We collect, use, process, transmit, and store information that is related to individuals and/or that constitutes "personal data," "personal information," "personally identifiable information," or similar terms under applicable data privacy laws (collectively, "Personal Information") about consumers and their devices, employees, job applicants and partners. We also rely on third-party service providers and partners to collect, process, transmit, and store Personal Information on our behalf. We collect such information from individuals located both in the United States and abroad, and we, and our service providers and business partners use tracking technologies, including cookies, device identifiers, and related technologies, to help us manage and track our users' interactions with our products and services, devices, website, and partners' content.
To deliver relevant advertisements effectively, we must successfully leverage this Personal Information, as well as data provided by third parties. Our ability to collect and use such data could be restricted by a number of factors, including users having the ability to refuse consent to or opt out from our, our service providers', or our advertising partners' collection and use of this Personal Information, restrictions imposed by advertisers, content partners, licensors, and service providers, changes in technology, and developments in laws, regulations, and industry standards. For example, certain EU laws and regulations prohibit access to or storage of information on a user's device (such as cookies and similar technologies that we use for advertising) that is not "strictly necessary" to provide a user-requested service or used for the "sole purpose" of a transmission unless the user has provided consent, and users may choose not to provide this consent to collection of information which is used for advertising purposes.
Additionally, certain device manufacturers or operating system providers may restrict the deployment of cookies and similar technologies or otherwise restrict the collection of Personal Information through these or other tools, via our applications. Any restrictions on our ability to collect or use Personal Information could harm our ability to grow our revenue, particularly our Media Platform revenue which depends on engaging the relevant recipients of advertising campaigns.
We and our vendors and partners are also subject to various federal, state, and foreign laws and regulations as well as industry standards and contractual obligations governing the collection, use, retention, protection, disclosure, cross-border transfer, localization, sharing, and security of the Personal Information. These requirements and their application, interpretation and amendment, as well as the regulatory environment for the collection and use of Personal Information by device manufacturers, online service providers, content distributors, advertisers, and publishers is evolving in the United States and internationally. It is also possible that new laws, regulations and other requirements, or amendments to or changes in interpretations of existing laws, regulations and other requirements, may require us to incur significant costs, implement new processes, or change our handling of Personal Information and business operations, which could ultimately hinder our ability to grow our business by extracting value from our data assets.
For example, privacy and consumer rights groups and government bodies (including the U.S. Federal Trade Commission ("FTC"), state attorneys general, the European Commission, and European and UK data protection authorities), have increasingly scrutinized privacy issues with respect to devices that identify or are identifiable to a person (or household or device) and Personal Information collected through the internet, and we expect such scrutiny to continue to increase. The U.S. federal government, U.S. states, and foreign governments have enacted (or are considering) laws and regulations that could significantly restrict industry participants' ability to collect, use, and share Personal Information, such as by regulating the level of consumer notice and consent required before a company can place cookies or other tracking technologies or collect categories of Personal Information deemed sensitive. Additionally, many such laws and regulations provide consumers with the ability to opt-out of the use of their Personal Information for certain processing purposes, which could impact our business. For example, the EU General Data Protection Regulation ("GDPR") imposes detailed requirements related to the collection, storage, and use of Personal Information related to people located in the EU (or which is processed in the context of EU operations) and places data protection obligations and restrictions on organizations, and may require us to make further changes to our policies and procedures in the future beyond what we have already done. Member states also have some flexibility to supplement the GDPR with their own laws and regulations and may apply stricter requirements for certain data processing activities. As a result of the exit of the United Kingdom from the European Union, the UK's GDPR will not automatically incorporate any future changes made to the EU's GDPR going forward (which would need to be specifically incorporated by the United Kingdom government). Moreover, the United Kingdom government has publicly announced plans to reform the UK's GDPR in ways that, if formalized, are likely to deviate from the EU's GDPR in certain areas, which creates a risk of divergent parallel regimes and related uncertainty, along with the potential for increased compliance costs and risks for affected businesses. We are monitoring such developments and the impact this may have on our business.
If we are not compliant with data protection laws or regulations if and when implemented, we may be subject to significant fines and penalties (such as restrictions on Personal Information processing) and our business may be harmed. For example, under the GDPR, fines of up to 20 million euros or 4% of the annual global revenue of a noncompliant company, whichever is higher, as well as data processing, possible prohibitions, or other restrictions, could be imposed for violation of certain of the GDPR's requirements. Further, the GDPR provides for private litigation related to the processing of personal data that can be brought by classes of data subjects or consumer protection organizations authorized at law to represent the data subjects' interests.
