Privacy and data rules

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

301 paragraphs · Finance Services show all sectors

These companies modify their terms of service or other policies, including fees charged to, or other restrictions on, and change how the personal information of its users is made available on their respective platforms or shared by users; or

Read in the 10-K filed Mar 31, 2025 ↗

As the owner of several Discord servers and reliance on social media for our own and our clients’ promotional campaigns, we may face claims or enforcement actions relating to information or content that is published or made available on social media platforms where our content or our users’ content is posted, or relating to our policies or the policies of Discord and other social media platforms on which our content or our users’ content is posted, notwithstanding our or the respective platforms’ best efforts to enforce such policies. In particular, the nature of our social media-based business exposes us to claims related to defamation, dissemination of misinformation or news hoaxes, discrimination, harassment, intellectual property rights, rights of publicity and privacy, personal injury torts, laws regulating hate speech or other types of content, online safety, consumer protection, and breach of contract, among others. This risk is enhanced in certain jurisdictions outside the United States where our protection from liability for third-party actions may be unclear or where we may be less protected under local laws than we are in the United States. For example, in April 2019, the European Union passed a directive (the European Copyright Directive) expanding online platform liability for copyright infringement and regulating certain uses of news content online, which the EU member states have since implemented into their national laws. In addition, the European Union revised the European Audiovisual Media Service Directive to apply to online video-sharing platforms, which member states are implementing. Additionally, Brazil has an intermediary liability framework limiting liability for third-party content, which has been challenged as unconstitutional and is under review by the Brazilian Supreme Court. In the United States, in 2023, the U.S. Supreme Court heard oral argument in a matter in which the scope of the protections available to online platforms under Section 230 of the Communications Decency Act (“Section 230”) was at issue, but it ultimately declined to address Section 230 in its decision. There also have been, and continue to be, various other litigation concerning, and state and federal legislative and executive efforts to remove or restrict, the scope of the protections under Section 230, as well as to impose new obligations on online platforms with respect to commerce listings, user access and content, counterfeit goods and copyright-infringing material, and our current protections from liability for third-party content in the United States could decrease or change. We could incur significant costs investigating and defending such claims and, if we are found liable, significant damages.

Read in the 10-K filed Mar 31, 2025 ↗

New and evolving regulations and compliance standards for cybersecurity, data protection, privacy, and internal IT controls are often created in response to the tide of cyberattacks and will increasingly impact organizations like our company. Existing regulatory standards require that organizations implement internal controls for user access to applications and data. In addition, data breaches are driving a new wave of regulation, such as the GDPR, with stricter enforcement and higher penalties. Regulatory and policy-driven obligations require expensive and time-consuming compliance measures. The fear of non-compliance, failed audits, and material findings has pushed organizations to spend more to ensure they are in compliance, often resulting in costly, one-off implementations to mitigate potential fines or reputational damage. The high costs associated with failing to meet regulatory requirements, combined with the risk of fallout from security breaches, may force us to spend additional time and money ensuring we will meet future regulatory requirements.

Read in the 10-K filed Mar 31, 2025 ↗

Failure to comply with data privacy and security laws and regulations could adversely affect our operating results and business.

Read in the 10-K filed Mar 31, 2025 ↗

In the ordinary course of our business, we might collect and store in our internal and external data centers, cloud services and networks sensitive data, including our proprietary business information and that of our customers, suppliers and business collaborators, as well as personal information of our customers and employees. The secure processing, maintenance and transmission of this information is critical to our operations and business strategy. The number and sophistication of attempted attacks and intrusions that companies have experienced from third parties has increased over the past few years. Despite our security measures, it is impossible for us to eliminate this risk.

Read in the 10-K filed Mar 31, 2025 ↗

U.S. federal data privacy laws include the CAN-SPAM Act, which, among other things, restricts data collection and use in connection with CAN-SPAM Act’s opt-out process requirements for senders of commercial emails; and COPPA, which regulates the collection of information by operators of websites and other electronic solutions that are directed to children under 13 years of age, although our website and app user terms of service and privacy policy expressly prohibit children under 13 from submitting information to or on our website or app. These laws and regulations promulgated under these laws restrict our collection, processing, storage, use and disclosure of personal information, may require us to notify individuals of our privacy practices and provide individuals with certain rights to prevent the use and disclosure of protected information, and mandate certain procedures with respect to safeguarding and proper description of stored information.

Read in the 10-K filed Mar 31, 2025 ↗

Moreover, certain laws and regulations of U.S. states and the EU impose similar or greater data protection requirements and may also subject us to scrutiny or attention from regulatory authorities. For example, the EU and California have passed comprehensive data privacy laws, the EU GDPR and the CCPA and regulations promulgated under the CCPA, respectively, which impose data protection obligations on enterprises, including limitations on data uses and constraints on certain uses of sensitive data. Of particular importance, the CCPA, which became effective on January 1, 2020, limits how we may collect and use personal information, including by requiring companies that process information relating to California residents to make disclosures to consumers about their data collection, use and sharing practices, provide consumers with rights to know and delete personal information and allow consumers to opt out of certain data sharing with third parties. The CCPA also creates an expanded definition of personal information, imposes special rules on the collection of consumer data from minors, and provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase the likelihood and cost of data breach litigation. The potential effects of this legislation are far-reaching and may require us to modify our data processing practices and policies and incur substantial costs and expenses in compliance and potential ligation efforts. Effective January 1, 2023, we also became subject to the CPRA in California, which expands upon the consumer data use restrictions, penalties and enforcement provisions under the CCPA.

