Privacy and data rules

social engineering schemes, the introduction of computer viruses, ransomware or other malware, and the physical destruction of all or portions of our information technology and infrastructure could compromise the confidentiality, availability and integrity of the information (including consumers’ personal information) in and being processed by our systems. Although we have developed systems and processes designed to protect information we manage, prevent data loss and other security breaches and to permit us to effectively respond to known and potential risks, and we expect to continue to expend significant resources to bolster these systems and processes, there can be no assurance that our security measures will provide absolute security or have prevented or will prevent breaches, security incidents or attacks, in particular, as the frequency and sophistication of cyberattacks increases.

Read in the 10-K filed Mar 20, 2025 ↗

business. Additionally, our consumers' personal data has in the past and could in the future be affected by inadvertent disclosure to, or security breaches at, third parties upon which we rely. For example, we are currently assessing an inadvertent personal customer data disclosure to a limited number of marketing partners that was recently discovered by Booking.com. We have contracts that include confidentiality provisions with such partners and at this time do not believe the information was exposed beyond such partners, but are continuing to assess this matter.

Read in the 10-K filed Feb 20, 2025 ↗

•additional complexity to comply with regulations in multiple jurisdictions, as well as overlapping or inconsistent legal regimes, in particular with respect to tax, labor, consumer protection, AI, digital content, advertising, promotions, privacy, sustainability, and competition laws;

Read in the 10-K filed Feb 20, 2025 ↗

protection, storage and privacy requirements, including new and greater monetary fines or penalties for privacy violations, and jurisdictions where we operate have passed, or continue to propose, data privacy legislation and or regulations. Failure to comply with these laws could result in significant penalties, including potential exclusion from federal healthcare programs, and reputational harm and could have a material adverse effect on our business and results of operations.

Read in the 10-K filed Feb 12, 2025 ↗

Currently, we do not have any insurance to cover our digital assets or mining equipment. The market for such insurance is in the early stages and we intend to purchase such insurance in the future. One of our digital asset custodians, Cactus Custody, is self-insured for $4 million plus annual additions. Any uninsured losses may have an adverse effect on our results of operations and/or financial condition. Fireblocks offers Fireblocks Institutional Digital Asset Program which is insured by leading insurance companies which are A.M. Bests rated “A” (excellent). There is an aggregate of $30,000,000 digital asset crime insurance for theft of digital assets, external breach of Fireblocks’ software or any malicious or intentional misbehavior or fraud by employees. Fireblocks has $12,500,000 of aggregate insurance for errors and omissions; professional liability insurance and cyber/privacy liability insurance.

Read in the 10-K filed Mar 14, 2025 ↗

Although the Ethereum network is one of the world’s most established digital asset networks, the Ethereum network and other cryptographic and algorithmic protocols governing the issuance of digital assets represent a new and rapidly evolving industry that is subject to a variety of factors that are difficult to evaluate. In the past, flaws in the source code for digital assets have been exposed and exploited, including flaws that disabled some functionality for users, exposed users’ personal information and/or resulted in the theft of users’ digital assets. The cryptography underlying ETH could prove to be flawed or ineffective, or developments in mathematics and/or technology, including advances in digital computing, algebraic geometry and quantum computing, could result in such cryptography becoming ineffective. In any of these circumstances, a malicious actor may be able to take the ETH held by the Company. Moreover, functionality of the Ethereum network may be negatively affected such that it is no longer attractive to users, thereby dampening demand for ETH. Even if digital assets other than ETH were affected by similar circumstances, any reduction in confidence in the source code or cryptography underlying digital assets generally could negatively affect the demand for digital assets and therefore adversely affect the business of the Company.

Read in the 10-K filed Mar 14, 2025 ↗

The Cybersecurity Review Measures (2021) (the “Measures”) were officially released to the public on December 28, 2021 and became effective on February 15, 2022. According to the Measures, to go public abroad, an online platform operator that possesses the personal information of more than 1 million users must seek cybersecurity review from the Office of Cybersecurity Review.

Read in the 10-K filed Mar 14, 2025 ↗

Education and Awareness: Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees and third-party contractors of the importance of handling and protecting data, including through privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. All employees and third-party contractors are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident.

Read in the 10-K filed Mar 20, 2025 ↗

vendors and governance practices as it pertains to the safeguarding of customer records. Furthermore, as new data protection and privacy-related

Read in the 10-K filed Feb 28, 2025 ↗

A significant actual or potential theft, loss, corruption, exposure, fraudulent use or misuse of client, employee or other personal information or proprietary business data, whether by third parties or as a result of employee malfeasance or otherwise,

Read in the 10-K filed Feb 14, 2025 ↗

Numerous local, municipal, state, federal and international law and regulations address privacy and security including the California Online Privacy Protection Act, the Personal information Protection and Electronic Documents Act, the Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act, the Telephone Consumer Protection Act of 1991, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Section 5© of the Federal Trade Commission Act, and, the California Consumer Privacy Act (“CCPA”). These privacy and security laws and regulations change frequently, and new legislation continues to be introduced, with over a dozen U.S. states having adopted comprehensive privacy laws. For example, the CCPA requires new disclosures to California consumers, gives California consumers new rights with respect to their data, and permits California consumers to opt-out of certain sales of personal information. The CCPA provides for fines of up to $7,500 per violation. Our website ecommerce and customer relations businesses that store, process or transmit payment cardholder data are subject to be Payment Card Industry (PCI) compliance requirements as mandated by the credit card companies (Visa, Mastercard, and American Express) and the Payment Card Institute Data Security Standard (PCI-DSS).

Read in the 10-K filed Feb 13, 2025 ↗

Most of our activities involve the receipt, use, storage or transmission of a substantial amount of individuals' PII, including PHI. We also use aggregated and/or anonymized data for research and analysis purposes and, in some cases, provide access to such anonymized data, or analytics created from such data, to pharmaceutical manufacturers and third-party data aggregators and analysts. We may also use such information to create analytic models designed to predict, and potentially improve, outcomes and patient care. The collection, dissemination, receipt, maintenance, protection, use, transmission, disclosure, privacy, confidentiality, security, availability, integrity, creation, processing and disposal of PII are regulated at the federal, state, international and industry levels, and requirements are imposed on us by contracts with clients. In some cases, such laws, rules, regulations and contractual requirements also apply to our vendors and require us to obtain written assurances of their compliance with such requirements. We are also subject to various other consumer protection laws that regulate our communications with customers, such as the FTC Act and the Telephone Consumer Protection Act. Certain of our businesses are also subject to the Payment Card Industry Data Security Standard ("PCI DSS"), which is designed to protect credit card account data as mandated by payment card industry entities. International laws, rules and regulations governing the use and disclosure of such information, such as the GDPR, can be more stringent than similar laws in the United States,

Read in the 10-K filed Feb 27, 2025 ↗

and they vary across jurisdictions. In addition, more jurisdictions are regulating the transfer of data across borders, and domestic privacy and data protection laws are generally becoming more onerous.

Read in the 10-K filed Feb 27, 2025 ↗

We utilize a sourcing strategy that emphasizes global procurement of materials, and that has direct or indirect dependencies upon a number of vendors with operations in the Asia-Pacific region. Our international operations are subject to complex foreign and U.S. laws and regulations, including trade regulations, anti-bribery and corruption laws, antitrust or competition laws, and data privacy laws, such as the GDPR, among others. In particular, recent years have seen a substantial increase in anti-bribery law enforcement activity by U.S. regulators, and we currently operate and seek to operate in many parts of the world that are recognized or perceived as having greater potential for corruption. Violations of any of these laws and regulations could result in fines and penalties, criminal sanctions against us or our employees, prohibitions on the conduct of our business and on our ability to offer our products and services in certain geographies, and significant harm to our business reputation. Our policies and procedures to promote compliance with these laws and regulations and, to mitigate these risks, may not protect us from all acts committed by our employees or third-party vendors, including contractors, agents and services partners or from the misinterpretation or changing application of such laws. Additionally, the costs of complying with these laws (including the costs of investigations, auditing and monitoring) could adversely affect our current or future business.

Read in the 10-K filed Dec 20, 2024 ↗

In the ordinary course of our business, our network environment and assets, and the networks and assets of our third-party business partners, including our supply chain and other vendors, maintain certain information that is confidential, regulated, proprietary or otherwise sensitive in nature to our business. This information may include intellectual property and product information, personal data, financial information and other confidential business information relating to us and our employees, customers, suppliers and other business partners. The frequency, sophistication and unpredictability of cybersecurity events globally have increased, and can be more acute during times of geopolitical tension or instability between countries. In addition, companies in the technology industry, and in particular, manufacturers of networking and communications products, have been increasingly subjected to a wide variety of data security incidents, including cyber-attacks, attacks against products, and other attempts to gain unauthorized access to network assets, infrastructure or sensitive information. Our network systems, devices, storage and other business applications, and those that we rely on, and that are maintained by our third-party providers, have been in the past, and may be in the future, subjected to security incidents including attack, exploitation, intrusion, disruption and other malfeasance or attempts to gain unauthorized access or conduct other unauthorized activities. Further, our network systems, devices, storage and other business applications may be targeted for data security incidents as a vicarious method to target our customers. Such data security incidents may be caused by malice or negligence from either third-party or internal actors. These threats arise from actions by nation states, independent hackers, hacktivist groups, organized cybercrime entities, and other third parties, as well as from malicious actors from within or supporting our organization. Further, evolving technologies, including AI, pose new threats. In some cases, it is difficult to anticipate, detect or identify indicators of such incidents and assess the damage caused thereby. If an actual or perceived data security incident affects our network or any of our third-party providers’ networks, we could incur significant costs, our technology and operations could be impacted, our customers and other stakeholders and/or their network environments could be impacted, our reputation could be harmed, and we may become involved in litigation, including with respect to allegations of breach of contract. We may also be subject to increased regulatory oversight, including governmental investigations, enforcement actions, and regulatory fines. We could also experience delays in reporting our financial results, and we may lose revenue and profits as a result of our inability to timely produce, distribute, invoice, and collect payments for our products and services. Additionally, a data security incident may result in significant remediation expenses and increased cybersecurity protection and insurance costs.

Read in the 10-K filed Dec 20, 2024 ↗

operations or our network security to date, future data security incidents could compromise material confidential or otherwise protected information, seize, destroy or corrupt data, impact our customers’ data or systems through attacks on our products in our customers’ environments, or otherwise disrupt our operations or impact our customers or other stakeholders. We and our network environment may also be subject in the future to ransomware attacks, nation-state cyber attacks or other types of cyber attacks. A failure to promptly disclose such material incidents as required by law may result in additional financial or regulatory consequences. We have incurred, and will continue to incur, expenses to comply with cybersecurity, privacy, and data protection standards and protocols imposed by law, regulation, industry standards and contractual obligations. Increased regulation of data collection, use and retention practices, and product security regulations, including self-regulation and industry standards, changes in existing laws and regulations, enactment of new laws and regulations, increased enforcement activity, and changes in interpretation of laws, could increase our cost of compliance and operation. And while we may be entitled to damages if our third-party providers fail to satisfy their security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. While we have purchased cybersecurity insurance, there are no assurances that the coverage would be adequate in relation to any incurred losses or not subject to any exclusions. Moreover, as cyber-attacks increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as adequate for our operations.

Read in the 10-K filed Dec 20, 2024 ↗

Additionally, we may not be able to ensure the adequacy of our security measures or those employed by third parties, including our mining pool service providers, custodians or other counterparties. Our business operations and reputation depend on our ability to maintain the confidentiality, integrity and availability of data, digital assets and systems related to our business, personal information, proprietary technologies, processes and intellectual property (“Confidential Information”). We, our business and commercial partners rely extensively on third-party service providers’ information technology, computer systems, hardware, software, technology infrastructure and online sites and networks (collectively, “IT Systems”), including renewable energy infrastructure, cloud-based systems and on-premises servers (i.e., data centers), to record and process transactions and manage our operations, among other matters. We and our third-party service providers, partners, custodians and collaborators, may experience failures of, or disruptions to, IT systems and may be subject to attempted and successful security breaches or cybersecurity incidents. Efforts to limit the ability of malicious actors to disrupt the operations of the internet or undermine our own security efforts may be costly to implement and may not be successful. Such incidents, whether attributable to a vulnerability in our or third party IT Systems, or otherwise, could result in claims of liability against us, damage our reputation and materially harm our business. Remote and hybrid working arrangements at our company, and at many third-party providers, also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. Additionally, any integration of artificial intelligence in our or any service providers’ or partners’ operations, products or services is expected to pose new or unknown cybersecurity risks and challenges.

Read in the 10-K filed Feb 25, 2025 ↗

Any adverse impact to the availability, integrity or confidentiality of our IT Systems or Confidential Information, may adversely affect our business or our reputation and could have a material adverse effect on our financial condition. In addition, we face numerous and evolving cybersecurity risks, including from diverse threat actors, such as state-sponsored organizations, opportunist hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), malfeasance by insiders, human or technological error, or other unscrupulous third parties who develop and deploy viruses and other malicious software programs that could attack our IT Systems and Confidential Information. In the case of such a security breach, IT failure or other cybersecurity incident, we may suffer damage to our key systems and experience (i) interruption in our services, (ii) loss of ability to control or operate our equipment; (iii) misappropriation of personal data and (iv) loss of Confidential Information or other critical data that could interrupt our operations; each of which may adversely impact our reputation and brand by resulting in significant incident response, system restoration or remediation and future compliance costs and expose us to increased risks of governmental and regulatory investigations, enforcement actions, legal claims or proceedings (such as class actions), fines and penalties, and other liability, any of which could adversely affect our business. A data breach or security incident may also trigger mandatory data breach notification obligations under applicable privacy and data protection laws, which, if applicable, could lead to widespread negative publicity and a loss in confidence regarding the effectiveness of our data security measures. Furthermore, mitigating the risk of future attacks or IT Systems failures have resulted, and could in the future result, in additional operating and capital costs in systems technology, personnel, monitoring and other investments. In addition, insurers are currently reluctant to provide cybersecurity insurance for digital assets and cryptocurrency assets and we do not currently hold cybersecurity insurance. Therefore, in the event of any such actual or potential incidents, our costs and resources devoted and any impacted assets may not be partially or fully recoverable.