Moreover, the EU's Data Act creates a regulatory framework to govern the sharing, use and re-use of internet or product-generated data and imposes, among other obligations, certain requirements concerning cross-border international transfers of, and governmental access to, non-personal data outside the European Economic Area ("EEA"). Depending on how this act and any similar laws are implemented and interpreted, we may have to adapt our business practices and contractual arrangements to comply with such obligations.
The U.S. data protection legal landscape also continues to evolve, with various states having enacted broad-based data privacy and protection legislation and with states and the federal government continuing to consider additional data privacy and protection legislation. The potential effects of this legislation are far-reaching and may require us to modify our data processing practices and policies and incur substantial costs and expenses in an effort to comply. For example, the California Consumer Privacy Act provides for civil penalties for violations, as well as a private right of action for certain data breaches that may increase data breach litigation. Federal laws such as the Children's Online Privacy Protection Act and Video Privacy Protection Act may also pose risks to our business.
We are continuing to assess the impact of new and proposed data privacy and protection laws and proposed amendments to existing laws on our business. Among other things, such restrictions are likely to increase the number of users to whom we cannot serve targeted advertising and are likely to restrict our ability to collect and process certain types of Personal Information deemed sensitive under these new laws.
In addition, each U.S. state and most U.S. territories, each EU member state, and the United Kingdom, as well as many other foreign nations, have passed laws requiring notification to regulatory authorities, affected users, or others within a specific timeframe when there has been a security breach involving, or other unauthorized access to or acquisition or disclosure of, certain Personal Information and impose additional obligations on companies. Additionally, our agreements with certain users or partners may require us to notify them in the event of a security breach. Such statutory and contractual disclosures are costly, could lead to negative publicity, may cause our users to lose confidence in the effectiveness of our security measures, and may require us to expend significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach. Compliance with these obligations could delay or impede the development of new products and may cause reputational harm.
As part of our data protection compliance program, we have implemented data transfer mechanisms to provide for the transfer of Personal Information from the EEA or the United Kingdom to the United States.
In addition, cloud service providers upon which our services depend are experiencing heightened scrutiny from EU regulators, which may lead to significant shifts or unavailability of cloud services to transfer Personal Information outside the EU, which may significantly impact our costs or ability to operate.
We continue to assess the available regulatory guidance, determinations, and enforcement actions from EU and UK Data Protection Authorities and the U.S. Department of Commerce on international data transfer compliance for companies, including guidance on specific supplementary measures in addition to the model clauses as well as specific data sharing that may be deemed a cross-border transfer for which appropriate safeguards must be implemented. Although the United Kingdom currently has an adequacy decision from the European Commission, such that standard contractual clauses are not required for the transfer of personal data from the EEA to the United Kingdom, that decision will sunset in June 2025 unless extended and it may be revoked in the future by the European Commission if the United Kingdom data protection regime is reformed in ways that deviate substantially from the GDPR. Our ability to continue to transfer personal information outside of the EU and UK may become significantly more costly and may subject us to increased scrutiny and liability under the GDPR or other legal frameworks, and we may experience operating disruptions if we are unable to conduct these transfers in the future.
We will continue to review our business practices and may find it necessary or desirable to make changes to our personal information processing to cause our transfer and receipt of EEA residents' personal information to conform to applicable European law.
Even though we believe we and our vendors are generally in compliance with applicable laws, rules and regulations relating to privacy and data security, these laws are in some cases relatively new and the interpretation and application of these laws are uncertain. Any failure or perceived failure by us to comply with data privacy laws, rules, regulations, industry standards and other requirements could result in proceedings or actions against us by individuals, consumer rights groups, government agencies, or others. We could incur significant costs in investigating and defending such claims and, if found liable, pay significant damages or fines or be required to make changes to our business. Further, these proceedings and any subsequent adverse outcomes may subject us to significant negative publicity and an erosion of trust. If any of these events were to occur, our business, results of operations, and financial condition could be materially adversely affected. Moreover, we have incurred, and will continue to incur, expenses to comply with privacy and security standards and protocols imposed by law, regulation, industry standards, and contractual obligations. Increased regulation of Personal Information collection, use, and security practices, including self-regulation and industry standards, changes in existing laws, enactment of new laws, increased enforcement activity, and changes in interpretation of laws, could increase our cost of compliance and operation, limit our ability to grow our business, or otherwise harm our business.