Read in the 10-K filed Mar 31, 2025 ↗

In addition, similar consumer data privacy laws have been passed and either are in effect or will become effective within the next 12 months in a number of other states, including Virginia (effective January 1, 2023); Colorado (effective July 1, 2023); Connecticut (effective July 1, 2023); Utah (effective December 31, 2023); Texas (effective July 1, 2024); Oregon (effective July 1, 2024); Montana (effective October 1, 2024); Iowa (effective January 1, 2025); Delaware (effective January 1, 2025); Nebraska (effective January 1, 2025); New Hampshire (effective January 1, 2025); New Jersey (effective January 15, 2025); Minnesota (effective July 1, 2025); Tennessee (effective July 1, 2025); Maryland (effective October 1, 2025); Indiana (effective January 1, 2026); Kentucky (effective January 1, 2026); and Rhode Island (effective January 1, 2026). Further, there are several legislative proposals in the United States, at both the federal and state level, that could impose new privacy and security obligations. We cannot yet determine the impact that these laws and regulations may have on our business.

Read in the 10-K filed Mar 31, 2025 ↗

Outside of the U.S., data protection laws, including the GDPR, also might apply to some of our operations or business collaborators. Legal requirements in the European Union and United Kingdom relating to the collection, storage, processing and transfer of personal data/information continue to evolve. The GDPR imposes, among other things, data protection requirements that include strict obligations and restrictions on the ability to collect, analyze and transfer EU personal data/information, a requirement for prompt notice of data breaches to data subjects and supervisory authorities in certain circumstances, and possible substantial fines for any violations (including possible fines for certain violations of up to the greater of 20 million Euros or 4% of total company revenue). Other governmental authorities around the world have enacted or are considering similar types of legislative and regulatory proposals concerning data protection.

Read in the 10-K filed Mar 31, 2025 ↗

There is significant ongoing uncertainty with respect to potential legislation, regulation and government policy at the federal, state and local levels in the United States. Such uncertainty and any material changes in such legislation, regulation and government policy could significantly impact our business as well as the markets in which we compete. Specific legislative and regulatory proposals that might materially impact us include, but are not limited to, changes to liability rules for Internet platforms, data privacy regulations, import and export regulations, income tax regulations and the U.S. federal tax code and public company reporting requirements, immigration policies and enforcement, healthcare law, minimum wage laws, climate and energy policies, foreign trade and relations with foreign governments, pandemic response and increased antitrust scrutiny in the tech industry. To the extent changes in the political environment have a negative impact on us or on our customers, our markets, our business, results of operation and financial condition could be materially and adversely impacted in the future.

Read in the 10-K filed Mar 31, 2025 ↗

social engineering schemes, the introduction of computer viruses, ransomware or other malware, and the physical destruction of all or portions of our information technology and infrastructure could compromise the confidentiality, availability and integrity of the information (including consumers’ personal information) in and being processed by our systems. Although we have developed systems and processes designed to protect information we manage, prevent data loss and other security breaches and to permit us to effectively respond to known and potential risks, and we expect to continue to expend significant resources to bolster these systems and processes, there can be no assurance that our security measures will provide absolute security or have prevented or will prevent breaches, security incidents or attacks, in particular, as the frequency and sophistication of cyberattacks increases.

Read in the 10-K filed Mar 20, 2025 ↗

Cybersecurity, data privacy and intellectual property risks: Cybersecurity incidents may compromise systems; intellectual property disputes or alleged infringements could disrupt our business; accounting for digital assets and fair value measurements; potential impairment charges; auditor transitions; internal control considerations.

Read in the 10-K filed Nov 21, 2025 ↗

Currently, we do not have any insurance to cover our digital assets or mining equipment. The market for such insurance is in the early stages and we intend to purchase such insurance in the future. One of our digital asset custodians, Cactus Custody, is self-insured for $4 million plus annual additions. Any uninsured losses may have an adverse effect on our results of operations and/or financial condition. Fireblocks offers Fireblocks Institutional Digital Asset Program which is insured by leading insurance companies which are A.M. Bests rated “A” (excellent). There is an aggregate of $30,000,000 digital asset crime insurance for theft of digital assets, external breach of Fireblocks’ software or any malicious or intentional misbehavior or fraud by employees. Fireblocks has $12,500,000 of aggregate insurance for errors and omissions; professional liability insurance and cyber/privacy liability insurance.