Read in the 10-K filed Feb 25, 2025 ↗

The inadvertent disclosure of or unauthorized access to IT systems, networks and data, including personal information, confidential information and proprietary information, may adversely affect our business or our reputation and could have a material adverse effect on our financial condition. In addition, undiscovered vulnerabilities in our equipment or services could expose us to hackers or other unscrupulous third parties who develop and deploy viruses and other malicious software programs that could attack our equipment services and business. In the case of such a security breach, security incident or other IT failure, we may suffer damage to our key systems and experience (i) interruption in our services, (ii) loss of ability to control or operate our equipment; (iii) misappropriation of personal data and (iv) loss of critical data that could interrupt our operations, which may adversely impact our reputation and brand and expose us to increased risks of governmental and regulatory investigation and enforcement actions, private litigation and other liability, any of which could adversely affect our business. A security breach may also trigger mandatory data breach notification obligations under applicable privacy and data protection laws, which, if applicable, could lead to widespread negative publicity and a loss in confidence regarding the effectiveness of our data security measures. Furthermore, mitigating the risk of future attacks or IT systems failures have resulted, and could in the future result, in additional operating and capital costs in systems technology, personnel, monitoring and other investments. In addition, insurers are currently reluctant to provide cybersecurity insurance for digital assets and cryptocurrency assets and we do not currently hold cybersecurity insurance. Therefore, in the event of any such actual or potential incidents, our costs and resources devoted and any impacted assets may not be partially or fully recoverable. Most of our sensitive and valuable data, including digital assets, are stored with third-party custodians and service providers. Therefore, we rely on the digital asset community to optimize and protect sensitive and valuable data and identify vulnerabilities. There can be no guarantee that these measures and the work of the digital asset developer community will identify all vulnerabilities, errors and defects, or will resolve all vulnerabilities, errors and defects, prior to a malicious actor being able to utilize them. Any actual or perceived data security breach at any of those third-party custodians or service providers could lead to theft or irretrievable loss of our fiat currencies or digital assets, which may or may not be covered by insurance maintained by us or our third-party custodians or service providers.

Read in the 10-K filed Feb 25, 2025 ↗

For example, Europe’s General Data Protection Regulation (“GDPR”) and the U.K. General Data Protection Regulation (which implements the GDPR into U.K. law), impose stringent data protection requirements and provide for significant penalties for noncompliance. Additionally, the California Consumer Privacy Act (“CCPA”) requires, among other things, covered companies to provide specified disclosures to California consumers and allows them to exercise certain rights in connection with their personal information, such as the right to opt-out of certain sales of personal information and to request deletion of personal information (subject to certain exceptions). The CCPA also provides for civil penalties for violations as well as a private right of action for data breaches that may increase data breach litigation. Further, the California Privacy Rights Act, which became effective in January 2023, significantly modified the CCPA to include additional compliance obligations. Since the CCPA was first passed, 19 other states have enacted similar data privacy legislation, eight of which are in effect as of the end of 2024. In addition, a number of other states have passed or are considering additional privacy laws, including laws on health data and biometric data that are in effect, or are expected to take effect in the near future. These state privacy laws will require us to incur additional costs and expenses in our efforts to comply.

Read in the 10-K filed Feb 5, 2025 ↗

While we continuously update our policies, programs, processes and practices, many of our data management, modeling, AI, aggregation and implementation processes are manual and may be subject to human error, data limitations, process delays or system failure. Failure to manage data effectively and to aggregate data in an accurate and timely manner may limit our ability to manage current and emerging risk, to produce accurate financial, regulatory and operational reporting as well as to manage changing business needs. If our Framework is ineffective, we could suffer unexpected losses which could materially adversely affect our results of operation or financial condition. Also, any information we provide to the public or to our regulators based on incorrectly designed or implemented models or AI could be inaccurate or misleading. Some of the decisions that our regulators make could be affected adversely due to the perception that the quality of the data, models and AI used to generate the relevant information is insufficient. In addition, regulation of AI is rapidly evolving worldwide as legislators and regulators are increasingly focused on these powerful emerging technologies. The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, privacy, data protection and data security, consumer protection, competition, and equal opportunity laws, and are expected to be subject to increased regulation and new laws or new applications of existing laws and regulations. AI is the subject of ongoing review by various U.S. governmental and regulatory agencies, and various U.S. states and other foreign jurisdictions are applying, or are considering applying, their platform moderation, privacy, data protection and data security laws and regulations to AI or are considering general legal frameworks for AI. We may not be able to anticipate how to respond to these rapidly evolving frameworks, and we may need to expend resources to adjust our offerings in certain jurisdictions if the legal frameworks are inconsistent across jurisdictions. Furthermore, because AI technology itself is highly complex and rapidly developing, it is not possible to predict all of the legal, operational, competitive or technological risks that may arise relating to the use of AI.

Read in the 10-K filed Feb 20, 2025 ↗

Further, we make public statements about our use, collection, disclosure and other processing of personal information through our privacy policies, information provided on our website and press statements. Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. The publication of our

Read in the 10-K filed Feb 20, 2025 ↗

For example, in 2021, third parties independently obtained login credentials and personal information for at least 6,000 customers and used those credentials to exploit a vulnerability that previously existed in the account recovery process. We reimbursed impacted customers approximately $25.1 million.

Read in the 10-K filed Feb 13, 2025 ↗

•regional data privacy laws and other regulatory requirements that apply to outsourced service providers and to the transmission of our customers’ data across international borders;

Read in the 10-K filed Mar 5, 2025 ↗

We are increasingly building AI into many of our offerings, including generative and agentic AI. As with many innovations, AI offerings, such as Agentforce, and our Salesforce Platform present additional risks and challenges that could affect their adoption and therefore our business. For example, the development of our AI offerings and the Salesforce Platform, which provides information regarding our customers’ customers, present emerging ethical issues. If we enable or offer solutions that draw controversy due to their perceived or actual impact on human rights, privacy, employment, or in other social contexts, we may experience new or enhanced governmental or regulatory scrutiny, brand or reputational harm, competitive harm or legal liability, especially as geopolitical turmoil creates increasingly volatile political and market conditions. Inadequate or ineffective AI development, deployment, content labeling or governance by us or others that result in controversy could also impair the acceptance of AI solutions or result in unintended performance of the services. This in turn could undermine confidence in the decisions, predictions, analysis or other content that our AI applications produce, subjecting us to competitive harm, legal liability and brand or reputational harm. The rapid evolution of AI will require the application of resources to develop, test and maintain our products and services to help ensure that AI is implemented ethically in order to minimize unintended, harmful impact. Uncertainty around new and emerging AI applications such as generative AI content creation and AI agents will require additional investment in compliance, governance and the licensing or development of proprietary datasets, machine learning models and systems to test for accuracy, bias and other variables, which are often complex, may be costly and could impact our profit margin. Moreover, the move from AI content classification to AI content generation through our development of Agentforce and other generative AI products brings additional risks and responsibility. Known risks of generative AI currently include risks related to accuracy, bias, toxicity, privacy and security and data provenance. For example, AI technologies, including generative AI, may create content that appears correct but is factually inaccurate or flawed, or contains copyrighted or other protected material, and if our customers or others use this flawed or protected content to their detriment, or the owners of such copyrighted material seek to enforce their rights, we may be exposed to brand or reputational harm, competitive harm and/or legal liability. Developing, testing and deploying AI systems may also increase the cost profile of our offerings due to the nature of the computing costs involved in such systems. If we are unable to mitigate these risks, or if we incur excessive expenses in our efforts to do so, our reputation, business, operating results and financial condition may be harmed.

Read in the 10-K filed Mar 5, 2025 ↗

Global privacy and data protection-related laws and regulations, including cybersecurity laws, are evolving, extensive, and complex. Compliance with these laws and regulations is difficult and costly. In addition, evolving legal requirements restricting

Read in the 10-K filed Sep 3, 2025 ↗

The interpretation and application of many privacy and data protection laws are uncertain. These laws may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our products. If so, in addition to the possibility of negative publicity, fines, lawsuits, and other claims and penalties, we could be required to fundamentally change our business activities and practices or modify our products, which could harm our business.

Read in the 10-K filed Feb 20, 2025 ↗

The world has experienced an exponential level of growth in the availability of potential applications of artificial intelligence (AI). AI could disrupt certain aspects of our business and evolve use of technology in ways that are not yet known. If we are not able to adapt and effectively incorporate potential advantages of AI in our business, it may negatively impact our ability to compete. On the other hand, if we are not able to effectively manage the risks of AI, including the potential for poor or inconsistent quality, privacy concerns, risks related to automated decision-making, and the potential for exposure of confidential and/or propriety information, we may suffer harm to our consolidated results of operations and reputation.

Read in the 10-K filed Jul 28, 2025 ↗

•difficulty complying with varying laws and regulatory standards across jurisdictions, including with respect to labor and employment, data privacy, data protection, tax, export control and sanctions, public health, payment processing, transactions, and local regulatory restrictions;

Read in the 10-K filed Feb 14, 2025 ↗

Additionally, we collect and store confidential data, including intellectual property, proprietary business information, and the proprietary business information of our customers, suppliers, and dealers, as well as personal data of our customers and employees in

Read in the 10-K filed Dec 12, 2024 ↗

Internationally, we distribute our products through warehouses and DCs managed by 3PLs in certain international locations. For example, we are currently in the process of transitioning one of our international 3PLs to a new partner with an upgraded warehouse management system beginning in October 2025. We depend on 3PLs to manage the operation of their warehouses and DCs to meet our business needs, performance standards, and expectations, including with respect to data security, compliance with data protection and privacy laws, and provision of quality services on a timely basis at the prices we expect. While we believe we conduct appropriate diligence before entering into service agreements with 3PLs, if our 3PLs fail to manage these responsibilities, or if their operations are disrupted as a result of factors outside of their control, such as sanctions that could in the future be imposed on other countries by the US government, our distribution operations could face significant disruption. The loss of or disruption to the operations of any one or more of these facilities could materially adversely affect our sales, business performance, and results of operations. Although we believe we possess adequate insurance to cover the potential effect of a disruption to the operations of these facilities, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.

Read in the 10-K filed May 23, 2025 ↗

We store and transmit a significant amount of sensitive information, including the personal information of our customers and employees, credit card information, and our proprietary financial, operational, and strategic information. The loss, theft, misuse, or unauthorized disclosure or access to such information could lead to significant reputation or competitive harm, result in litigation, expose us to regulatory proceedings, and cause us to incur substantial losses. As a result, we believe our future success and growth depends, in part, on the ability of our systems, including those utilizing artificial intelligence (AI) such as generative AI, to prevent the theft, loss, misuse, or unauthorized access of this information, and to respond quickly and effectively if data security incidents occur. Data privacy and security incidents may prevent us from maintaining the privacy of this information, result in the disruption of our business, and require us to expend significant resources to secure such information and respond to incidents, any of which could materially adversely affect our business, financial condition, or results of operations.

Read in the 10-K filed May 23, 2025 ↗

If any of these events were to occur, it could have a material adverse effect on our financial condition and results of operations and result in harm to our reputation. In addition, a cyber-attack or other data incident could put us at a competitive disadvantage, result in the deterioration of our customers’ confidence in our brands, cause our suppliers to reconsider their relationship with us or impose onerous contractual provisions, and subject us to litigation, liability, fines, and penalties. We could be subject to regulatory or other actions pursuant to domestic and international privacy laws, which could result in costly investigations and litigation, civil or criminal penalties, operational changes, and negative publicity that could adversely affect our reputation, as well as our results of operations and financial condition.

Read in the 10-K filed May 23, 2025 ↗

There are a number of laws protecting the privacy and security of personal information and increased scrutiny by regulators, such as the Federal Trade Commission, and state attorneys general focused on our industry. Such laws include the California Consumer Privacy Act and California Privacy Rights Act, the EU’s General Data Protection Regulation and member state directives, Canada’s Personal Information Protection and Electronic Documents Acts, and China’s Personal Information Protection Law, and limit how we may collect, use, share and store personal information, and they impose obligations to protect that information. Further, we may be subject to new data privacy and security laws and regulations. If we, or any of our service providers who have access to the personal data for which we are responsible, are found to be in violation of the privacy or security requirements of applicable data protection laws, we could be subject to civil or criminal penalties, which could increase our liabilities, harm our reputation, and have a material adverse effect on our business, financial condition, and results of operations. Although we utilize a variety of measures to secure the data that we control, even compliant entities can experience security breaches or have inadvertent failures despite employing reasonable practices and safeguards.

Read in the 10-K filed May 23, 2025 ↗

Generative AI in our products and services may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies. For example, AI algorithms use machine learning and predictive analytics which may be insufficient or of poor quality and reflect inherent biases and could lead to flawed, biased, and inaccurate results. In addition, generative AI may create content that appears correct but is factually inaccurate or flawed, or contains copyrighted or other protected material, and if our customers or others use this flawed content to their detriment, we may be exposed to brand or reputational harm, competitive harm, and/or legal liability. For example, deficient or inaccurate recommendations, summaries, or analyses that generative AI features assist in producing could lead to customer rejection, or skepticism of our products, affect our reputation or brand, and negatively affect our financial results. Further, unauthorized use or misuse of generative AI by our employees or others may result in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability. Generative AI is also the subject of a quickly evolving legal and regulatory environment, and new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications related to our use of generative AI could cause us to divert resources towards compliance and adversely affect our business, reputation, or financial results. Our use of generative AI may also lead to novel and urgent cybersecurity risks, including the misuse of personal data, which may adversely affect our operations and reputation.

Read in the 10-K filed Mar 27, 2025 ↗

In addition, federal, state, and international government bodies and agencies have in the past adopted, and may in the future adopt, laws and regulations affecting the use of the internet as a commercial medium. Changes in these laws or regulations could adversely affect the demand for our products and services or require us to modify our products and services to comply with these changes. Laws, rules, and regulations governing advertising and e-commerce through internet communications and mobile carriers and their partners are dynamic, and the extent of future government regulation is uncertain. Federal and state regulations govern various aspects of our online business, including intellectual property ownership, infringement, and misappropriation, concerning trade secrets, the distribution of electronic communications, marketing and advertising, data privacy and security, search engines and internet tracking technologies. Future taxation on the use of the internet or e-commerce transactions could also be imposed. Existing or future regulation or taxation could hinder growth in or negatively impact the use of the internet generally, including the viability of internet e-commerce, which could reduce our revenue, increase our operating expenses, and expose us to significant liabilities.

Read in the 10-K filed Mar 27, 2025 ↗

Security incidents or real or perceived errors, failures or bugs in our systems and platform could impair our operations, compromise our confidential information or our users’ personal information, damage our reputation and brand, and harm our business and operating results.

