Privacy and data rules

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

301 paragraphs · Services-Computer Programming, Data Processing, Etc. show all sectors

Similarly, in February 2022, Google announced its Privacy Sandbox initiative for Android, a multi-year effort expected to restrict tracking activity and limit advertisers' ability to collect app and user data across Android devices. In January 2024, Google

Read in the 10-K filed Feb 27, 2025 ↗

•questions about the quality of our Apps, our data practices or concerns related to privacy and sharing or other processing of user data, safety, security, or other factors.

Read in the 10-K filed Feb 27, 2025 ↗

With regard to transfers to the United States of personal data from our employees and European users and other third parties, we historically relied upon the EU-U.S. and Swiss-U.S. Privacy Shield programs as well as standard contractual clauses approved by the EU Commission (the "SCCs"); however, the EU-U.S. Privacy Shield and the SCCs have been subject to legal challenge, and on July 16, 2020, the Court of Justice of the EU held in the Schrems II case that the EU-U.S. Privacy Shield was invalid and imposed obligations in connection with use of the SCCs. EU regulators also have issued guidance that we and other companies must consider and undertake when using the SCCs. On June 4, 2021, the European Commission adopted new SCCs to reflect GDPR requirements. The United Kingdom’s Information Commissioner’s Office also has issued new standard contractual clauses for which implementation is required. Further, the Austrian, French, Italian, and Danish data protection authorities have indicated that use of Google Analytics by European website operators involves the unlawful transfer of personal data to the United States. In March 2022, the EU and U.S. agreed in principle upon a new EU-U.S. Data Privacy Framework ("EU-U.S. DPF"). On July 10, 2023, the European Commission adopted an adequacy decision in relation to the EU-U.S. DPF, allowing it to be used to legitimize EU-U.S. personal data transfers for participating entities. The United Kingdom and U.S. also have established a UK Extension to the EU-U.S. DPF (the "UK Extension"), effective October 12, 2023, whereby entities participating in the EU-U.S. DPF may rely upon the UK Extension to legitimize United Kingdom-U.S. personal data transfers. Further, on July 17, 2023, the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”), which provides for a means of legitimizing personal data transfers from Switzerland to the U.S., entered into effect. We are self-certified under the EU-U.S. DPF, Swiss-U.S. DPF, and the UK Extension. The EU-U.S. DPF, has faced legal challenge, and it and the Swiss-U.S. DPF, and UK Extension may be subject to further legal challenges. The European Commission's adequacy decision regarding the EU-U.S. DPF provides that the EU-U.S. DPF will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations to its scope by the European Commission. The SCCs and other cross-border data transfer mechanisms may also be

Read in the 10-K filed Feb 27, 2025 ↗

the subject of additional legislative activity and regulatory guidance. We and many other companies may need to implement different or additional measures to establish or maintain legitimate means for the transfer and receipt of personal data from the EEA, Switzerland, the United Kingdom, or other jurisdictions to the United States, and we may, in addition to other impacts, experience additional costs associated with increased compliance burdens, and we and our clients face the potential for regulators to apply different standards to the transfer of personal data from various jurisdictions to the United States and to block, or require ad hoc verification of measures taken with respect to, certain data flows. We also may find it necessary to engage in contract negotiations with third parties that aid in processing data on our behalf to address cross-border data transfer matters. We may not be able to find alternative service providers, which could limit our ability to process personal data from impacted jurisdictions and increase our costs and/or impact our Advertising solutions Apps, or other offerings. We and our clients may face a risk of enforcement actions by data protection authorities relating to personal data transfers. Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel, and adversely affect our business, financial condition, and results of operations. Similar to the GDPR, in September 2020, Brazil enacted the Brazilian General Data Protection Law. China has enacted a new data privacy law known as PIPL, effective November 1, 2021, which adopts a stringent data transfer regime requiring, among other things, data subject consent for certain data transfers. Any of these developments may have an adverse effect on our business.

Read in the 10-K filed Feb 27, 2025 ↗

Moreover, the GDPR and other similar regulations require companies to give specific types of notice and in some cases seek consent from consumers and other data subjects before collecting or using their data for certain purposes, including some marketing activities. The European Commission has a draft regulation, known as the Regulation of Privacy and Electronic Communications ("ePrivacy Regulation"), which would replace the current ePrivacy Directive. Originally planned to be adopted and implemented at the same time as the GDPR, the ePrivacy Regulation is still being negotiated. On February 10, 2021, the Council of the EU agreed on its version of the draft ePrivacy Regulation. If adopted, ePrivacy Regulation could have broad impacts on the use of internet-based services and tracking technologies, such as cookies. Aspects of the ePrivacy Regulation remain for negotiation between the European Commission and the Council.

Read in the 10-K filed Feb 27, 2025 ↗

implementation of AI in our offerings and internal systems) could subject us to regulatory action and legal liability, including under specific legislation regulating AI, as well as new applications of existing data protection, cybersecurity, privacy, intellectual property, and other laws.

Read in the 10-K filed Feb 5, 2025 ↗

On March 25, 2022, the European Union and United States announced that they had reached an agreement in principle on a new EU-U.S. Data Privacy Framework (EU-U.S. DPF). On October 7, 2022, President Biden signed the Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities (E.O.), and on June 30, 2023, the European Union and the three additional countries making up the EEA were designated by the United States Attorney General as a “qualifying state” under Section 3(f) of the E.O. On July 10, 2023, the European Commission adopted an adequacy decision in relation to the United States. The adequacy decision concludes that the United States ensures an adequate level of protection for personal data transferred from the European Union to organizations in the United States that are included in the “Data Privacy Framework List,” maintained and made publicly available by the United States Department of Commerce pursuant to the EU-U.S. DPF. The implementation of the EU-U.S. DPF and the adequacy decision are important and welcome milestones, and we have implemented steps to comply with the above corrective orders following engagement with the IDPC. The EU-U.S. DPF replaces two prior adequacy frameworks which were invalidated by the CJEU. A further invalidation of the EU-U.S. DPF by the CJEU could create considerable uncertainty and lead to us being unable to offer a

Read in the 10-K filed Jan 30, 2025 ↗