The global data protection landscape is rapidly evolving, and we are or may become subject to numerous state, federal and foreign laws, requirements and regulations governing the collection, use, disclosure, retention, and security of personal information. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, our internal policies and procedures or our contracts governing our processing of personal information could result in negative publicity, government investigations and enforcement actions, claims by third parties and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business.
In the U.S., numerous state laws impose standards relating to the privacy, security, transmission and breach reporting of personal information. Such laws and regulations are subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us, our customers and our strategic partners. For example, the CCPA went into effect on January 1, 2020. The CCPA creates individual privacy rights for California consumers and imposes privacy and security obligations on entities handling personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches suffered as a result of the business's violation of the duty to implement and maintain reasonable security procedures and practices, and this may lead to breach litigation. Further, the CPRA, effective January 1, 2023, significantly amended the CCPA and imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also created a new California data protection agency authorized to issue substantive regulations, which could result in increased privacy and information security enforcement. Similar laws are now in effect and enforceable in Virginia, Colorado, Connecticut, and Utah, and will soon be enforceable in several other states as well. Additionally, state regulators may exercise greater scrutiny regarding the collection and processing of personal information for purposes of online advertising, marketing, and analytics. These laws and their requirements could have a material adverse effect on our financial performance, and any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.
Furthermore, the Federal Trade Commission ("FTC") and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. The FTC sees failure to take appropriate steps to keep consumers' personal information secure as constituting unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. The FTC has recently conducted enforcement actions against other companies that created new precedents that may require us to adjust our business practices, although these changes have not produced material costs or loss of revenue for us. Future FTC enforcement actions against marketing companies could result in more material impacts to us. The FTC also has initiated a rulemaking regarding "Commercial Surveillance and Data Security," and although that rule is not expected to come into effect soon, it has resulted in increased regulatory attention and scrutiny regarding the collection and processing of personal information and online advertising, marketing and analytics services.
Our communications with consumers are also subject to certain laws and regulations, including the Controlling the Assault of Non-Solicited Pornography and Marketing ("CAN-SPAM") Act of 2003, the Telephone Consumer Protection Act of 1991 (the "TCPA"), and the Telemarketing Sales Rule and analogous state laws, that could expose us to significant damages awards, fines and other penalties that could materially impact our business. For example, the TCPA imposes various consumer consent requirements and other restrictions in connection with certain telemarketing activity and other communication with consumers by phone, fax or text message. Recently enacted state laws, for example in Connecticut and Maryland, create additional requirements and penalties for violations relating to telemarketing and SMS marketing. Numerous class-action suits under federal and state laws have been filed in recent years against companies who conduct telemarketing and/or SMS texting programs, with many resulting in multi-million-dollar settlements to the plaintiffs. Any future such litigation against us could be costly and time-consuming to defend. In particular, the TCPA and related state laws impose significant restrictions on the ability to make telephone calls or send text messages to mobile telephone numbers without the prior consent of the person being contacted. The CAN-SPAM Act and the Telemarketing Sales Rule and analogous state laws also impose various restrictions on marketing conducted using email, telephone, fax or text message. Additional laws, regulations, and standards covering marketing, advertising, and other activities conducted by telephone, email, mobile devices, and the internet may be or become applicable to our business, such as the Communications Act, the Federal Wiretap Act, the Electronic Communications Privacy Act, and similar state consumer protection and communication privacy laws, such as California's Invasion of Privacy Act. As laws and regulations, including FTC enforcement, rapidly evolve to govern the use of these communications and marketing platforms, the failure by us, our employees or third parties acting at our direction to abide by applicable laws and regulations could adversely impact our business, financial condition and results of operations or subject us to fines or other penalties.
New requirements relating to automated, browser-based, or one-stop opt-out mechanisms (OOMs) such as the Global Privacy Control, the forthcoming opt-out mechanism for data brokers established under the California Delete Act, or other OOMs that will be established in the future may result in significantly larger numbers of consumers opting out of having their data used for marketing purposes versus historical averages. This could result in Zeta having less access to consumer data, impacting performance of our services or resulting in loss of business.
Our operations abroad may also be subject to increased scrutiny or attention from data protection authorities. For example, in Europe, we are subject to the European Union General Data Protection Regulation (the "EU GDPR") and the United Kingdom's General Data Protection Regulation and the Data Protection Act 2018 (the "UK GDPR") (the EU GDPR and UK GDPR, together referred to as the "GDPR"), which impose strict requirements for processing the personal data of individuals within the EEA. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance. Since we are subject to the supervision of relevant data protection authorities under both the EU GDPR and the UK GDPR, we could be fined under each of these regimes independently, in respect of the same breach. Penalties for certain breaches are up to €20 million / £17.5 million or 4% of the annual global revenues of the noncompliant company, whichever is greater.