Read in the 10-K filed Mar 27, 2025 ↗

Operating our business and products involves the collection, storage, use and transmission of large volumes of sensitive, proprietary and confidential information, including financial and personal information, pertaining to our current, prospective and past users, as well as our staff, contractors, and business partners. The security measures we take to protect this information may be breached as a result of computer malware, viruses, social engineering, ransomware attacks, account takeover attacks, hacking and cyberattacks, including by state-sponsored and other sophisticated organizations. Such incidents have become more prevalent in recent years. Our security measures could also be compromised by our personnel, theft, or errors, or be insufficient to prevent exploitation of security vulnerabilities in software or systems on which we rely. Such incidents may in the future result in unauthorized, unlawful or inappropriate use, destruction or disclosure of, access to, or inability to access the sensitive, proprietary, and confidential information that we handle. These incidents may remain undetected for extended periods.

Read in the 10-K filed Mar 27, 2025 ↗

Because there are many different cybercrime and hacking techniques and such techniques continue to evolve, we may be unable to anticipate attempted security breaches, react promptly or implement adequate preventative measures. While we have developed systems and processes designed to protect the integrity, confidentiality, and security of our and our users’ confidential and personal information under our control, we cannot assure you that any security measures that we or our third-party service providers have implemented will be effective against current or future security threats.

Read in the 10-K filed Mar 27, 2025 ↗

We collect, store, use and otherwise process personal information, including financial information and other sensitive data, which subjects us to governmental regulation and other legal obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could harm our business.

Read in the 10-K filed Mar 27, 2025 ↗

We collect, store, use and process personal information and other user data, including financial information, credit report information and other sensitive information for our Registered Users. We rely on this data provided to us by users and third parties to offer, improve and innovate our products. If we are unable to maintain and grow such data, we may be unable to provide borrowers with a platform experience that is relevant, efficient, and effective, which could adversely affect our business, financial condition and results of operations.

Read in the 10-K filed Mar 27, 2025 ↗

There are numerous federal, state, and local laws and regulations regarding data privacy and the storing, sharing, use, processing, disclosure and protection of personal information and other user data, the scope of which is changing and subject to differing interpretations. In addition, as we continue to expand internationally, we are subject to foreign data privacy and security laws and regulations. These data privacy laws and regulations are complex, continue to evolve, and on occasion may be inconsistent between jurisdictions leading to uncertainty in interpreting such laws. We are also subject to the terms of our privacy policies and privacy-related obligations to third parties, and, given the recent change in administration, we expect a heightened level of scrutiny on the financial data we handle. These laws, regulations, and other obligations may be interpreted and applied in a manner that is inconsistent from one regulatory body to another and may conflict with other rules or our practices.

Read in the 10-K filed Mar 27, 2025 ↗

Most of the jurisdictions in which we operate have established their data privacy and security legal frameworks. Failure to comply with these laws can result in regulatory fines or penalties. The California borrower Privacy Act (“CCPA”) created new data privacy rights for California-resident users that will be expanded when the CPRA, which was approved in November 2020, goes into effect. In addition, Virginia recently passed the borrower Data Protection Act, which will go into effect at the same time as CPRA and many other states are considering enacting privacy laws. These laws, as well as any associated regulations, may increase our operating costs and potential liability (particularly in the event of a data breach), delay or impede the development of new products, and have a material adverse effect on our business, including how we use information about individuals, our financial condition and the results of our operations or prospects.

Read in the 10-K filed Mar 27, 2025 ↗

Any failure or perceived failure by us to comply with our privacy policies, our privacy-related obligations to users or other third parties, or our privacy-related legal obligations, or any compromise of security that results in the unauthorized release or transfer of personally identifiable information or other user data, may result in governmental enforcement actions, litigation or negative publicity and could cause our users and lenders to lose trust in us, which would have a material and adverse effect on our business. We may also be subject to remedies that may harm our business, including fines, demands or orders that we modify or cease existing or planned business practices.

Read in the 10-K filed Mar 27, 2025 ↗

If the Company’s data and network infrastructure were to fail, or if the Company were to suffer an interruption or degradation of services or other infrastructure environments, it could lose important manufacturing and technical data, which could harm its business. The Company’s facilities, as well as the facilities of third parties that maintain or have access to the Company’s data or network infrastructure, are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, cyber security attacks, terrorist attacks, power losses, telecommunications failures and similar events. If the Company’s or any third-party provider’s systems or service abilities are hindered by any of the events discussed above, the Company’s ability to operate may be impaired and its business could be adversely affected. A decision to close facilities without adequate notice, or other unanticipated problems, could adversely impact the Company’s operations. The Company’s infrastructure also could be subject to break-ins, cyber-attacks, sabotage, intentional acts of vandalism and other misconduct, from a spectrum of actors ranging in sophistication from threats common to most industries to more advanced and persistent, highly organized adversaries. Any security breach, including personal data breaches, or incident, including cybersecurity incidents, that the Company experiences could result in unauthorized access to, misuse of or unauthorized acquisition of its internal sensitive corporate data, such as financial data, intellectual property, or data related to contracts with commercial or government customers or partners. Such unauthorized access, misuse, acquisition, or modification of sensitive data may result in data loss, corruption or alteration, interruptions in the Company’s operations or damage to the Company’s computer hardware or systems or those of its employees and customers. Moreover, negative publicity arising from these types of disruptions could damage the Company’s reputation.

Read in the 10-K filed Mar 27, 2025 ↗

Over the past several years, cyber-attacks have become more prevalent and much harder to detect and defend against. The Company’s network and storage applications may be vulnerable to cyber-attack, malicious intrusion, malfeasance, loss of data privacy or other significant disruption and may be subject to unauthorized access by hackers, employees, consultants or other service providers. In addition, hardware, software or applications the Company develops or procures from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise information security. Unauthorized parties may also attempt to gain access to the Company’s systems or facilities through fraud, trickery or other forms of deceiving the Company’s employees, contractors and temporary staff. As cyber threats continue to evolve, the Company may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any cybersecurity vulnerabilities. The Company does not currently have a cyber liability insurance policy and even if a policy is purchased, the Company cannot be certain that its coverage will be adequate for liabilities incurred or that insurance will continue to be available to it on economically reasonable terms, or at all.

Read in the 10-K filed Mar 27, 2025 ↗

Computer malware, viruses, ransomware, hacking, phishing attacks and similar disruptions could result in security and privacy breaches and interruptions and delays in services and operations, which could harm our business.

Read in the 10-K filed Mar 27, 2025 ↗

Aspects of our business may be subject to a variety of federal and state financial and other laws, including laws and state licensing requirements financial products and services, privacy and data security, investment advisory services, and other laws that are frequently evolving and developing. The scope and interpretation of such laws are often uncertain and may be conflicting or ambiguous. It is difficult to predict how existing laws, some of which were enacted before the widespread adoption of the internet and mobile devices, will be applied to our business and the new laws to which we may become subject. In addition, as our business grows into new markets or expands and we collect, use and share more user data internally and with financial services partners, we may become subject to additional laws and regulations.

Read in the 10-K filed Mar 27, 2025 ↗

we are unable to address user concerns regarding the content, privacy, and security of our digital platform;

Read in the 10-K filed Mar 27, 2025 ↗

•Enforcement actions, investigations, or audits by governmental agencies and/or state law claims for monetary damages by patients who believe their protected health information (PHI) has been used, disclosed or not properly safeguarded in violation of federal or state patient privacy laws, including, among others, HIPAA and the Privacy Act of 1974;

Read in the 10-K filed Feb 13, 2025 ↗

For instance, in the European Union, increasingly stringent data protection and privacy rules that have and will continue to have substantial impact on the use of patient data across the healthcare industry became effective in

Read in the 10-K filed Feb 18, 2025 ↗

Payments and other financial services are governed by complex and continuously evolving laws and regulations that are subject to change and vary across different jurisdictions in the United States globally. As a result, we are required to spend significant time and effort to determine whether various licensing and registration laws as well as privacy and secrecy laws relating to payments and other financial services we offer apply to us and to comply with applicable laws and licensing and registration regulations. In addition, there can be no assurance that we will be able to obtain or retain any necessary licenses or registrations. Any failure or claim of failure by us or our third-party service providers to comply with applicable laws and regulations relating to payments or financial services could require us to expend significant resources, result in liabilities, limit or preclude our ability to enter or continue to operate in certain markets and harm our reputation. In addition, changes in payment regulations, or other financial regulation, including changes to the credit or debit card interchange rates in the United States or other markets, could adversely affect payments on our platform and make our payments systems less profitable.

Read in the 10-K filed Feb 27, 2025 ↗

Regulatory scrutiny of privacy, data protection, and the collection, use, sharing, retention and deletion of personal data is increasing globally. We are subject to a number of privacy, data protection, and cybersecurity laws and regulations in the countries in which we operate and these laws and regulations will likely continue to evolve over time, both through regulatory and legislative action and judicial decisions. In addition, compliance with these laws may restrict our ability to provide services to our customers that they may find to be valuable. For example, the General Data Protection Regulation (the “GDPR”) applies to personal data collected in the context of all of our activities conducted from an establishment in the European Union, related to products and services offered to individuals in the European Union or related to the monitoring of individuals’ behavior in Europe, imposes a range of

Read in the 10-K filed Feb 27, 2025 ↗

In the United States, numerous states have adopted generally applicable and comprehensive consumer privacy laws, with the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”) extending more broadly to personal data about any type of California resident (including employees and individuals acting in a professional capacity at other companies as well). These new and developing state laws provide new privacy rights for residents of these states and impose corresponding obligations on organizations doing business in these states. Not only do these laws require that we make disclosures about our data collection, use and sharing practices, but they also require that we provide new rights to individuals, such as the right to access, delete and correct personal data. Complying with new and developing laws has required, and will continue to require, us to incur substantial costs and expenses. In addition, a number of other U.S. states are continuing to propose laws and regulations imposing obligations regarding the handling of personal data. Compliance with the GDPR, the new U.S. state laws, and other current and future applicable U.S. and international privacy, data protection, cybersecurity, AI, and other data-related laws can be costly and time-consuming. For example, the European Union’s comprehensive Artificial Intelligence Act (“EU AI Act”), which lays out the parameters for AI systems where non-compliance can result in fines up to 35 million euros or 7% of global turnover, came into force in August 2024. AI regulation is also expanding in the United States. For example, the California AI Transparency Act, which codifies detailed AI-related disclosure requirements, will come into force in January 2026, and the Colorado AI Act will come into force in February 2026. Implementing and complying with these varying data, privacy, and AI-related requirements in different jurisdictions could cause us to incur substantial costs and/or require us to change our business practices in a manner adverse to our business and violations of these laws can result in significant penalties.

Read in the 10-K filed Feb 27, 2025 ↗

We post on our websites our privacy notices and practices concerning the collection, use, sharing, disclosure, deletion and retention of our user data. Any failure, or perceived failure, by us to comply with our posted privacy notices or with any regulatory requirements or orders or other U.S. federal, state or international privacy or consumer protection-related laws and regulations, including the GDPR and CCPA, could result in proceedings or actions against us by governmental entities or others (e.g., class action or mass action plaintiffs), subject us to significant penalties or damages awards and negative publicity, require us to change our business practices, increase our costs and adversely affect our business. Data collection, data usage and sharing, privacy and security have become the subject of increasing public concern. If Internet and mobile users were to reduce their use of our websites, mobile platforms, products, and services as a result of these concerns, or not consent to the use of their personal data for certain marketing or advertising purposes, our business could be harmed. We also have experienced security breaches and likely will in the future, which themselves may result in a violation of these laws and give rise to regulatory enforcement and/or private litigation.

Read in the 10-K filed Feb 27, 2025 ↗

Online services companies may be subject to claims relating to information disseminated through their services, including claims alleging defamation, libel, breach of contract, invasion of privacy, negligence, among other things. The laws relating to the liability of online services companies for information disseminated through their services are subject to frequent challenges both in the United States and foreign jurisdictions. Any liabilities incurred as a result of these matters could require us to incur additional costs and harm our reputation and our business.

Read in the 10-K filed Feb 27, 2025 ↗

•the acquisition of new customer and employee personal data by us or a third party acquiring assets or businesses from us, which in and of itself may require regulatory approval and or additional controls, policies and procedures and subject us to additional exposure;

Read in the 10-K filed Feb 27, 2025 ↗

MLR and rebates related thereto; claims related to privacy, intellectual property and vendor disputes; claims related to our use of personal information and other proprietary data; and, customer audits and contract performance, including government contracts. These actions or proceedings could result in substantial costs to us, require management to spend substantial time focused on litigation, result in negative media attention, and may adversely affect our business, reputation, financial condition, results of operations and cash flows.

Read in the 10-K filed Feb 20, 2025 ↗

Although we have taken steps to abide by applicable privacy and cybersecurity laws, and strive to protect the security of our IT Systems and Confidential Information, the compliance and security measures put in place by the Company and its vendors cannot guarantee perfect compliance or provide absolute security, and the Company and its vendors’ IT Systems may be vulnerable to numerous and evolving cybersecurity threats and risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information, including through social engineering/phishing, malware (including ransomware), distributed denial-of-service attempts, data theft, account takeovers, social engineering/phishing, technological

Read in the 10-K filed Feb 21, 2025 ↗

Operating globally subjects Eaton to changes in government regulations and policies in a large number of jurisdictions around the world, including, but not limited to, those related to tariffs and trade barriers, investments, property ownership rights, taxation, data privacy, and exchange controls. Changes in the relative values of currencies occur from time to time and could affect Eaton's operating results. While we monitor exchange rate exposures and attempt to reduce these exposures through hedging activities, these risks could adversely affect our operating results.

Read in the 10-K filed Feb 27, 2025 ↗

Our business requires us to enter into a large number of agreements with third-party providers and distribute the Exodus Platform in many different jurisdictions. Our agreements contain a variety of terms, including service levels, data privacy and security obligations, indemnification, dispute resolution procedures and regulatory requirements. Agreement terms may not be standardized across our business and can be subject to differing interpretations and local law requirements, which could result in disputes with our users and other third parties from time to time. If our users or other third parties notify us of a breach of contract or otherwise dispute the terms of our agreements, the dispute resolution process could be expensive and time consuming and result in the diversion of resources that could otherwise be deployed to grow our business. Even if these disputes are resolved in our favor, we may be unable to recoup the expenses and other diverted resources committed to resolving the dispute and, if we receive negative publicity in connection with the dispute, our reputation and brand may be harmed. Furthermore, the ultimate resolution of such disputes may be adverse to our interests and as a result could negatively affect our results of operations and financial condition.

