Our subsidiaries and we receive, collect, store, process, transfer, and use personal information and other data relating to users of our products, our employees and contractors, and other persons. We have legal and contractual obligations regarding the protection of confidentiality and appropriate use of certain data, including personal information. We are subject to numerous federal, state, local, and international laws, directives, and regulations regarding privacy, data protection, and data security and the collection, storing, sharing, use, processing, transfer, disclosure, and protection of personal information and other data, the scope of which are changing, subject to differing interpretations, and may be inconsistent among jurisdictions or conflict with other legal and regulatory requirements. We are also subject to certain contractual obligations to third parties related to privacy, data protection and data security. We strive to comply with our applicable policies and applicable laws, regulations, contractual obligations, and other legal obligations relating to privacy, data protection, and data security to the extent possible. However, the regulatory framework for privacy, data protection and data security worldwide is, and is likely to remain for the foreseeable future, uncertain and complex, and it is possible that these or other actual or alleged obligations may be interpreted and applied in a manner that we do not anticipate or that is inconsistent from one jurisdiction to another and may conflict with other legal obligations or our practices. Further, any significant change to applicable laws, regulations or industry practices regarding the collection, use, retention, security or disclosure of data, or their interpretation, or any changes regarding the manner in which the consent of users or other data subjects for the collection, use, retention or disclosure of such data must be obtained, could increase our costs and require us to modify our services and features, possibly in a material manner, which we may be unable to complete, and may limit our ability to store and process user data or develop new services and features.
If our subsidiaries or we were found in violation of any applicable laws or regulations relating to privacy, data protection, or security, our business may be materially and adversely affected, and we would likely have to change our business practices and potentially the services and features available through our platform. In addition, these laws and regulations could impose significant costs on us and could constrain our ability to use and process data in manners that may be commercially desirable. In addition, if a breach of data security were to occur or to be alleged to have occurred, if any violation of laws and regulations relating to privacy, data protection or data security were to be alleged, or if we had any actual or alleged defect in our safeguards or practices relating to privacy, data protection, or data security, our solutions may be perceived as less desirable, and our business, prospects, financial condition, and results of operations could be materially and adversely affected.
We also expect that there will continue to be new laws, regulations, and industry standards concerning privacy, data protection, and information security proposed and enacted in various jurisdictions. For example, the data protection landscape in the European Union ("EU") is currently evolving, resulting in possible significant operational costs for internal compliance and risks to our business. The EU adopted the General Data Protection Regulation or GDPR, which became effective in May 2018, and contains numerous requirements and changes from previously existing EU laws, including more robust obligations on data processors and heavier documentation requirements for data protection compliance programs by companies. Among other requirements, the GDPR regulates the transfer of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States.
In addition to the GDPR, the European Commission has another draft regulation in the approval process that focuses on a person's right to conduct a private life. The proposed legislation, known as the Regulation of Privacy and Electronic Communications, or ePrivacy Regulation, would replace the current ePrivacy Directive. Originally planned to be adopted and implemented at the same time as the GDPR, the ePrivacy Regulation is still being negotiated. Although it remains under debate, the proposed ePrivacy Regulation may further raise the bar for the use of cookies, and the fines and penalties for breach may be significant and could affect our services, business and revenues. We cannot yet determine the impact such future laws, regulations and standards may have on our business.
In addition, the U.K.'s General Data Protection Regulation (the "UK GDPR"), imposes robust obligations for the collection, control, use, sharing, disclosure and other processing of personal data and contains documentation and accountability requirements for data protection compliance. The UK GDPR exposes us to two parallel regimes (GDPR and UK GDPR), each of which authorizes similar fines and may subject us to increased compliance risk based on differing, and potentially inconsistent or conflicting interpretation and enforcement by regulators and authorities (particularly, if the laws are amended in the future in divergent ways). Failure to comply with these obligations can result in significant fines and other liability under applicable law. In particular, under the GDPR, fines of up to EUR 20 million (or GBP 17.5 million under the UK GDPR) or up to 4% of the annual global revenue of the noncompliant company, whichever is greater, could be imposed for violations of certain of the GDPR's requirements. The GDPR requirements apply not only to third-party transactions, but also to transfers of data between us and our subsidiaries, including employee data. Because our services are accessible worldwide, certain foreign jurisdictions may claim that we are required to comply with their laws, including in jurisdictions where we have no local entity, employees or infrastructure.
On November 1, 2022, the Digital Markets Act, (the "DMA"), entered into force and on November 16, 2022, the Digital Services Act (the "DSA"), followed. For the DSA, most provisions became applicable on February 17, 2024. The DSA and the DMA focus on creating a safer digital space, protecting fundamental rights of all users of digital services, and establishing a level playing field for businesses and consumers with regards to online platforms. As further guidance is issued and interpretation of both the DSA and the DMA evolves, it is difficult to assess the impact of the DSA and DMA on our and our subsidiaries' business or operations, but, to the extent applicable, it may require us to modify our practices and policies and we could incur substantial costs as a result.