Among other requirements, the GDPR also regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the U.S.; in July 2020, the Court of Justice of the EU ("CJEU") limited how organizations could lawfully transfer personal data from the EU/European Economic Area ("EEA") to the U.S. by invalidating the Privacy Shield for purposes of international transfers and imposing further restrictions on the use of standard contractual clauses ("SCCs") by stating reliance on SCCs alone may not be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. European court and regulatory decisions subsequent to the CJEU decision have taken a restrictive approach to international data transfers. Further the European Commission published revised standard contractual clauses for data transfers from the EEA (mandatory for new transfers since September 27, 2021, and for existing transfers since December 27, 2022) and the UK Information Commissioner's Office published its own new data transfer standard contracts for data transfers from the UK (mandatory for new transfers since September 21, 2022 and for existing transfers by March 21, 2024). We expect the existing legal complexity and uncertainty regarding international data transfers to continue and in particular, we expect international transfers to the U.S. and other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As supervisory authorities issue further guidance on personal data export mechanisms, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. In addition, in February 2022, the Belgian data protection authority found that the Interactive Advertising Bureau's (IAB) "Transparency and Consent Framework" ("TCF"), the primary consent management platform used in Europe for online advertising compliance, violates the GDPR. While this decision is being appealed, a subsequent loss of the TCF could result in increased legal risk, or a need to discontinue online advertising in Europe, which could impact our revenues.
For transfers from the EEA to the UK the European Commission has adopted an adequacy decision in favor of the United Kingdom, enabling data transfers from EU member states to the United Kingdom without additional safeguards. However, the UK adequacy decision will automatically expire in June 2025 unless the European Commission re-assesses and renews or extends that decision.
We are also subject to evolving EU and UK privacy laws on cookies, tracking technologies and e-marketing. The GDPR also imposes conditions on obtaining valid consent for cookies, such as a prohibition on pre-checked consents and a requirement to ensure separate consents are sought for each type of cookie or similar technology. Recent European court and regulator decisions are driving increased attention to cookies and tracking technologies. In light of the complex and evolving nature of EU, EU Member State and UK privacy laws on cookies and tracking technologies, there can be no assurances that we will be successful in our efforts to comply with such laws and violations of such laws could result in regulatory investigations, fines, orders to cease / change our use of such technologies, as well as civil claims including class actions, and reputational damage. In July 2021, we received a notice from Norwegian authorities of an intent to impose a fine for our alleged failure to adhere to the GDPR with respect to the collection of personal data via cookies in their country. We have challenged this allegation on a number of grounds and currently await a response from the Norwegian DPA. We are hopeful that the Norwegian DPA will close this case without enforcement action as we have not received any correspondence since July 2022.
Increased scrutiny regarding the use of such technologies and the use of personal data for online advertising practices, together with adverse rulings on these issues, even if not directly against us, may have a direct impact on our ability to continue to collect and process personal data for the services that we provide and could adversely impact our business activities. Changes proposed by providers of major browsers to eliminate or restrict the usage of third-party cookies to track user behaviors, and to allow users to limit the collection of certain data generally or from specified websites, could impair our ability to collect user information,including personal data and usage information, that helps us provide more targeted advertising to our current and prospective consumers. The effectiveness of our platform relies in part on our ability to collect and use online data, so these changes could adversely affect our business.
In Canada, the Personal Information Protection and Electronic Documents Act ("PIPEDA"), and various provincial laws require that companies give detailed privacy notices to consumers, obtain consent to use personal information, with limited exceptions, allow individuals to access and correct their personal information, and report certain data breaches. Failure to comply with PIPEDA or other Canadian provincial privacy or data protection laws could result in significant fines and penalties or possible damage awards.
Our data-driven platform may also be subject to laws and evolving regulations regarding the use of artificial intelligence and machine learning, controlling for data bias, and antidiscrimination. For example, in addition to enforcing Section 5 of the FTC Act, the FTC enforces the Fair Credit Reporting Act, and the Equal Credit Opportunity Act. These laws prohibit unfair and deceptive practices, including use of biased algorithms in artificial intelligence. The European Commission also recently published its proposal for a regulation implementing harmonized rules on artificial intelligence and amending certain union legislative acts. The proposed regulation would impose additional restrictions and obligations on providers of artificial intelligence systems, including increasing transparency so consumers know they are interacting with an artificial intelligence system, requiring human oversight in artificial intelligence, and prohibiting certain practices of artificial intelligence that could lead to physical or psychological harm. If federal or state regulators were to determine that the type of data we collect, the process we use for collecting this data or how we use it unfairly discriminates against some groups of people, laws and regulations could be interpreted or implemented to prohibit or restrict our collection or use of this data. Additionally, existing and future laws, and evolving attitudes about privacy protection may impair our ability to collect, use, and maintain data points of sufficient type or quantity to develop and train our artificial intelligence algorithms.
Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Any failure or perceived failure by us or our employees, representatives, contractors, consultants, collaborators, or other third parties to comply with such requirements or adequately address privacy and security concerns, even if unfounded, could result in the imposition of significant civil and/or criminal penalties, damage in our reputation, private litigation, and restrictions on data processing.