Read in the 10-K filed Mar 6, 2025 ↗

Moreover, while illegal activities are primarily facilitated through the use of fiat currencies, digital assets are relatively new and, in many jurisdictions, may be lightly regulated or largely unregulated. Many types of digital assets have characteristics, such as the speed with which digital currency transactions can be conducted, the ability to conduct transactions without the involvement of regulated intermediaries, the ability to engage in transactions across multiple jurisdictions, and the irreversible nature of certain digital asset transactions, and encryption technology that anonymizes these transactions, that make digital assets susceptible to use in illegal activity. U.S. federal and state and foreign regulatory authorities and law enforcement agencies, such as the Department of Justice (“DOJ”), SEC, Commodities Futures Trading Commission (“CFTC”), FTC, OFAC or the Internal Revenue Service (“IRS”), and various state securities and financial regulators have taken and continue to take legal action against persons and entities alleged to be engaged in fraudulent schemes or other illicit activity involving digital assets. We also support digital assets that incorporate privacy-enhancing features, and may from time to time support additional digital assets with similar functionalities. These privacy-enhancing digital assets obscure the identities of sender and receiver, and may prevent law enforcement officials from tracing the source of funds on the blockchain. Facilitating transactions in these digital assets may cause us to be at increased risk of liability arising out of anti-money laundering and economic sanctions laws and regulations.

Read in the 10-K filed Mar 6, 2025 ↗

For example, foreign countries and governmental bodies, including the European Union ("EU") and United Kingdom ("U.K.") and other jurisdictions in which we operate or conduct our business, have laws and regulations concerning the collection, use, retention, security and transfer of the personal data of individuals in those jurisdictions. We may become subject to GDPR and U.K. GDPR, which impose stringent privacy and data protection requirements, and could increase the risk of non-compliance and the costs of providing our products and services in a compliant manner. Additionally, the GDPR (covering the European Economic Area), U.K. GDPR and Swiss data protection regimes impose strict rules on the transfer of personal data out of the EU, U.K. or Switzerland to a “third country,” including to the United States. As an un-hosted self-custody wallet provider, we do not process the personal data of our customers and therefore, compliance with these regimes do not currently have a material impact on our business. However, any actual or perceived breach of the GDPR or U.K. GDPR in the future could further add to our compliance costs, limit how we process information, or lead to reputational damage, regulatory investigations or fines. For example, if regulators assert that we have failed to comply with the GDPR or U.K. GDPR, we may be subject to fines. We may also face civil claims, as well as associated costs, diversion of internal resources, and reputational harm.

Read in the 10-K filed Mar 6, 2025 ↗

Aspects of the GDPR, U.K. GDPR, California Consumer Privacy Act (“CCPA”), Swiss Secretariat for Economic Affairs (“SECO”) and other laws, regulations, industry standards and other obligations related to privacy, data protection and data security remain uncertain. As such, compliance may require us to incur additional costs, modify our data handling practices and restrict our business operations. It is also possible that these laws, regulations, industry standards and other obligations may be interpreted and applied in a manner that is, or is alleged to be, inconsistent with our policies and procedures, the Exodus Platform or our services. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to modify the Exodus Platform or services or make changes to our business activities and practices. We may be unable to make such changes and modifications in a commercially reasonable manner, or at all, and our ability to develop new offerings and features could be limited.

Read in the 10-K filed Mar 6, 2025 ↗

difficulties and expenses in integrating or separating, as the case may be, the operations, products, technology, privacy protection systems, information systems or personnel of an acquired or divested company, including in the case of a divestiture our reliance on performance by the acquiring company;

Read in the 10-K filed Feb 7, 2025 ↗

The regulatory framework for privacy issues worldwide is currently in flux and is likely to remain so for the foreseeable

Read in the 10-K filed Feb 7, 2025 ↗

Evolving privacy-related laws could give rise to liabilities, which could adversely impact our business, results of operations or financial condition.

Read in the 10-K filed Feb 26, 2025 ↗

The technology infrastructure of acquired businesses, as well as their practices related to the use and maintenance of data, could also present issues that we were not able to identify prior to the acquisition. For example, ShopRunner, which we acquired in 2021, collects and stores certain personal data of its merchants and their buyers, its partners, consumers with whom it has a direct relationship, and

Read in the 10-K filed Jul 21, 2025 ↗

users of its applications. Additionally, it uses third-party service providers and subprocessors to help deliver services to merchants and their buyers. These service providers and subprocessors may store or access personal data and/or other confidential information. The foregoing factors increase the risk of data incidents and the amount of potential exposure in the event of a data breach.

Read in the 10-K filed Jul 21, 2025 ↗

•A breach of our IT or physical security systems, or violation of data privacy laws, may cause us to incur significant legal and financial exposure and adversely affect our operations.

Read in the 10-K filed May 21, 2025 ↗

A breach of our IT or physical security systems, or violation of data privacy laws, may cause us to incur significant legal and financial exposure and adversely affect our operations.

Read in the 10-K filed May 21, 2025 ↗

We are subject to laws and regulations in the U.S. and in other countries relating to privacy and the collection, use, transfer, storage and security of personal data, including the European Union General Data Protection Regulation ("GDPR"), the UK GDPR, the EU ePrivacy Directive, Singapore’s Personal Data Protection Act, China’s Personal Information Protection Law ("PIPL"), India's Digital Personal Data Protection Act, and other privacy and data security laws throughout the Asia Pacific region and across the globe. In the U.S., many states including California, Colorado, Connecticut, Minnesota, New Hampshire, Tennessee, Texas, Utah and Virginia have enacted data privacy laws. The California Consumer Privacy Act ("CCPA") became effective January 1, 2020 and was further amended by the California Privacy Rights Act ("CPRA"), which became effective on January 1, 2023. The CCPA and CPRA, among other requirements, require covered companies to provide new rights and disclosures to California consumers, and allow such consumers abilities to opt-out of certain sales of personal information and other activities, and creates a new regulatory enforcement body. These and potential additional regulations and avenues for enforcement could result in, among other things, government inquiries, which could result in significant penalties. Additionally, new privacy and data protection laws and regulations are being considered, under development or are pending at the U.S. Federal and state level and many international jurisdictions.

Read in the 10-K filed May 21, 2025 ↗

to incur substantial costs and expenses in an effort to comply. Any actual or perceived failures to comply with these laws or regulations, or related contractual or other obligations, or any perceived privacy rights violation, whether by us, one of our third-party service providers or vendors or another third party, could lead to investigations, claims, and proceedings by governmental entities and private parties, damages for contract breach, and other significant costs, penalties, and other liabilities, as well as harm to our reputation and market position. The GDPR, the PIPL, U.S. state laws and other laws and self-regulatory codes may affect our ability to reach current and prospective customers, to understand how our solutions and services are being used, to respond to customer requests allowed under the laws, to transfer information among the Company and its international subsidiaries, and to implement our business strategy effectively. These laws and regulations could similarly affect our customers.

Read in the 10-K filed May 21, 2025 ↗

The attractiveness of our services to customers and our ability to conduct business with certain customers can be affected by changes in U.S. and other countries' policies, including regarding trade. We have significant operations located in China, which have been in the past, and could in the future be, adversely affected by evolving laws, regulations and policies, including with regard to import and export tariffs and restrictions, and information security and privacy, as well as changes in the political and geopolitical environment involving China. U.S.-China bilateral trade relations remain uncertain. The U.S.’s various trade actions, including imposing tariffs on certain goods imported from China or deemed to be of Chinese origin, as well as the potential for new tariffs, trade embargoes or sanctions by the U.S., and countermeasures imposed by China in response, have, in the past adversely affected, and could in the future, depending on their duration and implementation as well as our ability to mitigate their impact, adversely affect our business, including in the form of increased cost of goods sold, decreased margins, increased pricing for customers, and reduced sales. Moreover, we could be subject to reputational harm if any of our customers, former customers or vendors were subject to U.S. sanctions or if our customers, former customers or vendors did business with sanctioned countries. Furthermore, geopolitical changes in China-Taiwan relations could disrupt the operations of several companies in Taiwan that are critical to the global supply of semiconductors and other electronic components on which many of our customers depend.

Read in the 10-K filed May 21, 2025 ↗

Many governments, regulators, investors, customers, employees, and other stakeholders remain focused on sustainability practices and matters, including climate change and greenhouse gas ("GHG") emissions, environmental stewardship, responsible sourcing, social responsibility, human capital management, labor practices and workplace conduct, the usage of artificial intelligence, data privacy and human rights, with some expressing opposition to certain of these practices and matters. This attention has resulted in a variety of required and voluntary reporting regimes that are not harmonized and continue to change, including the EU’s Corporate Sustainability Reporting Directive ("CSRD") and the California Climate Corporate Data Accountability Act and Climate-Related Financial Risk Act, among other similar laws. A number of our customers have adopted, or may adopt, procurement policies that include sustainability provisions that their suppliers should comply with, or they may seek to include such provisions in their procurement terms and conditions. Moreover, a number of investors have adopted, or may adopt, sustainability policies with which they expect their portfolio companies to comply.

Read in the 10-K filed May 21, 2025 ↗

We are subject to U.S. federal and state laws and regulations, as well as those of other countries, relating to the collection, use, disclosure and security of personal information. The number and complexity of these laws

Read in the 10-K filed Aug 6, 2025 ↗

Additionally, we may be subject to other legal regimes throughout the world governing data handling, protection and privacy. For example, in June 2018, California passed the CCPA, which provides new data privacy rights for consumers and

Read in the 10-K filed Feb 21, 2025 ↗

In connection with the operation of our business, particularly in relation to our identity and information protection service and financial technology offerings, we collect, use, process, store, transmit or disclose (collectively, process) an increasingly large amount of confidential information, including personal information (which includes credit card information and other critical data) from employees and customers in multiple jurisdictions. The confidential and personal information we process is subject to an increasing number of federal, state, local and foreign laws regarding privacy, data security and the collection, and handling of PII and sensitive data, as well as contractual commitments, and this regulatory framework is rapidly evolving and likely to remain uncertain for the foreseeable future. For example, at the federal level, the GLBA (along with its implementing regulations) requires disclosures to consumers about our handling of their nonpublic personal information and empowers consumers to place restrictions on, or opt out of, our sharing nonpublic personal information with affiliated and nonaffiliated their parties for various purposes. Additionally, our investment adviser, ML Wealth, and broker-dealer, MoneyLion Securities LLC, are subject to SEC Regulation S-P, which requires that covered institutions maintain certain policies and procedures addressing the protection of consumer information and records.

Read in the 10-K filed May 15, 2025 ↗

We are, and may in the future become, subject to litigation, claims, examinations, investigations, legal and administrative cases and proceedings, whether civil or criminal, or lawsuits by governmental agencies or private parties, which may affect our business, financial condition, results of operations and cash flows. These claims, lawsuits and proceedings could involve labor and employment, discrimination and harassment, commercial disputes, class actions, general contract, tort, defamation, data privacy rights, antitrust, common law fraud, government regulation, compliance, alleged federal and state securities and “blue sky” law violations or other investor claims and other matters. For a discussion of specific legal proceedings to which we are currently subject. Refer to Note 18 of the Notes to the Consolidated Financial Statements included in this Annual Report on Form 10-K.

Read in the 10-K filed May 15, 2025 ↗

with compliance with global privacy and data security laws and regulations. Navigating a variety of legal and regulatory regimes may

Read in the 10-K filed Feb 6, 2025 ↗

money laundering, data privacy, and lobbying and similar activities. The FCPA, the U.K. Bribery Act of 2010, the Brazil Clean Companies

Read in the 10-K filed Feb 6, 2025 ↗

misappropriation of sensitive, confidential or personal information, safety risks or unavailability of products.

Read in the 10-K filed Feb 6, 2025 ↗

We also have access to sensitive, confidential or personal information or information in our businesses that is subject to privacy and

Read in the 10-K filed Feb 6, 2025 ↗

material compromise of sensitive, confidential or personal information, improper use of our systems, software solutions or networks,

Read in the 10-K filed Feb 6, 2025 ↗

sensitive, confidential, proprietary, or personal information (including employee information) in our businesses that is subject to a variety of

Read in the 10-K filed Feb 6, 2025 ↗

particularly generative AI, which raises novel privacy and security issues. Enforcement practices vary widely in the jurisdictions in which our

Read in the 10-K filed Feb 6, 2025 ↗

As a result of our worldwide operations, we are subject to rapidly shifting privacy and data protection laws and regulations. In the U.S.,

Read in the 10-K filed Feb 6, 2025 ↗

regulations, and standards concerning personal information, privacy, and data security. There are also U.S. state privacy laws that impose

Read in the 10-K filed Feb 6, 2025 ↗

privacy and security obligations on companies that collect and process personal information. These state laws, and similar state or federal

Read in the 10-K filed Feb 6, 2025 ↗

which we operate have adopted unique data privacy and cybersecurity legal frameworks with which we must comply. Violations of

Read in the 10-K filed Feb 6, 2025 ↗

applicable data privacy or data protection laws or regulations could result in substantial fines, regulatory investigations, reputational

Read in the 10-K filed Feb 6, 2025 ↗

transfer of personal information, which can bring complexity to processing operations that are supported by external third parties located

Read in the 10-K filed Feb 6, 2025 ↗

customer-imposed controls relating to data privacy and security could adversely affect our business and result in damage to our reputation

Read in the 10-K filed Feb 6, 2025 ↗

resides within them. Similarly, such an occurrence could result in the compromise, acquisition or loss of the information processed by these systems and products. Such events could result in, among other things, the loss of proprietary data, interruptions or delays in our business operations and damage to our reputation. In addition, such events could increase the risk of claims alleging that we are non-compliant with applicable laws or regulations, subjecting us to potential liability from private litigation or regulatory penalties and related costs under laws protecting the privacy of personal information or unfair or deceptive practices relating to consumer information; disrupt our operations; or reduce the competitive advantage we hope to derive from our investment in advanced technologies. Various events described above have occurred in the past and may occur in the future. Although impacts of past events have been immaterial, the impacts of such events in the future may be material.

Read in the 10-K filed Jan 28, 2025 ↗

implementation of AI in our offerings and internal systems) could subject us to regulatory action and legal liability, including under specific legislation regulating AI, as well as new applications of existing data protection, cybersecurity, privacy, intellectual property, and other laws.

Read in the 10-K filed Feb 5, 2025 ↗

tools we use rely, we also may incur liability through the violation of applicable laws and regulations, third-party intellectual property, data privacy, or other rights, or contracts to which we are a party.