Read in the 10-K filed Mar 14, 2025 ↗

Although the Ethereum network is one of the world’s most established digital asset networks, the Ethereum network and other cryptographic and algorithmic protocols governing the issuance of digital assets represent a new and rapidly evolving industry that is subject to a variety of factors that are difficult to evaluate. In the past, flaws in the source code for digital assets have been exposed and exploited, including flaws that disabled some functionality for users, exposed users’ personal information and/or resulted in the theft of users’ digital assets. The cryptography underlying ETH could prove to be flawed or ineffective, or developments in mathematics and/or technology, including advances in digital computing, algebraic geometry and quantum computing, could result in such cryptography becoming ineffective. In any of these circumstances, a malicious actor may be able to take the ETH held by the Company. Moreover, functionality of the Ethereum network may be negatively affected such that it is no longer attractive to users, thereby dampening demand for ETH. Even if digital assets other than ETH were affected by similar circumstances, any reduction in confidence in the source code or cryptography underlying digital assets generally could negatively affect the demand for digital assets and therefore adversely affect the business of the Company.

Read in the 10-K filed Mar 14, 2025 ↗

The Cybersecurity Review Measures (2021) (the “Measures”) were officially released to the public on December 28, 2021 and became effective on February 15, 2022. According to the Measures, to go public abroad, an online platform operator that possesses the personal information of more than 1 million users must seek cybersecurity review from the Office of Cybersecurity Review.

Read in the 10-K filed Mar 14, 2025 ↗

Education and Awareness: Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees and third-party contractors of the importance of handling and protecting data, including through privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. All employees and third-party contractors are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident.

Read in the 10-K filed Mar 20, 2025 ↗

Additionally, we may not be able to ensure the adequacy of our security measures or those employed by third parties, including our mining pool service providers, custodians or other counterparties. Our business operations and reputation depend on our ability to maintain the confidentiality, integrity and availability of data, digital assets and systems related to our business, personal information, proprietary technologies, processes and intellectual property (“Confidential Information”). We, our business and commercial partners rely extensively on third-party service providers’ information technology, computer systems, hardware, software, technology infrastructure and online sites and networks (collectively, “IT Systems”), including renewable energy infrastructure, cloud-based systems and on-premises servers (i.e., data centers), to record and process transactions and manage our operations, among other matters. We and our third-party service providers, partners, custodians and collaborators, may experience failures of, or disruptions to, IT systems and may be subject to attempted and successful security breaches or cybersecurity incidents. Efforts to limit the ability of malicious actors to disrupt the operations of the internet or undermine our own security efforts may be costly to implement and may not be successful. Such incidents, whether attributable to a vulnerability in our or third party IT Systems, or otherwise, could result in claims of liability against us, damage our reputation and materially harm our business. Remote and hybrid working arrangements at our company, and at many third-party providers, also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. Additionally, any integration of artificial intelligence in our or any service providers’ or partners’ operations, products or services is expected to pose new or unknown cybersecurity risks and challenges.

Read in the 10-K filed Feb 25, 2025 ↗

Any adverse impact to the availability, integrity or confidentiality of our IT Systems or Confidential Information, may adversely affect our business or our reputation and could have a material adverse effect on our financial condition. In addition, we face numerous and evolving cybersecurity risks, including from diverse threat actors, such as state-sponsored organizations, opportunist hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), malfeasance by insiders, human or technological error, or other unscrupulous third parties who develop and deploy viruses and other malicious software programs that could attack our IT Systems and Confidential Information. In the case of such a security breach, IT failure or other cybersecurity incident, we may suffer damage to our key systems and experience (i) interruption in our services, (ii) loss of ability to control or operate our equipment; (iii) misappropriation of personal data and (iv) loss of Confidential Information or other critical data that could interrupt our operations; each of which may adversely impact our reputation and brand by resulting in significant incident response, system restoration or remediation and future compliance costs and expose us to increased risks of governmental and regulatory investigations, enforcement actions, legal claims or proceedings (such as class actions), fines and penalties, and other liability, any of which could adversely affect our business. A data breach or security incident may also trigger mandatory data breach notification obligations under applicable privacy and data protection laws, which, if applicable, could lead to widespread negative publicity and a loss in confidence regarding the effectiveness of our data security measures. Furthermore, mitigating the risk of future attacks or IT Systems failures have resulted, and could in the future result, in additional operating and capital costs in systems technology, personnel, monitoring and other investments. In addition, insurers are currently reluctant to provide cybersecurity insurance for digital assets and cryptocurrency assets and we do not currently hold cybersecurity insurance. Therefore, in the event of any such actual or potential incidents, our costs and resources devoted and any impacted assets may not be partially or fully recoverable.

