A variety of federal, state and foreign laws and regulations govern the collection, use, retention, sharing and security of consumer data. Laws and regulations relating to privacy, data protection and consumer protection are evolving and subject to potentially differing interpretations. These requirements may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another or may conflict with other rules or our practices. As a result, our practices may not have complied or may not comply in the future with all such laws, regulations, requirements and obligations. Any failure, or perceived failure, by us to comply with any federal, state or foreign privacy or consumer protection-related laws, regulations, industry self-regulatory principles, industry standards or codes of conduct, regulatory guidance, orders to which we may be subject or other legal obligations relating to privacy or consumer protection could adversely affect our reputation, brand and business, and may result in claims, investigations, proceedings or actions against us by governmental entities or others or other liabilities or require us to change our operations.
We collect, store, process, and use personal information and other customer data, and we rely on third parties that are not directly under our control to manage certain of these operations and to collect, store, process and use payment information. Our members' and customers' personal information may include names, addresses, phone numbers, email addresses, payment card data, and payment account information, as well as other information. Due to the volume and sensitivity of the personal information and data we and these third parties manage, the security features of our information systems are critical. If our security measures, some of which are managed by third parties, are breached or fail, unauthorized persons may be able to access sensitive customer data, including payment card data. As discussed above, our network has previously been breached by hackers via a virtual private network (VPN) and while they encrypted certain local desktop computers and servers connected to that domain, there was no exposure of our customer database or primary system servers which host our website in the attack. If we or our independent service providers or business partners experience a breach of systems that collect, store or process our members' and customers' sensitive data, our brand could be harmed, sales of our products could decrease, and we could be exposed to claims, losses, administrative fines, litigation or regulatory and governmental investigations and proceedings. Any such claim, investigation, proceeding or action could hurt our reputation, brand and business, force us to incur significant expenses in defense of such proceedings, distract our management, increase our costs of doing business, result in a loss of members, customers and suppliers and may result in the imposition of monetary penalties and administrative fines. Depending on the nature of the information compromised, we may also have obligations to notify users, law enforcement, or payment companies about the incident and may need to provide some form of remedy, such as refunds, for the individuals affected by the incident.
Privacy laws, rules, and regulations are constantly evolving in the United States and abroad and may be inconsistent from one jurisdiction to another. We expect that new industry standards, laws and regulations will continue to be proposed regarding privacy, data protection and information security in many jurisdictions, including the California Consumer Privacy Act of 2018, which went effective January 1, 2020, the California Consumer Privacy Rights Act, which goes effective on January 1, 2023, the Colorado Privacy Act, which goes effective on July 1, 2023 and the Virginia Consumer Data Protection Act, which went effective on January 1, 2023, and others. We cannot yet determine the impact such future laws, regulations and standards may have on our business. Complying with these evolving obligations is costly. For instance, expanding definitions and interpretations of what constitutes "personal data" (or the equivalent) within the United States and elsewhere may increase our compliance costs. Any failure to comply could give rise to unwanted media attention and other negative publicity, damage our customer and consumer relationships and reputation, and result in lost sales, claims, administrative fines, lawsuits or regulatory and governmental investigations and proceedings and may harm our business and results of operations.
Outside of the United States, there are many countries with data protection laws, and new countries are adopting data protection legislation with increasing frequency. Many of these laws may require consent from members and customers for the use of data for various purposes, including marketing, which may reduce our ability to market our products. There is no harmonized approach to these laws and regulations globally. Consequently, we will increase our risk of non-compliance with applicable foreign data protection laws and regulations if we expand internationally. We may need to change and limit the way we use personal information in operating our business and may have difficulty maintaining a single operating model that is compliant. Compliance with such laws and regulations will result in additional costs and may necessitate changes to our business practices and divergent operating models, limit the effectiveness of our marketing activities, adversely affect our business and financial condition, and subject us to additional liabilities.
In addition, various federal, state and foreign legislative and regulatory bodies, or self-regulatory organizations, may expand current laws or regulations, enact new laws or regulations or issue revised rules or guidance regarding privacy, data protection and consumer protection. Further regulation and interpretation of existing regulation of cookies and similar technologies may lead to broader restrictions on our marketing and personalization activities and may negatively impact our efforts to understand users' internet usage, as well as the effectiveness of our marketing and our business generally. Such regulations may have a negative effect on businesses, including ours, that collect and use online usage information for consumer acquisition and marketing, it may increase the cost of operating a business that collects or uses such information and undertakes online marketing, it may also increase regulatory scrutiny and increase potential civil liability under data protection or consumer protection laws. Any such changes may force us to incur substantial costs or require us to change our business practices. This could compromise our ability to pursue our growth strategy effectively and may adversely affect our ability to acquire members and customers or otherwise harm our business, financial condition, and operating results.