Read in the 10-K filed Feb 6, 2025 ↗

As a leading technology firm, we are exposed to attacks from criminals, nation state actors, malicious insiders, and activist hackers (collectively, “malicious parties”) who have at times been able to circumvent or bypass our cyber security measures. Although some of these attacks have caused disruptions or exposure of information, so far, these attacks have not resulted in material negative impacts to HPE, nor have any of HPE’s consumers, customers, or employees informed HPE that these attacks resulted in material harm to them. While we investigate and remediate incidents, there can be no assurance that we will do so comprehensively or that the threat actor will not identify alternative means of intrusion or opportunities to otherwise utilize the information it accessed to adversely affect our business or results of operations. It is also possible that incidents may embolden other malicious actors to perpetrate future attacks that may result in material misappropriation, system disruptions or shutdowns, malicious alteration, or destruction of our confidential or personal information or that of third parties. Further, there has been an increase in the frequency and sophistication of such attacks, and we expect these activities to continue to increase, including malicious actors potentially leveraging AI to develop malicious code or sophisticated phishing attempts. Malicious parties may also be able to otherwise develop and deploy viruses, worms, ransomware, and other malicious software programs that attack our products or otherwise exploit any security vulnerabilities of our products, including within our cloud-based environments and offerings, such that we may be unable to anticipate such malicious parties’ techniques, implement adequate preventative measures, or remediate any intrusion on a timely or effective basis even if our security measures are appropriate, reasonable, and comply with applicable legal requirements. Further, cyberattacks or incidents have in the past gone, and could in the future go, undetected in our environments for a period of time, and we may discover additional impacts of earlier incidents that we believe were remediated. For example, as previously disclosed in our Form 8-K filed with the Securities and Exchange Commission on January 24, 2024, we learned in December 2023 that, beginning in May 2023, a nation-state-

Read in the 10-K filed Dec 19, 2024 ↗

now in effect, and similarly enacted broad laws relating to privacy, data protection, and information security that

Read in the 10-K filed Feb 25, 2025 ↗

Additionally, certain other states have enacted specific health data privacy laws and other states are considering

Read in the 10-K filed Feb 25, 2025 ↗

The health care laws that may affect us include: the federal fraud and abuse laws, including the federal Anti-Kickback Statute; false claims and civil monetary penalties laws, including the False Claims Act and Civil Monetary Penalties Law; federal data privacy and security laws, including HIPAA, as amended by HITECH; and the federal Physician Payments Sunshine Act which requires us to report to CMS annually any transfers of value made to physicians (defined broadly to include doctors, dentists, optometrists, podiatrists, chiropractors, and other advanced practice health care professionals), certain non-physician health care practitioners and teaching hospitals as well as ownership and investment interests held by physicians and their immediate family members. In addition, many states have similar laws and regulations that may differ from each other and federal law in significant ways, thus complicating compliance efforts. Moreover, several states require biopharmaceutical companies to comply with the biopharmaceutical industry’s voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government and may require manufacturers to report information related to payments and other transfers of value to physicians and other health care providers or marketing expenditures. Additionally, some state and local laws require the registration of biopharmaceutical sales representatives in the jurisdiction.

Read in the 10-K filed Apr 15, 2025 ↗

A disruption to our information technology systems could result in the loss of confidential business, customer, supplier or employee information, litigation or fines, and may require substantial investigations, repairs or replacements or impact our ability to summarize and report financial results in a timely manner, affecting our productivity or resulting in significant financial, legal and relational costs and potentially harming our reputation and adversely impacting our operations, customer service and results of operations. Additionally, the increasing use and evolution of technology, including cloud-based computing and AI, may lead to potential loss or unauthorized disclosure or use of personal data and proprietary information that was collected, used, stored, or transferred with respect to our business, and to dissemination or destruction of confidential information, unintentionally or otherwise, stored in our or in our third-party providers’ systems or through use of AI, which may significantly increase our business and information security costs, and expose us to reputational harm, penalties, or legal liability. As we complete integration of systems of prior acquired companies with IFF’s systems and prepare for the announced divestitures, we reduce our risk profile. Additionally, an information security or data breach could require us to devote significant management and financial resources to address the problems created, and, as a result of the private rights of action provided for under the European Union’s General Data Protection Regulation (the “GDPR”), the California Consumer Privacy Act (the “CCPA”) and other laws relating to data protection and privacy in other jurisdictions, in the event of such breaches, additional private litigation against us may result. These types of adverse impacts could also occur in the event the confidentiality, integrity or availability of company, customer, supplier or employee information are compromised due to a data loss by us or a trusted third party. We or the third parties with which we share information may not discover any such incidents and/or loss of information for a significant period of time after the incident occurs. In addition, our hybrid and remote work arrangements could introduce operational risk, including cybersecurity and IT systems management risks.

Read in the 10-K filed Feb 28, 2025 ↗

The use of AI by us, our employees or any of our third-party partners may result in unauthorized disclosure of personal data, proprietary information and trade secrets, commercially sensitive or confidential information of IFF, our employees or our partners. Similarly, we may become, through the use of AI and unbeknownst to us, recipients or users of such information provided by other parties, which may enable, among other things, third parties to claim that we infringed on their intellectual property rights. Such unauthorized disclosures or uses of information can result, among other things, in reputational harm, loss of confidence by our customers or employees, penalties, litigation costs, or legal liability.

Read in the 10-K filed Feb 28, 2025 ↗

The theft, loss, or misuse of personal data collected, used, stored, or transferred by us to run our business, including data stored with vendors or other third parties, could result in significantly increased business and security costs or costs related to defending legal claims. Costs to comply with and implement privacy-related and data-protection measures are significant, and noncompliance could expose us to significant monetary penalties, damage to our reputation, suspension of online services or sites in certain countries, and even criminal sanctions.

Read in the 10-K filed Jan 31, 2025 ↗

•Designing and implementing control processes to comply with additional regulations and laws related to the environment, climate change, privacy, and data protection in light of our increased scale and global presence.

Read in the 10-K filed Feb 21, 2025 ↗

Our business operations rely on securely managed information technology systems, some of which are provided or managed by third parties, for data capture, processing, storage and reporting. We have invested in information technology security initiatives and risk management, as well as incident response, business continuity and disaster recovery plans, but it is not possible to eliminate all systematic or external risk. Further, the development and maintenance of information technology security measures is costly and requires ongoing monitoring, testing and updating as technologies and processes change, and efforts to overcome security measures become increasingly sophisticated. Additionally, the global regulatory environment surrounding information security, data privacy and data protection is becoming increasingly restrictive and is evolving frequently.

Read in the 10-K filed Feb 21, 2025 ↗

Our operations are subject to regulation under a wide variety of domestic and international laws, regulations and other government requirements, including, among others, those relating to the environment, health and safety, labor and employment, data privacy, tax, trade and health care. There can be no assurance that laws, regulations and government requirements will not be changed, applied or interpreted in ways that will require us to modify our respective operations and objectives or affect our respective returns on investments by restricting existing activities and products or increasing costs. In addition, any failure or alleged failure to comply with applicable laws, regulations or other government requirements could have an adverse effect on our reputation and financial results or may result in, among other things, litigation, revocation of required licenses, internal investigations, governmental investigations or proceedings, administrative enforcement actions, fines and civil and criminal liability.

Read in the 10-K filed Feb 21, 2025 ↗

Our global operations are subject to complex and evolving domestic and international data privacy laws and regulations, such as the European Union’s General Data Protection Regulation, the UK's General Data Protection Regulation, any supplemental applicable European Union member state or UK national data protection laws, China’s Personal Information Protection Law and comprehensive privacy laws in many U.S. states, including California, Connecticut, Colorado, Utah, and Virginia. These laws impose a range of compliance obligations regarding the handling of personal data. There are significant penalties for non-compliance, including monetary fines, disruption of operations and reputational harm. Moreover, other states and governmental authorities around the world have introduced or passed, or are considering, similar legislation which may impose varying standards and

Read in the 10-K filed Feb 21, 2025 ↗

This increasingly restrictive and evolving global regulatory environment related to data privacy and data protection may continue to require changes to our business practices, and give rise to significantly expanded compliance burdens, costs and enforcement risks. Moreover, many of these laws and regulations are subject to uncertain application, interpretation or enforcement standards that could result in claims, changes to business practices, data processing and security systems, penalties, increased operating costs or other impacts on our business. Additionally, regulatory bodies and others tasked with enforcing privacy and data protection laws have been actively engaging in enforcement investigations and actions. These laws often provide for civil penalties for violations, as well as private rights of action for data breaches that may increase data breach litigation. We use internal and external resources to monitor compliance with relevant legislation and continually evaluate and, where necessary, modify data processing practices and policies to comply with evolving privacy laws. Nevertheless, relevant regulatory authorities could determine that our data handling practices fail to address all the requirements of certain new laws, which could subject us to penalties and/or litigation. In addition, there is no assurance that our security controls over personal data, the training of employees and vendors on data privacy and data security, and policies, procedures and practices will prevent the improper handling of, disclosure of or access to personal data. Improper handling and disclosure of or access to personal data in violation of other data privacy and protection laws could cause reputational harm and loss of consumer confidence and subject us to government enforcement actions (including fines), or result in private litigation, which could result in loss of revenue, increased costs, liability for monetary damages, fines and/or criminal prosecution, all of which could negatively affect our business and operating results.

Read in the 10-K filed Feb 21, 2025 ↗

In the U.S., an executive order was issued in October 2023 on the Safe, Secure and Trustworthy Development and Use of AI, emphasizing the need for transparency, accountability, and fairness in the development and use of AI, including in the healthcare industry. The order seeks to balance fostering innovation with addressing risks associated with AI by providing eight guiding principles and priorities, such as ensuring that consumers are protected from fraud, discrimination, and privacy risks related to AI. The order also calls for future regulations from various agencies, such as the Department of Commerce (to draft guidance for detecting and authenticating AI content) and the Federal Trade Commission (to ensure fair competition and reduce consumer harm). In alignment with the order, other agencies have published guidance. Agencies such as the Department of Commerce and the Federal Trade Commission have also issued proposed rules governing the use and development of AI technologies. Further, legislation related to AI technologies has been introduced at the federal level and is advancing at the state level. For example, on March 13, 2024, Utah passed the Utah AI Policy Act, which took effect in May 2024, imposing certain disclosure requirements on the use of AI and, on May 17, 2024, Colorado enacted the Colorado AI Act, which will take effect in February 2026. Further, the California Privacy Protection Agency is currently in the process of finalizing regulations under the CCPA regarding the use of automated decision-making. Such additional regulations may impact our ability to develop, use, and commercialize AI technologies in the future.

Read in the 10-K filed Jan 31, 2025 ↗

JPMorganChase has experienced and expects that it will continue to experience failures and disruptions in the stability of its operational systems, including degraded performance of data processing systems, data quality issues, disruptions of network connectivity and malfunctioning software, as well as disruptions in its ability to access and use the operational systems of third parties and interruptions in service from third-party service providers. These incidents have resulted in various negative effects for customers, including the inability to access account information or transact through ATM, internet or mobile channels, the exfiltration of customer personal data, the recording of duplicative transactions and extended delays for customers requiring services from call centers. There can be no assurance that these and other types of operational failures or disruptions will not occur in the future.

Read in the 10-K filed Feb 14, 2025 ↗

JPMorganChase’s businesses and operations are subject to complex and evolving laws, rules and regulations, both within and outside the U.S., governing the privacy and protection of personal information of individuals. Governmental authorities around the world have adopted and are considering the adoption of numerous legislative and regulatory initiatives concerning privacy, data protection and security. Litigation or enforcement actions relating to these laws, rules and regulations could result in fines or orders requiring that JPMorganChase change its data-related practices, which could have an adverse effect on JPMorganChase’s ability to provide products and otherwise harm its business operations.

Read in the 10-K filed Feb 14, 2025 ↗

Implementing processes relating to JPMorganChase’s collection, use, sharing and storage of personal information to comply with all applicable laws, rules and regulations in all relevant jurisdictions, including where the laws of different jurisdictions are in conflict, can:

Read in the 10-K filed Feb 14, 2025 ↗

information exchanged between them and JPMorganChase, particularly where information is transmitted by electronic means. JPMorganChase could be exposed to litigation or regulatory fines, penalties or other sanctions if personal information of clients, customers, employees or others were to be mishandled or misused, such as situations where such information is:

Read in the 10-K filed Feb 14, 2025 ↗

In recent years, well-publicized incidents involving the inappropriate collection, use, sharing or storage of personal information have led to expanded governmental scrutiny of practices relating to the processing or safeguarding of personal information by companies in the U.S. and other countries. That scrutiny has in some cases resulted in, and could in the future lead to, the adoption of stricter laws, rules and regulations relating to the collection, use, sharing and storage of personal information. These types of laws, rules and regulations can prohibit or significantly restrict financial services firms such as JPMorganChase from transferring information across national borders or sharing information among affiliates or with third parties such as vendors, thereby

Read in the 10-K filed Feb 14, 2025 ↗

increase compliance costs and operational risk, or restrict JPMorganChase’s use of personal information when developing or offering products or services to customers. Some countries are considering or have adopted legislation implementing data protection requirements or requiring local storage and processing of data which could increase the cost and complexity of JPMorganChase’s delivery of products and services. These restrictions could also inhibit JPMorganChase’s development or marketing of certain products or services, or increase the costs of offering them to customers.