Read in the 10-K filed Feb 25, 2025 ↗

The inadvertent disclosure of or unauthorized access to IT systems, networks and data, including personal information, confidential information and proprietary information, may adversely affect our business or our reputation and could have a material adverse effect on our financial condition. In addition, undiscovered vulnerabilities in our equipment or services could expose us to hackers or other unscrupulous third parties who develop and deploy viruses and other malicious software programs that could attack our equipment services and business. In the case of such a security breach, security incident or other IT failure, we may suffer damage to our key systems and experience (i) interruption in our services, (ii) loss of ability to control or operate our equipment; (iii) misappropriation of personal data and (iv) loss of critical data that could interrupt our operations, which may adversely impact our reputation and brand and expose us to increased risks of governmental and regulatory investigation and enforcement actions, private litigation and other liability, any of which could adversely affect our business. A security breach may also trigger mandatory data breach notification obligations under applicable privacy and data protection laws, which, if applicable, could lead to widespread negative publicity and a loss in confidence regarding the effectiveness of our data security measures. Furthermore, mitigating the risk of future attacks or IT systems failures have resulted, and could in the future result, in additional operating and capital costs in systems technology, personnel, monitoring and other investments. In addition, insurers are currently reluctant to provide cybersecurity insurance for digital assets and cryptocurrency assets and we do not currently hold cybersecurity insurance. Therefore, in the event of any such actual or potential incidents, our costs and resources devoted and any impacted assets may not be partially or fully recoverable. Most of our sensitive and valuable data, including digital assets, are stored with third-party custodians and service providers. Therefore, we rely on the digital asset community to optimize and protect sensitive and valuable data and identify vulnerabilities. There can be no guarantee that these measures and the work of the digital asset developer community will identify all vulnerabilities, errors and defects, or will resolve all vulnerabilities, errors and defects, prior to a malicious actor being able to utilize them. Any actual or perceived data security breach at any of those third-party custodians or service providers could lead to theft or irretrievable loss of our fiat currencies or digital assets, which may or may not be covered by insurance maintained by us or our third-party custodians or service providers.

Read in the 10-K filed Feb 25, 2025 ↗

For example, in 2021, third parties independently obtained login credentials and personal information for at least 6,000 customers and used those credentials to exploit a vulnerability that previously existed in the account recovery process. We reimbursed impacted customers approximately $25.1 million.

Read in the 10-K filed Feb 13, 2025 ↗

Generative AI in our products and services may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies. For example, AI algorithms use machine learning and predictive analytics which may be insufficient or of poor quality and reflect inherent biases and could lead to flawed, biased, and inaccurate results. In addition, generative AI may create content that appears correct but is factually inaccurate or flawed, or contains copyrighted or other protected material, and if our customers or others use this flawed content to their detriment, we may be exposed to brand or reputational harm, competitive harm, and/or legal liability. For example, deficient or inaccurate recommendations, summaries, or analyses that generative AI features assist in producing could lead to customer rejection, or skepticism of our products, affect our reputation or brand, and negatively affect our financial results. Further, unauthorized use or misuse of generative AI by our employees or others may result in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability. Generative AI is also the subject of a quickly evolving legal and regulatory environment, and new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications related to our use of generative AI could cause us to divert resources towards compliance and adversely affect our business, reputation, or financial results. Our use of generative AI may also lead to novel and urgent cybersecurity risks, including the misuse of personal data, which may adversely affect our operations and reputation.

Read in the 10-K filed Mar 27, 2025 ↗

In addition, federal, state, and international government bodies and agencies have in the past adopted, and may in the future adopt, laws and regulations affecting the use of the internet as a commercial medium. Changes in these laws or regulations could adversely affect the demand for our products and services or require us to modify our products and services to comply with these changes. Laws, rules, and regulations governing advertising and e-commerce through internet communications and mobile carriers and their partners are dynamic, and the extent of future government regulation is uncertain. Federal and state regulations govern various aspects of our online business, including intellectual property ownership, infringement, and misappropriation, concerning trade secrets, the distribution of electronic communications, marketing and advertising, data privacy and security, search engines and internet tracking technologies. Future taxation on the use of the internet or e-commerce transactions could also be imposed. Existing or future regulation or taxation could hinder growth in or negatively impact the use of the internet generally, including the viability of internet e-commerce, which could reduce our revenue, increase our operating expenses, and expose us to significant liabilities.

Read in the 10-K filed Mar 27, 2025 ↗

Security incidents or real or perceived errors, failures or bugs in our systems and platform could impair our operations, compromise our confidential information or our users’ personal information, damage our reputation and brand, and harm our business and operating results.

Read in the 10-K filed Mar 27, 2025 ↗

Operating our business and products involves the collection, storage, use and transmission of large volumes of sensitive, proprietary and confidential information, including financial and personal information, pertaining to our current, prospective and past users, as well as our staff, contractors, and business partners. The security measures we take to protect this information may be breached as a result of computer malware, viruses, social engineering, ransomware attacks, account takeover attacks, hacking and cyberattacks, including by state-sponsored and other sophisticated organizations. Such incidents have become more prevalent in recent years. Our security measures could also be compromised by our personnel, theft, or errors, or be insufficient to prevent exploitation of security vulnerabilities in software or systems on which we rely. Such incidents may in the future result in unauthorized, unlawful or inappropriate use, destruction or disclosure of, access to, or inability to access the sensitive, proprietary, and confidential information that we handle. These incidents may remain undetected for extended periods.

Read in the 10-K filed Mar 27, 2025 ↗

Because there are many different cybercrime and hacking techniques and such techniques continue to evolve, we may be unable to anticipate attempted security breaches, react promptly or implement adequate preventative measures. While we have developed systems and processes designed to protect the integrity, confidentiality, and security of our and our users’ confidential and personal information under our control, we cannot assure you that any security measures that we or our third-party service providers have implemented will be effective against current or future security threats.