Additionally, legal developments in Europe in recent years, have created complexity and uncertainty regarding transfers of personal data from the EEA to the United States. On June 27, 2021, the European Commission published a new set of modular standard contractual clauses (the "New SCCs"). The New SCCs must be used for all relevant transfers of personal data outside the EEA (since December 27, 2022) and organizations must ensure that all new and existing contracts involving the transfer of personal data outside the EEA contain New SCCs and, for transfers out of the UK, the International Data Transfer Agreement ("IDTA") or the UK Addendum to the New SCCs. In addition to the use of a valid data transfer mechanism, transfer impact assessments must be carried out in respect of planned transfers of personal data from the EEA/UK to third countries including the U.S., and failure to do so may expose us to further compliance risk. The Court of Justice of the European Union ("CJEU") decision also cast doubt over the effectiveness of the SCCs. The European Data Protection Board, which subsequently issued a revised set of SCCs for organizations to utilize, released their comments on the supplementary measures that can be used to ensure a sufficient level of data protection when transferring personal data. The comments indicated that organizations need to perform a data transfer impact assessment to evaluate the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals, and that additional measures and/or contractual provisions may need to be put in place. However, the nature of these additional measures is currently uncertain. Additionally, recent legal developments in EU have created complexity and uncertainty regarding transfers of personal data from the EEA to the United States and other non-adequate jurisdictions. The EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. Data Privacy Framework (UK Extension to the EU-U.S. DPF), and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) were developed to facilitate transatlantic commerce by providing U.S. organizations with reliable mechanisms for personal data transfers to the United States from the European Union / European Economic Area, the United Kingdom (and Gibraltar), and Switzerland that are consistent with EU, UK, and Swiss law. On July 10, 2023, the European Commission adopted its adequacy decision for the EU-U.S. DPF. The adequacy decision concludes that the United States ensures an adequate level of protection – compared to that of the EU - for personal data transferred from the EU to US companies participating in the EU-U.S. DPF. On October 12, 2023, the UK Extension to the EU-U.S. DPF, known as the UK-US Data Bridge, took effect, allowing the transfers of personal data from the United Kingdom (UK) to the US without the need of having additional mechanism or safeguards in place.
Further, the European Commission regularly re-examines its adequacy decisions, including its Decision 2011/61/EU regarding the adequacy of Israeli law. On January 15, 2024, the European Commission successfully concluded its review of 11 existing adequacy decisions. These decisions had been adopted under the EU data protection legislation that preceded the GDPR. The European Commission finds that personal data transferred from the European Union to Andorra, Argentina, Canada, Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay, continues to benefit from adequate data protection safeguards. Therefore, the adequacy decisions adopted for these eleven countries and territories remain in place and data can continue to flow freely to these jurisdictions. In addition, while the European Commission adopted an adequacy decision for the UK on June 28, 2021, allowing the continued flow of personal data from the EEA to the UK, this decision will automatically expire in June 2025 unless the European Commission re-assesses and renews or extends that decision. The decision will be regularly reviewed by the European Commission going forward and may be revoked if the UK diverges from its current data protection laws and the European Commission deems the UK to no longer provide adequate protection of personal data.
Additionally, in June 2018, California passed the California Consumer Privacy Act, or CCPA, which provides new data privacy rights for California consumers and new operational requirements for covered companies. Specifically, the CCPA provides that covered companies must provide new disclosures to California consumers and afford such consumers new data privacy rights that include the right to request a copy from a covered company of the personal information collected about them, the right to request deletion of such personal information, and the right to request to opt-out of certain sales of such personal information. The California Attorney General can enforce the CCPA, including seeking an injunction and civil penalties for violations. The CCPA also provides a private right of action for certain data breaches expected to increase data breach litigation. The CCPA may require us to modify our data practices and policies and to incur substantial costs and expenses in order to comply. On November 3, 2020, California voters passed the California Privacy Rights Act into law, which took effect in January 2023 and significantly expands the CCPA, including by introducing additional obligations such as data minimization and storage limitations, granting additional rights to consumers. The CCPA may increase our compliance costs and potential liability. More generally, some observers have noted the CCPA could mark the beginning of a trend toward more stringent United States state and federal privacy legislations, which could increase our potential liability and adversely affect our business. Additional U.S. states have implemented, or are in the process of implementing, similar new laws or regulations (for example, the Virginia Consumer Data Protection Act ("VCDPA"), which took effect on January 1, 2023, and the Colorado Privacy Act ("CPA"), which took effect on July 1, 2023, Connecticut Data Privacy Act ("CDPA") which took effect on July 1, 2023 Utah Consumer Privacy Act ("UCPA") which took effect on December 31, 2023) that impose new privacy rights and obligations that resemble the CCPA. More generally, some observers have noted that the CCPA, VCDPA, CPA, CDPA and UCPA could mark the beginning of a trend toward more stringent United States federal privacy legislation, which could increase our potential liability and adversely affect our business.