Read in the 10-K filed Feb 14, 2025 ↗

•incorrect, biased or misleading results or content generated by artificial intelligence, leading to harmful outcomes, including discrimination in lending practices against vulnerable populations, fraud, manipulation of customers, privacy breaches or intellectual property infringement

Read in the 10-K filed Feb 14, 2025 ↗

Cybersecurity has become a top priority for regulators around the world. Rapidly developing and changing cybersecurity laws and regulations could further increase compliance costs and subject us to enforcement risks and reputational damage. Many jurisdictions in which we operate have laws and regulations relating to data privacy, cybersecurity and protection of personal information, including the U.K.’s Data Protection Act 2018, the European General Data Protection Regulation (“GDPR”) that became effective in May 2018, the E.U.’s regulations on digital operational resilience for the financial sector ("DORA"), which became effective in January 2023 and will begin to apply from January 2025 (which is designed to harmonize and strengthen digital operational resilience requirements for the EU's financial services sector and will require in-scope financial entities to comply with new requirements, including having a comprehensive governance and control framework for the management of information and communications technology risk), the Gramm-Leach-Bliley Act of 1999 as amended in June 2023 (and the applicable regulations thereunder) and the California Consumer Privacy Act (“CCPA”) that became effective in January 2020 and is amended by the California Privacy Rights Act (“CPRA”), which became operative in January 2023. The CPRA imposed additional obligations on companies covered by the legislation, including by expanding consumers’ rights with respect to certain sensitive personal information. The CPRA also creates a new state agency that is vested with authority to implement and enforce the CCPA and the CPRA. Global Atlantic is subject to the New York State Department of Financial Services (“NYSDFS”) cybersecurity regulation. In November 2023, the NYSDFS finalized amendments to its cybersecurity regulations which took effect in April 2024 (the “NYSDFS Cybersecurity Amendments”), which, among other things, imposes additional governance requirements, require the implementation of additional safeguards, impose various requirements on larger companies, require new and increased obligations related to written policies and procedures, heighten requirements around audits and risk assessments, and necessitate additional reporting requirements for cybersecurity incidents. More specifically, the NYSDFS Cybersecurity Amendments also require subject entities to (i)

Read in the 10-K filed Feb 28, 2025 ↗

Furthermore, the SEC has underscored its focus on cybersecurity. In July 2023, the SEC adopted new cybersecurity disclosure rules, aimed at enhancing and standardizing disclosures made by public companies regarding cybersecurity risk management, strategy, governance and incident reporting. Some jurisdictions have also enacted laws requiring companies to notify individuals of data security breaches involving certain types of personal data. In February 2022, the SEC also proposed similar cybersecurity regulations for regulated investment advisers. If adopted in its proposed form, the proposed rule would require implementation of written cybersecurity policies and procedures to address cybersecurity risk in addition to requiring registered investment advisers to report significant cybersecurity incidents affecting the investment adviser or the investment vehicles it advises within 48 hours to the SEC and would impose a new recordkeeping policy and internal review requirements related to cybersecurity. If this proposal is adopted, it could increase our compliance costs and potential regulatory liability related to cybersecurity. The SEC has also proposed a similar cybersecurity rule for broker-dealers and other security market participants which would require subject entities to implement policies and procedures that are reasonably designed to address their cybersecurity risks and, at least annually, review and assess the design and effectiveness of their cybersecurity policies and procedures, including whether they reflect changes in cybersecurity risk over the time period covered by the review. Many regulators have indicated an intention to take more aggressive enforcement actions regarding cybersecurity matters, and private litigation resulting from such matters is increasing and resulting in progressively larger judgments and settlements.

Read in the 10-K filed Feb 28, 2025 ↗

There is also a risk that artificial intelligence may be misused or misappropriated by our employees or third parties engaged by us. For example, a user may input confidential information, including material non-public information or personally identifiable information, into artificial intelligence applications, resulting in such information becoming a part of a dataset that is accessible by third-party technology applications and users, including our competitors. If we or third-party developers whose artificial intelligence we utilize do not have sufficient rights to use the data or other material relied upon by such developers, we also may incur liability through the alleged violation of applicable laws and regulations, third-party intellectual property, data privacy, or other rights, or contractual obligations. Further, we may not be able to control how third-party artificial intelligence that we choose to use are developed or maintained, or how data we input is used or disclosed, even where we have sought contractual protections with respect to these matters. The misuse or misappropriation of our data, unavoidable deficiencies in the practices associated with data collection, training AI technology on large data sets, and big data analytics and difficulties validating data, could have an adverse impact on our reputation and could subject us to legal and regulatory investigations or actions or create competitive risk.

Read in the 10-K filed Feb 28, 2025 ↗

Our ability to use data to gain insights into and manage our business may be limited in the future by regulatory scrutiny and legal developments. See also “—Risks Related to Our Business—Rapidly developing and changing global privacy and data laws and regulations could further increase compliance costs and subject us to enforcement risks and reputational damage” and “—Risks Related to Our Business—Cybersecurity failures and data security breaches may disrupt or have a material adverse impact on our businesses, operations and investments.”

Read in the 10-K filed Feb 28, 2025 ↗

We and our portfolio companies are subject to various risks and costs associated with the collection, processing, storage and transmission of personal information and other sensitive and confidential information. This data is wide ranging and relates to our investors, employees, insurance policyholders, contractors and other counterparties and third parties. Any inability, or perceived inability, by us or our portfolio companies to adequately address privacy concerns, or comply with applicable privacy laws, regulations, policies, industry standards and guidance, related contractual obligations, or other privacy legal obligations, even if unfounded, could result in significant regulatory and third party liability, increased costs, disruption of our and our portfolio companies’ business and operations, and a loss of investor confidence and other reputational damage.

Read in the 10-K filed Feb 28, 2025 ↗

Our employees (and, in certain cases, third-party service providers) have access to, and process, personal information of our investors, insurance policyholders, employees, contractors and other counterparties and third parties through a variety of media, including information technology systems. Our and our third-party service providers’ information systems and technology may not be able to adequately protect the information of our investors, employees, insurance policyholders, contractors and other counterparties and third parties, may not be suitable for new products and strategies and may be subject to security risks. We rely on various internal processes and controls to protect the confidentiality of client information that is accessible to, or in the possession of, us, our employees and certain vendors and third-party administrators. It is possible that an employee could, intentionally or unintentionally, disclose or misappropriate confidential client information or our data could be the subject of a cybersecurity attack. Our third-party administrators and their employees also have access to, and routinely process, personal information of our investors, employees, insurance policyholders, contractors and other counterparties and third parties, and we are also dependent on such third parties and their systems to protect such data. If we or one of our subsidiary’s employees, or one of our or a subsidiary’s third-party vendors or administrators’ employees, unintentionally share confidential client information or such information as a result of a cybersecurity attack or otherwise, we may be unable to control or mitigate this occurrence even if we offer remediation, such as credit monitoring, to the impacted parties. Misappropriation or intentional or unintentional inappropriate disclosure or misuse of client confidential information could occur even if individuals are properly trained and adequate internal controls and policies and procedures are maintained.

Read in the 10-K filed Feb 28, 2025 ↗

Pursuant to U.S. federal and state laws, various government agencies have established rules protecting the privacy and security of personal information. We and our portfolio companies may be required to comply with both U.S. federal and state laws and regulations related to privacy. For example, the CCPA provides for enhanced consumer protections for California residents, a private right of action for data breaches of certain personal information and statutory fines and damages for such data breaches or other CCPA violations, as well as a requirement of “reasonable” cybersecurity. The CCPA was expanded on January 1, 2023, when the CPRA amendments to the CCPA became operative. Additional U.S. states have passed their own comprehensive consumer privacy laws, some of which went into effect in 2023 and 2024, and other states are considering doing so, including Delaware, Iowa and Nebraska each of whom have new privacy laws taking effect in 2025. These state laws may expand our compliance obligations and impact our business or the businesses of our portfolio companies. Most states have enacted laws to which we are subject, and which vary significantly from jurisdiction to jurisdiction, to safeguard the privacy and security of personal information. Global Atlantic, in particular, processes sensitive personal information of its policyholders, which exposes Global Atlantic to heightened risk. Global Atlantic is subject to the NYSDFS cybersecurity regulation. The NYSDFS Cybersecurity Amendments significantly expand the regulation by the NYSDFS of data privacy matters. Global Atlantic is also subject to the California Consumer Privacy Act. At the U.S. federal level, we are subject to the Gramm-Leach-Bliley Act of 1999 as amended in June 2023, which imposes privacy requirements on financial institutions,

Read in the 10-K filed Feb 28, 2025 ↗

including obligations to protect and safeguard consumers’ nonpublic personal information and records, and limits the ability to share and reuse such information.

Read in the 10-K filed Feb 28, 2025 ↗

In December 2024, the DOJ finalized a rule with phased-in compliance for U.S. persons, including us, beginning in April 2025 which will impose data security requirements, such as meeting certain standards for cybersecurity, adopting cybersecurity policies, conducting cybersecurity audits and performing due diligence and recordkeeping requirements, on, and prohibit the transfer of, and access to, bulk sensitive personal data to foreign persons connected with certain countries of concern which currently include China, Cuba, Iran, North Korea, Russia and Venezuela.

Read in the 10-K filed Feb 28, 2025 ↗

In addition, we and our portfolio companies are required to comply with certain non-U.S. privacy laws, including, for example, the GDPR, the Personal Information Protection Law of the People’s Republic of China (“PIPL”), which has parallels with the GDPR given that it has extra-territorial effect, applying to data processing activities in China and outside of China in certain circumstances, the India Digital Personal Data Protection Act 2023 and the UK Data Protection Act as well as laws in other jurisdictions globally. Global laws in this area are rapidly increasing in the scale and depth of their requirements and are also often extra-territorial in nature. In addition, a wide range of regulators and private actors are seeking to enforce these privacy laws with increased scrutiny and growing penalties, including across regions and borders. Furthermore, we frequently have privacy compliance requirements because of our contractual obligations with counterparties. As new privacy-related laws and regulations are implemented, the time, cost and resources needed for us and our portfolio companies to comply with such laws and regulations continues to increase. These legal, regulatory, and contractual obligations heighten our privacy obligations in the ordinary course of conducting our business in the U.S. and internationally. Furthermore, failure to comply with U.S. and foreign privacy, data protection, and data security laws and regulations could result in government investigations or enforcement actions (which could include civil or criminal penalties), private litigation, claims, or public statements against us or adverse publicity. Claims that we have violated individuals’ privacy rights, failed to comply with privacy, data protection, and data security laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend, could result in adverse publicity and could have a material adverse effect on us. Many regulators have indicated an intention to take more aggressive enforcement actions regarding data privacy matters, and private litigation resulting from such matters is increasing and resulting in progressively larger judgments and settlements.

Read in the 10-K filed Feb 28, 2025 ↗

The private equity industry has been and continues to be under intense regulatory and news media scrutiny with governmental officials and regulators focusing on the private equity industry's fees, the taxation of its investments, business practices, antitrust compliance and operations of its portfolio companies, conflicts of interest, and other issues. In particular, the SEC's areas of focus on private equity firms have included, among others, fiduciary duty and compliance programs, conflicts of interest, allocation of investment opportunities, the allocation of fees and expenses, including the acceleration of monitoring fees and the allocation of broken-deal and other expenses, valuation practices, the disclosure, use and compensation of operating partners or consultants as well as third-party compliance or similar service providers, outside investment and business activities of firm principals and employees, group purchasing arrangements, disclosure of affiliated service providers, disclosure of conflicts of interest and investment risks, adherence to notice, consent and other contractual requirements, electronic communications, cybersecurity, data privacy and protection, the use of purchased data, valuation, retail investors, foreign bribery and corruption, and policies covering custody, auditing, handling of material nonpublic information, insider trading, business continuity and transition planning, conflicts of interest relating to liquidity, such as certain adviser-led fund

Read in the 10-K filed Feb 28, 2025 ↗

Additionally, our business could be adversely affected if we or our portfolio companies fail to comply with existing and potential new applicable regulations relating to artificial intelligence, including the EU AI Act, privacy, data, and information security. The potential impact to us of these regulations is in “—Risks Related to Our Business—Rapidly developing and changing global privacy and data laws and regulations could further increase compliance costs and subject us to enforcement risks and reputational damage” and "—Risks Related to Our Business—Cybersecurity failures and data security breaches may disrupt or have a material adverse impact on our businesses, operations and investments."

Read in the 10-K filed Feb 28, 2025 ↗

We are subject to certain laws, such as certain environmental laws, takeover laws, anti-bribery, trade sanctions, economic control, anti-money laundering and anti-corruption laws, escheat or abandoned property laws, antitrust laws, data privacy and

Read in the 10-K filed Feb 28, 2025 ↗

number of important business, financial, tax, accounting, sustainability, technological, cybersecurity, data privacy, regulatory and legal issues and macroeconomic trends in determining whether or not to proceed with an investment. Outside consultants, legal and tax advisors, accountants and investment banks, among others, are involved in the due diligence process in varying degrees depending on the type of investment. Nevertheless, when conducting due diligence and making an assessment regarding an investment, we rely on resources available to us, including information provided by the target of the investment and, in some circumstances, third-party investigations. The due diligence process may at times be subjective with respect to newly organized companies or carve-out transactions for which only limited information is available.

Read in the 10-K filed Feb 28, 2025 ↗

In the ordinary course of our business, we receive, process, transmit and store information relating to identifiable individuals (“personal data”), including employees, former employees, vendors, third-party personnel, customers and consumers with whom we interact. As a result, we are subject to a variety of continuously evolving and developing laws and regulations in numerous jurisdictions regarding privacy and data protection. These privacy and data protection laws may include different standards and obligations or may be interpreted and applied differently from jurisdiction to jurisdiction and may create inconsistent or conflicting requirements. In addition, new legislation in this area may be enacted in other jurisdictions at any time or may revise the law in jurisdictions that already have privacy regulations. These laws impose operational requirements

Read in the 10-K filed Feb 20, 2025 ↗

As previously disclosed, CNA sustained a sophisticated cybersecurity attack in March 2021 involving ransomware that caused a network disruption and impacted certain of its systems. CNA’s investigation into the incident revealed that an unauthorized third party copied some personal information relating to certain current and former employees, contract workers and their dependents and certain other persons, including some policyholders. Although CNA currently has no indication that the impacted data has been misused, or that CNA or its policyholder data was specifically targeted by the unauthorized third party, it may be subject to subsequent investigations, claims or actions in addition to other costs, fines, penalties, or other obligations related to impacted data, whether or not such data is misused. In addition, the misuse, or perceived misuse, of sensitive or confidential information regarding its business or policyholders could cause harm to CNA’s reputation and result in the loss of business with existing or potential customers, which could adversely impact its business, results of operations and financial condition.

Read in the 10-K filed Feb 11, 2025 ↗

The Company has previously experienced and expects to continue to experience attempts by unauthorized parties to compromise the Company’s cybersecurity controls, like the 2018 ransomware attack. The Company has also experienced and expects to continue to experience similar attempts by threat actors to penetrate the systems of third-party suppliers and vendors to whom the Company has provided data, like the 2019 AMCA data breach. These attempts, if successful, could result in the misappropriation or compromise of personal information or proprietary or confidential information stored within the Company's systems or within the systems of third parties, create system disruptions or cause shutdowns. Threat actors have a variety of attack methods, including without limitation, by developing and deploying viruses, worms, and other malicious software programs that attack the Company’s systems, the systems of third-parties, or otherwise exploit any security vulnerabilities. In addition, the increased use of AI by threat actors is enhancing the scale sophistication and effectiveness of their cyberattacks. Outside parties may also attempt to fraudulently induce employees to take actions, including the release of confidential or sensitive information or to make fraudulent payments through illegal electronic spamming, phishing, spear phishing, and other tactics.