Read in the 10-K filed Mar 27, 2025 ↗

We collect, store, use and otherwise process personal information, including financial information and other sensitive data, which subjects us to governmental regulation and other legal obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could harm our business.

Read in the 10-K filed Mar 27, 2025 ↗

We collect, store, use and process personal information and other user data, including financial information, credit report information and other sensitive information for our Registered Users. We rely on this data provided to us by users and third parties to offer, improve and innovate our products. If we are unable to maintain and grow such data, we may be unable to provide borrowers with a platform experience that is relevant, efficient, and effective, which could adversely affect our business, financial condition and results of operations.

Read in the 10-K filed Mar 27, 2025 ↗

There are numerous federal, state, and local laws and regulations regarding data privacy and the storing, sharing, use, processing, disclosure and protection of personal information and other user data, the scope of which is changing and subject to differing interpretations. In addition, as we continue to expand internationally, we are subject to foreign data privacy and security laws and regulations. These data privacy laws and regulations are complex, continue to evolve, and on occasion may be inconsistent between jurisdictions leading to uncertainty in interpreting such laws. We are also subject to the terms of our privacy policies and privacy-related obligations to third parties, and, given the recent change in administration, we expect a heightened level of scrutiny on the financial data we handle. These laws, regulations, and other obligations may be interpreted and applied in a manner that is inconsistent from one regulatory body to another and may conflict with other rules or our practices.

Read in the 10-K filed Mar 27, 2025 ↗

Most of the jurisdictions in which we operate have established their data privacy and security legal frameworks. Failure to comply with these laws can result in regulatory fines or penalties. The California borrower Privacy Act (“CCPA”) created new data privacy rights for California-resident users that will be expanded when the CPRA, which was approved in November 2020, goes into effect. In addition, Virginia recently passed the borrower Data Protection Act, which will go into effect at the same time as CPRA and many other states are considering enacting privacy laws. These laws, as well as any associated regulations, may increase our operating costs and potential liability (particularly in the event of a data breach), delay or impede the development of new products, and have a material adverse effect on our business, including how we use information about individuals, our financial condition and the results of our operations or prospects.

Read in the 10-K filed Mar 27, 2025 ↗

Any failure or perceived failure by us to comply with our privacy policies, our privacy-related obligations to users or other third parties, or our privacy-related legal obligations, or any compromise of security that results in the unauthorized release or transfer of personally identifiable information or other user data, may result in governmental enforcement actions, litigation or negative publicity and could cause our users and lenders to lose trust in us, which would have a material and adverse effect on our business. We may also be subject to remedies that may harm our business, including fines, demands or orders that we modify or cease existing or planned business practices.

Read in the 10-K filed Mar 27, 2025 ↗

If the Company’s data and network infrastructure were to fail, or if the Company were to suffer an interruption or degradation of services or other infrastructure environments, it could lose important manufacturing and technical data, which could harm its business. The Company’s facilities, as well as the facilities of third parties that maintain or have access to the Company’s data or network infrastructure, are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, cyber security attacks, terrorist attacks, power losses, telecommunications failures and similar events. If the Company’s or any third-party provider’s systems or service abilities are hindered by any of the events discussed above, the Company’s ability to operate may be impaired and its business could be adversely affected. A decision to close facilities without adequate notice, or other unanticipated problems, could adversely impact the Company’s operations. The Company’s infrastructure also could be subject to break-ins, cyber-attacks, sabotage, intentional acts of vandalism and other misconduct, from a spectrum of actors ranging in sophistication from threats common to most industries to more advanced and persistent, highly organized adversaries. Any security breach, including personal data breaches, or incident, including cybersecurity incidents, that the Company experiences could result in unauthorized access to, misuse of or unauthorized acquisition of its internal sensitive corporate data, such as financial data, intellectual property, or data related to contracts with commercial or government customers or partners. Such unauthorized access, misuse, acquisition, or modification of sensitive data may result in data loss, corruption or alteration, interruptions in the Company’s operations or damage to the Company’s computer hardware or systems or those of its employees and customers. Moreover, negative publicity arising from these types of disruptions could damage the Company’s reputation.

Read in the 10-K filed Mar 27, 2025 ↗

Over the past several years, cyber-attacks have become more prevalent and much harder to detect and defend against. The Company’s network and storage applications may be vulnerable to cyber-attack, malicious intrusion, malfeasance, loss of data privacy or other significant disruption and may be subject to unauthorized access by hackers, employees, consultants or other service providers. In addition, hardware, software or applications the Company develops or procures from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise information security. Unauthorized parties may also attempt to gain access to the Company’s systems or facilities through fraud, trickery or other forms of deceiving the Company’s employees, contractors and temporary staff. As cyber threats continue to evolve, the Company may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any cybersecurity vulnerabilities. The Company does not currently have a cyber liability insurance policy and even if a policy is purchased, the Company cannot be certain that its coverage will be adequate for liabilities incurred or that insurance will continue to be available to it on economically reasonable terms, or at all.