Moreover, other federal laws have been enacted. For example, the Children's Online Privacy Protection Rule that restricts online service providers' collection of user data on minors as well as distribution of materials deemed harmful to minors. In many respects, these state laws focus on advertising activities, mandating that businesses that engage in certain advertising uses of consumer personal data to offer and honor an opt-out of such activities, including, in some states, through browser or device-based preference signals. These state privacy laws also provide consumers other rights, such as to access, correct or delete their personal data (subject to certain limitations), opt out of certain processing of their personal data, and impose special rules on the collection of data from minors, as well as transparency and data governance obligations. Additionally, new state privacy laws (including, privacy laws, social media regulations, children online data laws and data broker laws) are expected to become effective in 2024, including privacy laws in Florida, Oregon, Texas, and Montana, and additional states are expected to follow in future years. There are also a number of legislative proposals pending before the U.S. Congress and various state legislative bodies concerning various data protection topics, including, privacy, children data, data brokers, which could affect us. The abovementioned laws, regulations and decisions could impact our services, business operations, practices, products, or our ability to receive information necessary to conduct our business.
In addition, failure to comply with the Israeli Privacy Protection Law 5741-1981, and its regulations as well as the guidelines of the Israeli Privacy Protection Authority, may expose us to administrative fines, civil claims (including class actions), and in certain cases, criminal liability. Current pending amendment to the Israeli Privacy Protection Law, 1981 is expected to enhance fines and sanctions for breaching the Israeli Privacy Law and to strengthen the enforcement capacity of the Israeli Privacy Protection Authority. There have also been privacy bills enacted in other countries around the world, such as Brazil, which have introduced new or expanded privacy requirements and we expect that privacy legislation will continue to evolve in the coming years. Therefore, it is difficult to determine whether and how such existing laws and regulations will apply to and impact the internet and our business.
On January 15, 2024, the European Commission successfully concluded its review of 11 existing adequacy decisions. These decisions had been adopted under the EU data protection legislation that preceded the GDPR. The European Commission finds that personal data transferred from the European Union to Andorra, Argentina, Canada, Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland, and Uruguay, continues to benefit from adequate data protection safeguards. Therefore, the adequacy decisions adopted for these eleven countries and territories remain in place and data can continue to flow freely to these jurisdictions.
Any failure or perceived failure by our subsidiaries or by us to comply with our posted privacy policies, our privacy-related obligations to users or other third parties, or any other legal obligations or regulatory requirements relating to privacy, data protection, or data security may result in governmental investigations or enforcement actions, litigation, claims, or public statements against us by consumer advocacy groups or others and could result in significant liability, cause our users to lose trust in us, and otherwise materially and adversely affect our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, other obligations, and policies that are applicable to the businesses of our users may limit the adoption and use of, and reduce the overall demand for, our platform. Additionally, if third parties we work with violate applicable laws, regulations, or contractual obligations, such violations may put our users' data at risk, could result in governmental investigations or enforcement actions, fines, litigation, claims, or public statements against us by consumer advocacy groups or others and could result in significant liability, cause our users to lose trust in us, and otherwise materially and adversely affect our reputation and business. Further, public scrutiny of, or complaints about, technology companies or their data handling or data protection practices, even if unrelated to our business, industry, or operations, may lead to increased scrutiny of technology companies, including us, and may cause government agencies to enact additional regulatory requirements, or to modify their enforcement or investigation activities, which may increase our costs and risks.
While it is generally the laws of the jurisdiction in which our business is located apply, there is a risk that data protection regulators of other countries may seek jurisdiction over our remotely activities in locations in which we process data of our customers, but do not have an operating entity. Where the local data protection and privacy laws of a jurisdiction apply, we may be required to register our operations in that jurisdiction or make changes to our business so that personal data is only collected and processed in accordance with applicable local law. In addition, because our services are accessible worldwide, certain foreign jurisdictions may claim that we are required to comply with their privacy and data protection laws, including in jurisdictions where we have no local entity, employees, or infrastructure. In such cases, we may require additional legal review and resources to ensure compliance with any applicable privacy or data protection laws and regulations. In addition, in many jurisdictions there may in the future be new legislation that may affect our business and require additional legal review. Additionally, if third parties we work with violate applicable laws, regulations, or contractual obligations, such violations may put our users' data at risk, could result in governmental investigations or enforcement actions, fines, litigation, claims, or public statements against us by consumer advocacy groups or others and could result in significant liability, cause our users to lose trust in us, and otherwise materially and adversely affect our reputation and business. Further, public scrutiny of, or complaints about, technology companies or their data handling or data protection practices, even if unrelated to our business, industry, or operations, may lead to increased scrutiny of technology companies, including us, and may cause government agencies to enact additional regulatory requirements, or to modify their enforcement or investigation activities, which may increase our costs and risks.