Read in the 10-K filed Feb 25, 2025 ↗

The Company depends on third parties to provide services critical to the Company's business, including supplies, ground and air transport of clinical and diagnostic testing supplies and specimens, research products, and people, among other services and depends on them to comply with applicable laws and regulations. Third parties that provide services to the Company are subject to similar risks related to security of customer-related information and compliance with U.S., state, local, or international environmental, health and safety, and privacy and security laws and regulations as the Company. Any failure by third parties to comply with applicable laws, or any failure of third parties to provide services more generally, could have a material impact on the Company, whether because of the loss of the ability to receive services from the third parties, legal liability of the Company for the actions or inactions of third parties, or otherwise.

Read in the 10-K filed Feb 25, 2025 ↗

In addition, third parties to whom the Company outsources certain services or functions may process personal data, or other confidential information of the Company. A cybersecurity incident affecting these third parties, like the AMCA Incident, could also harm the Company's business, results of operations and reputation.

Read in the 10-K filed Feb 25, 2025 ↗

In the U.S., the Health Insurance Portability and Accountability Act of 1996, the U.S. Health Information Technology for Economic and Clinical Health (HITECH) Act, and their implementing privacy and security regulations (collectively, HIPAA) establish comprehensive standards with respect to the use and disclosure of protected health information (PHI), by covered entities as well as their “business associates” as defined in HIPAA, in addition to setting standards to protect the confidentiality, integrity and security of PHI.

Read in the 10-K filed Feb 25, 2025 ↗

HIPAA restricts the Company’s ability to use or disclose PHI, without patient authorization, for purposes other than payment, treatment or healthcare operations (as defined by HIPAA), except for disclosures for various public policy purposes and other permitted purposes outlined in the privacy regulations. HIPAA provides for significant fines and other penalties for wrongful use or disclosure of PHI in violation of the privacy and security regulations, including potential civil and criminal fines and penalties. The regulations establish a complex framework on a variety of subjects, including:

Read in the 10-K filed Feb 25, 2025 ↗

In addition to the existing requirements under HIPAA, HHS issued an NPRM regarding revising the HIPAA Security Rule, which, if adopted, would impose increased requirements on regulated entities such as the Company. The Company has implemented policies and procedures designed to comply with the HIPAA privacy and security requirements as applicable. The privacy and security regulations establish a “floor” and do not supersede state laws that are more stringent. Therefore, the Company is required to comply with both additional federal privacy and security regulations and varying state privacy and security laws. To the extent applicable, newer laws like the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Washington My Health My Data Act, and similar consumer privacy laws in other states, may impose additional obligations on the Company. Federal and state laws that protect the privacy and security of patient information may be subject to enforcement and interpretations by various governmental authorities and courts, resulting in complex compliance issues. In addition, laws regulating artificial intelligence and machine learning, including the use of algorithms and automated processing, may impact the Company and lead to increases in the cost of compliance. Noncompliance with these laws could result in the imposition of fines, penalties, or orders to stop certain activities, and potentially expose the Company to actions for the wrongful use or disclosure of health information or other personal information.

Read in the 10-K filed Feb 25, 2025 ↗

The Company may also be required to comply with the data privacy and security laws of other countries in which it operates or with which it transfers and receives data. For example, the EU’s General Data Protection Regulation (GDPR) includes compliance obligations for subject companies and imposes penalties for noncompliance of up to the greater of €20 million or 4% of worldwide revenue for the most serious breaches of data protection obligations, and similar obligations exist under the UK GDPR. The Company has established processes and frameworks to manage compliance with the GDPR. Potential fines and penalties in the event of a violation of the GDPR could have a material adverse effect on the Company’s business and operations. In addition, similar data protection regulations addressing access, use, disclosure and transfer of personal data have been enacted or updated in regions where the Company does business, including in Asia, Latin America, and other parts of Europe.

Read in the 10-K filed Feb 25, 2025 ↗

false claims, procurement integrity, cost accounting and billing, competition, information security and data privacy

Read in the 10-K filed Feb 14, 2025 ↗

other processing of proprietary, confidential and other information. Moreover, new laws and regulations, such as the European Union’s General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act (“CCPA”), and China’s Personal Information Protection Law, add to the complexity of our compliance obligations and increases our compliance costs. Although we have established internal controls and procedures intended to comply with such laws and regulations, any actual or alleged failure to fully comply could result in significant penalties and other liabilities, harm to our reputation and market position, business and financial condition.

Read in the 10-K filed Aug 19, 2025 ↗

Other governmental authorities investigating or seeking information about the Data Security Incident have imposed and may further impose undertakings, injunctive relief, consent decrees, or other penalties, which could, among other things, materially increase our costs or otherwise require us to alter how we operate our business and could damage our reputation and brand. Significant management time and Company resources have been, and will continue to be, devoted to matters related to the Data Security Incident. Insurance coverage designed to limit our exposure to losses such as those related to the Data Security Incident is costly and may not be sufficient or available to cover all of our expenses or other losses (including payments imposed by the AG Offices or other regulators and other payments, fines, or penalties) related to the Data Security Incident, and certain expenses by their nature (such as, for example, expenses related to enhancing our data privacy and information security programs) are not covered by our insurance program.

Read in the 10-K filed Feb 11, 2025 ↗

Changes in laws could adversely affect our ability to market our products effectively. We rely on a variety of direct marketing techniques, including email marketing, online advertising (including through social media), and postal mailings. Any further legal restrictions under various U.S. federal, state, or international laws, or new international, federal, or state laws on marketing and solicitation or international privacy, e-privacy, and anti-spam laws that govern these activities could adversely affect the continuing effectiveness of email, online advertising (including through social media), and postal mailing techniques and could require changes in our marketing strategy. If this occurs, we may not be able to develop adequate alternative marketing strategies, which could impact the amount and timing of our sales of certain products. We also obtain access to

Read in the 10-K filed Feb 11, 2025 ↗

–complexities of compliance with employment laws, various proposed and enacted data privacy laws, and cybersecurity rules in numerous jurisdictions.

Read in the 10-K filed Feb 14, 2025 ↗

On March 25, 2022, the European Union and United States announced that they had reached an agreement in principle on a new EU-U.S. Data Privacy Framework (EU-U.S. DPF). On October 7, 2022, President Biden signed the Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities (E.O.), and on June 30, 2023, the European Union and the three additional countries making up the EEA were designated by the United States Attorney General as a “qualifying state” under Section 3(f) of the E.O. On July 10, 2023, the European Commission adopted an adequacy decision in relation to the United States. The adequacy decision concludes that the United States ensures an adequate level of protection for personal data transferred from the European Union to organizations in the United States that are included in the “Data Privacy Framework List,” maintained and made publicly available by the United States Department of Commerce pursuant to the EU-U.S. DPF. The implementation of the EU-U.S. DPF and the adequacy decision are important and welcome milestones, and we have implemented steps to comply with the above corrective orders following engagement with the IDPC. The EU-U.S. DPF replaces two prior adequacy frameworks which were invalidated by the CJEU. A further invalidation of the EU-U.S. DPF by the CJEU could create considerable uncertainty and lead to us being unable to offer a

Read in the 10-K filed Jan 30, 2025 ↗

In the U.S., for example, the CCPA imposes requirements on companies that do business in California and collect personal information from certain individuals, including notice, consent and service provider requirements. The CCPA also provides for civil penalties for companies that fail to comply with these requirements, as well as a private right of action for data breaches. Further, the California Privacy Rights Act (CPRA) went into full effect on January 1, 2023 (with a ‘look-back’ to January 1, 2022). The CPRA builds on the CCPA and among other things, requires the establishment of a dedicated agency to regulate privacy issues. In 2021, Virginia, Colorado, Connecticut and Utah adopted laws which have now taken effect introducing new privacy obligations, which have required us to develop additional compliance mechanisms and processes. Many other states are considering similar legislation. A broad range of legislative measures also have been introduced at the federal level. There also is a wide range of enforcement agencies at both the state and federal levels that can review companies for privacy and data security concerns based on general consumer protection laws. The Federal Trade Commission and state Attorneys General all are aggressive in reviewing privacy and data security protections for consumers. Accordingly, failure to comply with federal and state laws (both those currently in effect and future legislation) regarding privacy and security of personal information could expose us to fines and penalties under such laws. There also is the threat of consumer class actions related to these laws and the overall protection of personal data. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business.

Read in the 10-K filed Jan 23, 2025 ↗

Similarly, outside of the U.S., there are various laws and regulations governing the collection, use, disclosure, transfer, or other processing of personal data. For instance, the GDPR, which applies to the processing of personal data of individuals in the European Union, is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including strict rules on the transfer of personal data to countries outside the European Union, including the U.S. Beyond GDPR, there are privacy and data security laws in a growing number of countries around the world (including in the United Kingdom as a result of Brexit). While many loosely follow GDPR as a model, other laws contain different or conflicting provisions. These laws may impact our ability to conduct our business activities and the costs associated with these activities.

Read in the 10-K filed Jan 23, 2025 ↗

The Company or its third-party vendors may develop or incorporate artificial intelligence technology in certain business processes, services or products. The development and use of artificial intelligence may present risks to the Company’s business. Also, the rapidly evolving legal and regulatory environment relating to artificial intelligence, in the United States and internationally, could impact the Company’s implementation of artificial intelligence technology, and increase compliance costs and the risk of non-compliance. While the Company will seek to develop and use artificial intelligence responsibly, and will attempt to identify and mitigate ethical, privacy, legal or other issues presented by its use, there can be no assurance that the Company will be fully successful in doing so, and may be subject to data breaches, allegations of unauthorized access to, or use of, third party data, information, or intellectual property rights, or other risks, which may lead to financial losses, legal liability, regulatory scrutiny and reputational damage.

Read in the 10-K filed Feb 5, 2025 ↗

including the risk of legal claims or proceedings, investigations or enforcement actions by U.S., state, or foreign regulators; liabilities or penalties under applicable laws and regulations, including privacy laws and regulations in the U.S. and other jurisdictions; interference with the Company’s operations; the incurrence of remediation costs; loss of intellectual property protection; the loss of customer, supplier, or employee relationships; and damage to the Company’s reputation, any of which could have a material adverse effect the Company’s business. Although the Company maintains insurance coverage for various cybersecurity and business continuity risks, there can be no guarantee that all costs, damages, expenses or losses incurred will be fully insured nor reimbursed through insurance recoveries.

Read in the 10-K filed Feb 5, 2025 ↗

Privacy, cyber security, and data protection are becoming increasingly significant issues. To address these issues, the Standing Committee of the National People’s Congress promulgated the Cyber Security Law of the People’s Republic of China (the “Cyber Security Law”), which took effect on June 1, 2017. The Cyber Security Law sets forth various requirements relating to the collection, use, storage, disclosure and security of data, among other things. On June 10, 2021, the National People’s Congress passed the Data Security Law of the People’s Republic of China (the “Data Security Law”), which became effective on September 1, 2021. The Data Security Law is the first comprehensive data security legislation in China, which becomes a key supplement to the Cyber Security Law and aims to regulate a wide range of issues in relation to the collection, storage, processing, use, provision, transaction and publication of any kind of data. Various Chinese agencies are expected to issue additional regulations in the future to define these requirements more precisely. For example, the Personal Information Protection Law (“PIPL”), took effect on November 1, 2021. PIPL is aimed at protecting and controlling the use and transfer of personal data in China. There is significant uncertainty in how regulators will interpret and enforce the law, and it contains provisions that allow substantial government oversight and include fines for failure to obtain required approval from China’s cyber and data protection regulators for cross-border transfers of personal data.

Read in the 10-K filed Mar 3, 2025 ↗

Effective May 25, 2018, the European Union (“EU”) implemented the General Data Protection Regulation (“GDPR”), a broad data protection framework that expands the scope of EU data protection law to non-European Union entities that process, or control the processing of, the personal data of EU subjects. The GDPR allows for the imposition of fines and corrective action on entities that improperly use, disclose or secure the personal data of EU subjects, including through a data security breach. In addition, an increasing number of states in the U.S. have enacted laws containing similar requirements to the GDPR for businesses collecting or processing personal data. For example, the State of California enacted the California Consumer Privacy Act of 2018 (“CCPA”), which was significantly amended by the California Privacy Rights Act, and sets forth comprehensive privacy and security obligations regarding the collection and processing of personal data of eligible California residents. Other states have, or are expected to, enact similar or more expansive legislation regarding the collection and processing of personal data. These regulatory requirements may increase our costs of compliance. Any failure to fully comply with the Cyber Security Law, the Data Security Law, PIPL, GDPR, CCPA, and other applicable laws and regulations could lead to significant fines and regulatory corrective actions, along with reputational damage or third-party lawsuits, which could adversely affect our business and results of operations. In addition, data security breaches experienced by us could result in the loss of trade secrets or other intellectual property, public disclosure of sensitive commercial data, and the exposure of personal data (including sensitive personal data) of our employees, customers, suppliers and others. Such incidents could subject us to significant monetary damages, regulatory enforcement actions and/or criminal prosecution, and cause us to lose customers and their related revenue in the future.

Read in the 10-K filed Mar 3, 2025 ↗

In the United States, at the federal level, failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. In

Read in the 10-K filed Feb 21, 2025 ↗

addition, certain state laws govern privacy and security of personal information. For example, California has passed the CCPA and numerous other states have passed their own similar comprehensive consumer privacy laws. There are also states that are specifically regulating health information. Further, a small number of states have passed laws that regulate biometric data specifically. In addition, numerous states and the federal government are actively considering proposed legislation governing the protection of personal data. State laws are changing rapidly and there have been discussions in the U.S. Congress of new comprehensive federal data privacy laws to which we could become subject, if enacted.

Read in the 10-K filed Feb 21, 2025 ↗

The development and use of GenAI and other AI technologies (collectively, AI Technologies), along with an uncertain regulatory landscape, pose risks that could harm our reputation, expose us to liability or otherwise adversely affect our business. The integration of AI Technologies into our and our vendors’ systems (potentially without the vendor disclosing such use to us) subjects us to the risk that the providers of AI Technologies may not meet existing or rapidly evolving regulatory or industry standards with respect to privacy and data protection. Further, bad actors around the world use increasingly sophisticated methods, including the use of AI technologies, to engage in illegal activities involving the theft and misuse of personal information, confidential information and intellectual property. These factors may lead to breaches of security or privacy, reduced levels of service or experience, loss of intellectual property or exposure of confidential or proprietary information. Sophisticated cyber-attacks, including those using AI, could exacerbate these risks. Additionally, GenAI’s potential for producing false or misleading outputs, reflecting biases or generating content that may not be subject to IP protection or that infringes proprietary rights of others, poses additional risks to our business. Regulatory changes or reinterpretations could introduce new compliance risks, including potential government enforcement actions or civil lawsuits. Our competitors’ faster or more effective adoption of AI could also disadvantage us.