Read in the 10-K filed Mar 27, 2025 ↗

Computer malware, viruses, ransomware, hacking, phishing attacks and similar disruptions could result in security and privacy breaches and interruptions and delays in services and operations, which could harm our business.

Read in the 10-K filed Mar 27, 2025 ↗

Aspects of our business may be subject to a variety of federal and state financial and other laws, including laws and state licensing requirements financial products and services, privacy and data security, investment advisory services, and other laws that are frequently evolving and developing. The scope and interpretation of such laws are often uncertain and may be conflicting or ambiguous. It is difficult to predict how existing laws, some of which were enacted before the widespread adoption of the internet and mobile devices, will be applied to our business and the new laws to which we may become subject. In addition, as our business grows into new markets or expands and we collect, use and share more user data internally and with financial services partners, we may become subject to additional laws and regulations.

Read in the 10-K filed Mar 27, 2025 ↗

we are unable to address user concerns regarding the content, privacy, and security of our digital platform;

Read in the 10-K filed Mar 27, 2025 ↗

Our business requires us to enter into a large number of agreements with third-party providers and distribute the Exodus Platform in many different jurisdictions. Our agreements contain a variety of terms, including service levels, data privacy and security obligations, indemnification, dispute resolution procedures and regulatory requirements. Agreement terms may not be standardized across our business and can be subject to differing interpretations and local law requirements, which could result in disputes with our users and other third parties from time to time. If our users or other third parties notify us of a breach of contract or otherwise dispute the terms of our agreements, the dispute resolution process could be expensive and time consuming and result in the diversion of resources that could otherwise be deployed to grow our business. Even if these disputes are resolved in our favor, we may be unable to recoup the expenses and other diverted resources committed to resolving the dispute and, if we receive negative publicity in connection with the dispute, our reputation and brand may be harmed. Furthermore, the ultimate resolution of such disputes may be adverse to our interests and as a result could negatively affect our results of operations and financial condition.

Read in the 10-K filed Mar 6, 2025 ↗

Moreover, while illegal activities are primarily facilitated through the use of fiat currencies, digital assets are relatively new and, in many jurisdictions, may be lightly regulated or largely unregulated. Many types of digital assets have characteristics, such as the speed with which digital currency transactions can be conducted, the ability to conduct transactions without the involvement of regulated intermediaries, the ability to engage in transactions across multiple jurisdictions, and the irreversible nature of certain digital asset transactions, and encryption technology that anonymizes these transactions, that make digital assets susceptible to use in illegal activity. U.S. federal and state and foreign regulatory authorities and law enforcement agencies, such as the Department of Justice (“DOJ”), SEC, Commodities Futures Trading Commission (“CFTC”), FTC, OFAC or the Internal Revenue Service (“IRS”), and various state securities and financial regulators have taken and continue to take legal action against persons and entities alleged to be engaged in fraudulent schemes or other illicit activity involving digital assets. We also support digital assets that incorporate privacy-enhancing features, and may from time to time support additional digital assets with similar functionalities. These privacy-enhancing digital assets obscure the identities of sender and receiver, and may prevent law enforcement officials from tracing the source of funds on the blockchain. Facilitating transactions in these digital assets may cause us to be at increased risk of liability arising out of anti-money laundering and economic sanctions laws and regulations.

Read in the 10-K filed Mar 6, 2025 ↗

For example, foreign countries and governmental bodies, including the European Union ("EU") and United Kingdom ("U.K.") and other jurisdictions in which we operate or conduct our business, have laws and regulations concerning the collection, use, retention, security and transfer of the personal data of individuals in those jurisdictions. We may become subject to GDPR and U.K. GDPR, which impose stringent privacy and data protection requirements, and could increase the risk of non-compliance and the costs of providing our products and services in a compliant manner. Additionally, the GDPR (covering the European Economic Area), U.K. GDPR and Swiss data protection regimes impose strict rules on the transfer of personal data out of the EU, U.K. or Switzerland to a “third country,” including to the United States. As an un-hosted self-custody wallet provider, we do not process the personal data of our customers and therefore, compliance with these regimes do not currently have a material impact on our business. However, any actual or perceived breach of the GDPR or U.K. GDPR in the future could further add to our compliance costs, limit how we process information, or lead to reputational damage, regulatory investigations or fines. For example, if regulators assert that we have failed to comply with the GDPR or U.K. GDPR, we may be subject to fines. We may also face civil claims, as well as associated costs, diversion of internal resources, and reputational harm.

Read in the 10-K filed Mar 6, 2025 ↗

Aspects of the GDPR, U.K. GDPR, California Consumer Privacy Act (“CCPA”), Swiss Secretariat for Economic Affairs (“SECO”) and other laws, regulations, industry standards and other obligations related to privacy, data protection and data security remain uncertain. As such, compliance may require us to incur additional costs, modify our data handling practices and restrict our business operations. It is also possible that these laws, regulations, industry standards and other obligations may be interpreted and applied in a manner that is, or is alleged to be, inconsistent with our policies and procedures, the Exodus Platform or our services. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to modify the Exodus Platform or services or make changes to our business activities and practices. We may be unable to make such changes and modifications in a commercially reasonable manner, or at all, and our ability to develop new offerings and features could be limited.

