Privacy and data rules

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

433 paragraphs · Retail-Auto Dealers & Gasoline Stations show all sectors

In the United States, California has enacted the California Consumer Privacy Act, as amended (“CCPA”) and numerous similar recently enacted laws create new data privacy rights for individuals. Other evolving legislation relating to privacy and cybersecurity at the federal, state, and local levels also may, or may be argued to, apply to us. Additionally, certain of our commercial partners, including payment card companies, have imposed data security standards or other obligations relating to privacy, data protection, or data security upon us, and others may do so in the future. We also may be, or may be argued to be, subject to industry standards or other actual or asserted obligations relating to privacy, data protection, and cybersecurity. We strive to comply with applicable laws, regulations, policies, and contractual and other legal obligations relating to privacy, data protection, and cybersecurity. These legal, contractual, and other actual and asserted obligations are, however, evolving rapidly, may be interpreted and applied in new ways and/or in manners that are inconsistent, and may conflict with other obligations or our practices.

Read in the 10-K filed Sep 29, 2026 ↗

Because the models, algorithms, and datasets these technologies rely on may be flawed, incomplete, or biased, their outputs may be inaccurate, unreliable, or otherwise harmful, including in unintended or discriminatory ways. Certain of our uses directly affect transaction outcomes for vehicle sellers and buyers, errors, defects, or malfunctions, or their misuse by our personnel, which could result in operational disruptions, flawed business decisions, degraded sale outcomes, disputes or litigation, and harm to our reputation and our relationships with insurance companies and other significant vehicle sellers. Our use of these technologies may also increase the risk that our confidential information or our customers' personal information is inadvertently disclosed, used to train third-party models, or otherwise made available to others, and intellectual property rights in the outputs may be uncertain or unenforceable, we may not own those outputs, and our use of these technologies and their training data may subject us to infringement or misappropriation claims. Any of the foregoing risks, individually or in the aggregate, could have a material adverse effect on our business, consolidated results of operations, and financial position.

Read in the 10-K filed Sep 29, 2026 ↗

We increasingly develop and deploy AI technology through third party generative AI platforms and internal software, in connection with our proprietary systems and customer experiences, including automated, self-service workflows, AI-enabled customer support tools, internal work efficiencies, and enhancement of our recruiting and hiring processes. These initiatives are complex, rapidly evolving, and inherently uncertain. There is no assurance that our AI capabilities will function as intended, deliver anticipated benefits, or scale cost-effectively. The performance, quality, and impact of AI models depend on numerous factors, including the availability and integrity of training data, model design, computational resources, integration with our operations and technology stack, and ongoing monitoring and governance. If our AI systems or those third party platforms we utilize underperform, produce inaccurate, incomplete, or biased outputs, hallucinate or fail under edge cases, degrade customer experiences, inadvertently disclose or misuse intellectual property, or otherwise fail to meet expectations, we could experience decreased conversion, operational disruptions, increased costs, reduced margins, customer dissatisfaction, negative publicity, or harm to our brand and competitive position. Increased use of AI may additionally result in cybersecurity, data privacy, and labor and employment risks.

Read in the 10-K filed Feb 18, 2026 ↗

The laws, rules, standards, and guidance relating to AI are developing rapidly and vary across jurisdictions. We may be subject to evolving requirements regarding transparency, fairness, explainability, safety, data usage and provenance, content integrity, consumer protection, and algorithmic accountability. If we use AI in ways that regulators view as unfair, deceptive, discriminatory, or otherwise noncompliant, we could face heightened scrutiny, investigations, enforcement actions, private litigation, or requirements to modify, suspend, or cease certain AI-enabled practices. To the extent AI touches areas implicating privacy, information security, intellectual property, credit and financing, or other regulated activities, we may incur additional compliance obligations and associated costs.

Read in the 10-K filed Feb 18, 2026 ↗

We also rely on third‑party service providers and vendors that process information on our behalf. We have limited ability to control their security and privacy practices, and contractual protections and due diligence may not prevent all incidents. A security incident at a third party could have similar adverse effects on us as an incident on our own systems. The use of AI tools and programs by new or existing vendors may also introduce unique vulnerabilities whose existence or exploitation could have a material adverse effect on our business or operations.

Read in the 10-K filed Feb 18, 2026 ↗