investigations and compliance, allow private class-action litigation, carry significant potential liability for our business, and could result in reputational harm. This existing and future legislation may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment in resources to compliance programs, could impact strategies and availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies, all of which we may not be able to expend resources toward. We expect that there will continue to be new proposed laws, regulations, and industry standards and guidelines concerning privacy, data protection, and information security and we cannot determine the impact such future laws, regulations, and standards may have on our business. We could be subject to legal claims, government investigations or actions, or harm to our reputation or incur significant remediation costs if we experience a security breach or our practices fail, or are seen as failing, to comply with our policies or with applicable laws concerning personal information.
Further, if the trend of new data privacy laws and increasing enforcement by regulators continues, this could lead to substantial costs, require significant systems changes, divert the attention of our personnel, increase costs and subject us to additional liabilities. Any of the foregoing could materially adversely affect our brand, reputation, business, results of operations, and financial condition.
The U.S. Federal Trade Commission and many state attorneys general are also interpreting federal and state consumer protection laws to impose standards for the collection, use, processing, dissemination, and security of data. Amongst other requirements, such standards may require us to publish statements that describe how we handle personal information and choices individuals may have about the way we handle their personal information. If, for example, such information that we publish is considered untrue or inaccurate, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences, including penalties and reputational harm.