Read in the 10-K filed Mar 6, 2025 ↗

The health care laws that may affect us include: the federal fraud and abuse laws, including the federal Anti-Kickback Statute; false claims and civil monetary penalties laws, including the False Claims Act and Civil Monetary Penalties Law; federal data privacy and security laws, including HIPAA, as amended by HITECH; and the federal Physician Payments Sunshine Act which requires us to report to CMS annually any transfers of value made to physicians (defined broadly to include doctors, dentists, optometrists, podiatrists, chiropractors, and other advanced practice health care professionals), certain non-physician health care practitioners and teaching hospitals as well as ownership and investment interests held by physicians and their immediate family members. In addition, many states have similar laws and regulations that may differ from each other and federal law in significant ways, thus complicating compliance efforts. Moreover, several states require biopharmaceutical companies to comply with the biopharmaceutical industry’s voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government and may require manufacturers to report information related to payments and other transfers of value to physicians and other health care providers or marketing expenditures. Additionally, some state and local laws require the registration of biopharmaceutical sales representatives in the jurisdiction.

Read in the 10-K filed Apr 15, 2025 ↗

The market for our model and data is new, rapidly evolving and increasingly competitive. We are expanding our business by offering technology-driven access to consultation and treatment options for new conditions, including telehealth options, but it is uncertain whether our offerings will achieve and sustain high levels of demand and market adoption. Our future financial performance depends in part on growth in this market, our ability to market effectively and in a cost-efficient manner, and our ability to adapt to emerging demands of existing and potential customers and the evolving regulatory landscape. It is difficult to predict the future growth rate and size of our target market. Negative publicity concerning telehealth generally, our offerings, customer success with our platform, or our market as a whole could limit market acceptance of our business model and services. If our customers do not perceive the benefits of our offerings, or if our offerings do not drive customer use and enrollment, then our market and our customer base may not continue to develop, or they may develop more slowly than we expect. Negative publicity regarding customer confidentiality and privacy in the context of telehealth could limit market acceptance of our business model and services.

Read in the 10-K filed Mar 28, 2025 ↗

In the course of offering personalized health and wellness recommendations, we collect a substantial amount of personalized health information. Numerous state and federal laws and regulations govern the collection, dissemination, use, privacy, confidentiality, security, availability, integrity and other processing of protected health information (PHI), and other types of personal information. For example, HIPAA establishes a set of national privacy and security standards for the protection PHI by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract for services, as well as their covered subcontractors. When we act in the capacity of a business associate under HIPAA, we execute business associate agreements with our clients.

Read in the 10-K filed Mar 28, 2025 ↗

In addition, HIPAA mandates that the Secretary of HHS conduct periodic compliance audits of HIPAA covered entities and business associates for compliance with the HIPAA privacy and security rules.

Read in the 10-K filed Mar 28, 2025 ↗

HIPAA further requires that patients be notified of any unauthorized acquisition, access, use or disclosure of their unsecured PHI that compromises the privacy or security of such information, with certain exceptions related to unintentional or inadvertent use or disclosure by employees or authorized individuals. HIPAA requires such notifications to be made “without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.” If a breach affects 500 patients or more, it must be reported to HHS without unreasonable delay, and HHS will post the name of the breaching entity on its public web site. Breaches affecting 500 patients or more in the same state or jurisdiction must also be reported to the local media. If a breach involves fewer than 500 people, the covered entity must record it in a log and notify HHS at least annually.

Read in the 10-K filed Mar 28, 2025 ↗

In addition to HIPAA, numerous other federal, state, and foreign laws and regulations protect the confidentiality, privacy, availability, integrity and security of health-related and other personal information. These laws and regulations in many cases are more restrictive than and may not be pre-empted by HIPAA and its implementing rules. These laws and regulations are often uncertain, contradictory, and subject to changed or differing interpretations, and we expect new laws, rules and regulations regarding privacy, data protection, and to be proposed and enacted in the future. Further, many state attorneys general are interpreting existing federal and state consumer protection laws to impose evolving standards for the online collection, use, dissemination and security of health-related and other personal information. Courts may also adopt the standards for fair information practices promulgated by the FTC, which concern consumer notice, choice, security and access. Consumer protection laws require us to publish statements that describe how we handle personal information and choices individuals may have about the way we handle their personal information. If such information that we publish is considered untrue, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Furthermore, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the FTC Act.

Read in the 10-K filed Mar 28, 2025 ↗

The proper functioning of our own information technology (IT) infrastructure is critical to the efficient operation and management of our business. We may not have the necessary financial resources to update and maintain our IT infrastructure, and any failure or interruption of our IT system could adversely impact our operations. In addition, our IT is vulnerable to cyberattacks, computer viruses, worms and other malicious software programs, physical and electronic break-ins, sabotage and similar disruptions from unauthorized tampering with our computer systems. We believe that we have adopted appropriate measures to mitigate potential risks to our technology infrastructure and our operations from these IT-related and other potential disruptions. However, given the unpredictability of the timing, nature and scope of any such IT failures or disruptions, we could potentially be subject to downtimes, transactional errors, processing inefficiencies, operational delays, other detrimental impacts on our operations or ability to provide products to our customers, the compromising of confidential or personal information, destruction or corruption of data, security breaches, other manipulation or improper use of our systems and networks, financial losses from remedial actions, loss of business or potential liability, and/or damage to our reputation, any of which could have a material adverse effect on our cash flows, competitive position, financial condition or results of operations.

Read in the 10-K filed Mar 28, 2025 ↗

SharpLink’s collection, storage and use of personal data are subject to applicable data protection and privacy laws, and any failure to comply with such laws may harm our reputation and business or expose SharpLink to fines and other enforcement action.

Read in the 10-K filed Mar 14, 2025 ↗

In the ordinary course of business, SharpLink collects, stores, uses and transmits certain types of information that are subject to different laws and regulations. In particular, data security and data protection laws and regulations relating to personal and consumer information that we are, or may become subject to, often vary significantly by jurisdiction and are evolving significantly as legislators and regulators continue to grapple with policy considerations surrounding the collection and use of data. Compliance with such data protection and privacy laws will require significant time and expense, particularly as we continue to expand our businesses across multiple jurisdictions.

Read in the 10-K filed Mar 14, 2025 ↗

For example, California has enacted the California Consumer Privacy Act, or CCPA, which became effective on January 1, 2020. The CCPA requires new disclosures to California consumers, imposes new rules for collecting or using information, requires companies to comply with data subject access and deletion requests, and affords California consumers new abilities to opt out of certain disclosures of personal information. It remains unclear what, if any, regulations will be implemented pursuant to the law or how it will be interpreted. The Stop Hacks and Improve Electronic Data Security Act, otherwise known as the SHIELD Act, is a New York State bill, the data protection portions of which became effective on March 23, 2020. The SHIELD Act requires companies to adopt reasonable safeguards to protect the security, confidentiality, and integrity of private information. A company should implement a data security program containing specific measures, including risk assessments, employee training, vendor contracts, and timely data disposal. The effects of the CCPA and the SHIELD Act potentially are significant and may require us and our clients to modify data collection or processing practices and policies and to incur substantial costs in an effort to comply.

Read in the 10-K filed Mar 14, 2025 ↗

In addition, the new EU-wide General Data Protection Regulation, or GDPR, became applicable on May 25, 2018, replacing the data protection laws of each EU member state. The GDPR implemented more stringent operational requirements for processors and controllers of personal data, including, for example, expanded disclosures about what and how personal information is to be used, limitations on retention of information, increased requirements to erase an individual’s information upon request, mandatory data breach notification requirements and higher standards for data controllers to demonstrate that they have obtained valid consent from individuals to process their personal data (or reliance on another appropriate legal basis) for certain data processing activities. It also significantly increased penalties for noncompliance, including where the Company may act as a data processor.

Read in the 10-K filed Mar 14, 2025 ↗

Although we continue to review and improve our policies and procedures with respect to data protection and privacy to ensure compliance with applicable laws, rules and regulations, if our privacy or data security measures fail to comply with applicable current or future laws and regulations, we may be subject to fines, litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data or our marketing practices, or other liabilities, such as compensation claims by individuals affected by a personal data breach, as well as negative publicity and a potential loss of business. Compliance with data protection and privacy laws and regulations will become more complex, time intensive and costly as we grow, particularly when we begin to rely on the movement of data across national boundaries.

Read in the 10-K filed Mar 14, 2025 ↗

There is no assurance that the time and resources expended on pursuing a particular acquisition or strategic investment opportunity will result in a completed transaction, or that any completed transaction will ultimately be successful. In addition, the assumptions we use to evaluate investment and acquisition opportunities may not prove to be accurate, and intended benefits may not be realized. Our due diligence investigations may fail to identify all of the issues, liabilities or other challenges associated with an acquired business, which could result in increased risk of unanticipated or unknown issues or liabilities, including with respect to privacy, competition and other regulatory matters, and our mitigation strategies for such risks that are identified may not be effective. Further, we may be unable to identify suitable acquisition or strategic investment opportunities, or may be unable to obtain any required financing or regulatory approvals, and therefore may be unable to complete such acquisitions or strategic investments on favorable terms, if at all. We may decide to pursue acquisitions with which our investors may not agree, and we cannot assure you that any acquisition or investment will be successful or otherwise provide a favorable return on investment.

Read in the 10-K filed Mar 14, 2025 ↗

Any compromise or breach of our security measures, or those of our third-party service providers, could violate applicable privacy, data protection, data security, network and information systems security and other laws and cause significant legal and financial exposure, adverse publicity and a loss of confidence in our security measures, which could have a material adverse effect on our business, financial condition, results of operations and prospects. We continue to devote significant resources to protect against security breaches or we may need to in the future to address problems caused by breaches, including notifying affected users and responding to any resulting litigation, which in turn, diverts resources from the growth and expansion of our business.

Read in the 10-K filed Mar 14, 2025 ↗