Read in the 10-K filed Feb 21, 2025 ↗

Many statutory requirements, both in the U.S. and abroad, include obligations for companies to notify individuals of security breaches involving certain personal information, which could result from breaches experienced by us or our vendors. For example, laws in all 50 U.S. states generally require businesses to provide notice under

Read in the 10-K filed Feb 10, 2025 ↗

In June 2024, the U.S. Supreme Court overturned the Chevron doctrine, ending judicial deference to regulatory agencies. This shift could significantly impact environmental regulation, consumer protection, advertising, privacy, artificial intelligence, and other regulatory frameworks we must comply with. This may impact our ability to operate our business in the manner in which we are accustomed and could negatively impact how we market our offerings, and could increase our regulatory compliance expense, which could in turn have a material adverse effect on our business, financial conditions, and results of operations. Political policies in the U.S., China, the U.K., Canada, and Europe may affect global trade, domestic purchasing, or create uncertainty. In recent years, the U.S. government has taken a new approach to trade policy, renegotiating or potentially terminating agreements and imposing tariffs, particularly on

Read in the 10-K filed Feb 7, 2025 ↗

The market for our model and data is new, rapidly evolving and increasingly competitive. We are expanding our business by offering technology-driven access to consultation and treatment options for new conditions, including telehealth options, but it is uncertain whether our offerings will achieve and sustain high levels of demand and market adoption. Our future financial performance depends in part on growth in this market, our ability to market effectively and in a cost-efficient manner, and our ability to adapt to emerging demands of existing and potential customers and the evolving regulatory landscape. It is difficult to predict the future growth rate and size of our target market. Negative publicity concerning telehealth generally, our offerings, customer success with our platform, or our market as a whole could limit market acceptance of our business model and services. If our customers do not perceive the benefits of our offerings, or if our offerings do not drive customer use and enrollment, then our market and our customer base may not continue to develop, or they may develop more slowly than we expect. Negative publicity regarding customer confidentiality and privacy in the context of telehealth could limit market acceptance of our business model and services.

Read in the 10-K filed Mar 28, 2025 ↗

In the course of offering personalized health and wellness recommendations, we collect a substantial amount of personalized health information. Numerous state and federal laws and regulations govern the collection, dissemination, use, privacy, confidentiality, security, availability, integrity and other processing of protected health information (PHI), and other types of personal information. For example, HIPAA establishes a set of national privacy and security standards for the protection PHI by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates with whom such covered entities contract for services, as well as their covered subcontractors. When we act in the capacity of a business associate under HIPAA, we execute business associate agreements with our clients.

Read in the 10-K filed Mar 28, 2025 ↗

In addition, HIPAA mandates that the Secretary of HHS conduct periodic compliance audits of HIPAA covered entities and business associates for compliance with the HIPAA privacy and security rules.

Read in the 10-K filed Mar 28, 2025 ↗

HIPAA further requires that patients be notified of any unauthorized acquisition, access, use or disclosure of their unsecured PHI that compromises the privacy or security of such information, with certain exceptions related to unintentional or inadvertent use or disclosure by employees or authorized individuals. HIPAA requires such notifications to be made “without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.” If a breach affects 500 patients or more, it must be reported to HHS without unreasonable delay, and HHS will post the name of the breaching entity on its public web site. Breaches affecting 500 patients or more in the same state or jurisdiction must also be reported to the local media. If a breach involves fewer than 500 people, the covered entity must record it in a log and notify HHS at least annually.

Read in the 10-K filed Mar 28, 2025 ↗

In addition to HIPAA, numerous other federal, state, and foreign laws and regulations protect the confidentiality, privacy, availability, integrity and security of health-related and other personal information. These laws and regulations in many cases are more restrictive than and may not be pre-empted by HIPAA and its implementing rules. These laws and regulations are often uncertain, contradictory, and subject to changed or differing interpretations, and we expect new laws, rules and regulations regarding privacy, data protection, and to be proposed and enacted in the future. Further, many state attorneys general are interpreting existing federal and state consumer protection laws to impose evolving standards for the online collection, use, dissemination and security of health-related and other personal information. Courts may also adopt the standards for fair information practices promulgated by the FTC, which concern consumer notice, choice, security and access. Consumer protection laws require us to publish statements that describe how we handle personal information and choices individuals may have about the way we handle their personal information. If such information that we publish is considered untrue, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Furthermore, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the FTC Act.

Read in the 10-K filed Mar 28, 2025 ↗

The proper functioning of our own information technology (IT) infrastructure is critical to the efficient operation and management of our business. We may not have the necessary financial resources to update and maintain our IT infrastructure, and any failure or interruption of our IT system could adversely impact our operations. In addition, our IT is vulnerable to cyberattacks, computer viruses, worms and other malicious software programs, physical and electronic break-ins, sabotage and similar disruptions from unauthorized tampering with our computer systems. We believe that we have adopted appropriate measures to mitigate potential risks to our technology infrastructure and our operations from these IT-related and other potential disruptions. However, given the unpredictability of the timing, nature and scope of any such IT failures or disruptions, we could potentially be subject to downtimes, transactional errors, processing inefficiencies, operational delays, other detrimental impacts on our operations or ability to provide products to our customers, the compromising of confidential or personal information, destruction or corruption of data, security breaches, other manipulation or improper use of our systems and networks, financial losses from remedial actions, loss of business or potential liability, and/or damage to our reputation, any of which could have a material adverse effect on our cash flows, competitive position, financial condition or results of operations.

Read in the 10-K filed Mar 28, 2025 ↗

As cybersecurity threats continue to increase in frequency and sophistication, and as the domestic and international regulatory and compliance structure related to information, cybersecurity, data privacy, resiliency and data usage becomes increasingly complex and exacting, we may be required to devote significant additional resources to strengthen our cybersecurity capabilities, and to identify and remediate any security vulnerabilities. Compliance with laws and regulations concerning cybersecurity, data privacy, resiliency and data usage could result in significant expense, and any failure to comply could result in proceedings against us by regulatory authorities or other third parties. Costs for bolstering cybersecurity capabilities, and increased cybersecurity and data privacy compliance costs, could adversely impact our business, financial condition and operating results. Additionally, our clients increasingly demand rigorous contractual, certification and audit provisions regarding cybersecurity, data protection and data usage, which may also increase our overall compliance burden and costs in meeting such obligations.

Read in the 10-K filed Feb 21, 2025 ↗

We have made, and are continuing to make, significant investments in AI including generative AI, to, among other things, develop new products or features for our existing products, including our anti-financial crime, equity trading, investor relations, sustainability and investment analytics solutions, and to enhance and refine our internal business operations. As AI is a new and evolving technology in the early stages of commercial use, there are significant risks involved in the development and deployment of AI, and there can be no assurance that the use of AI will enhance our products or services or augment our business or operating results. Market acceptance of AI technologies is uncertain, and we may be unsuccessful in our product development efforts. Moreover, our AI-related product initiatives and offerings, or use in our internal business operations, may give rise to risks related to harmful content, accuracy, bias, discrimination, intellectual property infringement, the ability to obtain intellectual property protection, misappropriation or leakage of intellectual property, defamation, data privacy, and cybersecurity, among others. In addition, these risks include the possibility of the introduction of new or enhanced laws or regulations or novel enforcement of existing laws to uses of AI, for which compliance may be costly and burdensome or involve changes to our business practices or products, litigation or other legal liability, or additional oversight, audits or enforcement under existing laws or regulations. The use of AI may also give rise to ethical concerns or negative public perceptions, which may cause brand or reputational harm. Additionally, our competitors may be developing their own AI products and technologies, which may be superior in features or functionality, or cost, to our offerings. Any of these factors could adversely affect our business, reputation, or operating results.

Read in the 10-K filed Feb 21, 2025 ↗

Laws and regulations regarding security and safeguarding of our systems and services, protection of sensitive customer data and the handling of personal data and information may affect our services or result in increased costs, legal claims or fines against us.

Read in the 10-K filed Feb 21, 2025 ↗

Our business operates certain systems that may be considered “critical infrastructure” under certain regulations and licenses or sells certain systems or services to customers that are used by customers in their role as providers of critical infrastructure or to fulfill certain core business requirements or process certain sensitive data. New cybersecurity, privacy, data sovereignty, and resiliency regulations may impact the requirements and cost of delivery for impacted systems and services and, in the event of an incident, increase the cost and complexity of our response and the potential financial and reputation impact from fines or private litigation. These regulations may also impact customer decision making and conditions on contracting for our services.

Read in the 10-K filed Feb 21, 2025 ↗

Our businesses and internal operations rely on the processing of data in many jurisdictions and the movement of data, including personal data, across national borders. Legal and contractual requirements relating to the processing, including, but not limited to, collection, storage, handling, use, disclosure, transfer and security, and brokering, of personal data continue to evolve and regulatory scrutiny and customer requirements in this area are increasing around the world. Significant uncertainty exists as privacy and data protection laws may be interpreted and applied differently across jurisdictions and may create inconsistent or conflicting requirements with privacy and other laws to which we are subject.

Read in the 10-K filed Feb 21, 2025 ↗

Laws and regulations such as the European Union and United Kingdom General Data Protection Regulation, the California Privacy Rights Act and other comparable laws and regulations adopted globally and within the United States and Canada can apply to our processing of their residents’ personal data by Nasdaq legal entities regardless of the location of such entities; such laws may also require our customers located in such jurisdictions to contractually obligate our compliance.

Read in the 10-K filed Feb 21, 2025 ↗

In addition to directly applying to some of our business activities, these laws and industry-specific regulations, such as the Health Insurance Portability and Accountability Act and the Gramm-Leach-Bliley Act, impact many of our customers, which may affect their decisions to purchase our services. As a supplier to such customers, regulators may engage in direct enforcement actions or seek to impose liability on us if we do not comply with applicable regulations. Our efforts to comply with privacy and data protection laws may entail substantial expenses, may divert resources from other initiatives and projects, and could impact the services that we offer. The enactment of more restrictive laws, rules or regulations, future enforcement actions or investigations, or the creation of new rights to pursue damages could impact us through increased costs or

Read in the 10-K filed Feb 21, 2025 ↗

Moreover, as we integrate AI into our operations, there may be increased cybersecurity and privacy risks, including the risk of unauthorized or misuse of AI tools, and threat actors may leverage AI to engage in automated, targeted and coordinated attacks against our systems.

Read in the 10-K filed Jul 17, 2025 ↗

These outcomes could damage our reputation, harm our business, and lead to significant liabilities. Additionally, a cybersecurity incident or loss of personal information has in the past and could in the future result in remediation costs, disruption of internal operations, increased cybersecurity protection costs, significant fines, and/or lost revenues.

Read in the 10-K filed Jun 9, 2025 ↗

In the U.S., there are numerous federal, state and local data privacy and security laws and regulations governing the collection, sharing, use, retention, disclosure, security, storage, transfer and other processing of personal information. At the federal level, we are subject to, among other laws and regulations, the rules and regulations promulgated under the authority of the Federal Trade Commission and the Gramm-Leach-Bliley Act. Moreover, the U.S. Congress has considered, and may in the future consider, various proposals for more comprehensive data privacy and security legislation, to which we may be subject if enacted. At the state level, we are subject to laws and regulations such as the CCPA. Numerous other states also have enacted, or are in the process of enacting or considering, comprehensive state-level data privacy and security laws and regulations that share similarities with the CCPA. Moreover, laws in all 50 U.S. states require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach.

Read in the 10-K filed Feb 24, 2025 ↗

In the ordinary course of business, we transfer personal data from Europe, China, and other jurisdictions to the United States or other countries. Certain jurisdictions have enacted data localization laws and cross-border personal data

Read in the 10-K filed Feb 26, 2025 ↗

the phase-out of support for third-party cookies and mobile identifiers, as well as platform and browser requirements, news blocking or bias and new privacy regulations, may also negatively impact digital advertising revenues. There can be no assurance that the Company will be able to successfully navigate the evolving digital advertising market or that its digital advertising revenues will be able to offset declines in advertising revenue from traditional media offerings.

Read in the 10-K filed Aug 6, 2025 ↗

Among other things, such laws generally: require disclosures about the data collection, use, and disclosure practices of covered businesses, and provide individuals expanded rights to access, delete, and correct their personal information, and opt out of certain sales or transfers of personal information.

Read in the 10-K filed Feb 5, 2025 ↗

Our obligations related to data privacy and security are quickly changing in an increasingly stringent fashion, creating some uncertainty as to the future legal framework governing such matters. Preparing for and complying with these obligations requires us to devote significant resources. These obligations may necessitate changes to our practices and to those of any third parties that process personal data on our behalf. In addition, these laws, rules, and regulations could also affect the acceptance of new communications technologies and the use of current communications technologies as advertising media.

Read in the 10-K filed Feb 5, 2025 ↗

In addition, the U.K. government enacted the U.K. Data (Use and Access) Act 2025 on June 19, 2025, which includes targeted amendments to the U.K.’s data protection regime that cause it to expressly deviate from the GDPR. This development creates new compliance challenges and has created uncertainty with respect to the European Commission’s adequacy determination regarding the U.K.’s data protection regime, which has been extended until December 2025 and must be renewed to permit ongoing relatively unrestricted data flows from the EEA to the UK.

Read in the 10-K filed Aug 29, 2025 ↗

The Utility also relies on complex information technology systems that allow it to create, collect, use, disclose, store, and otherwise process sensitive information, including the Utility’s financial information, customer energy usage and billing information, and personal information regarding customers, employees and their dependents, contractors, and other individuals, and portions of such sensitive information may be required to be encrypted by the Utility. In addition, the Utility is increasingly being required to disclose large amounts of data (including customer energy usage and personal information regarding customers) to support changes to California’s electricity market related to grid modernization and customer choice. The Utility often relies on third-party vendors to host, maintain, modify, and update its systems (including providing security updates), and to provide other services to the Utility or the Utility’s customers. These third-party vendors could cease to exist, fail to adopt and implement adequate processes to protect the Utility’s systems and information, fail to provide timely software updates (and even if timely provided, there could be a delay in the installation of the updates), fail to detect security vulnerabilities, or experience security incidents or inadequate security measures. Any such incidents or disruptions in the Utility’s information technology systems could impact the Utility’s ability to track or collect revenues and to maintain effective internal controls over financial reporting.

Read in the 10-K filed Feb 13, 2025 ↗

PG&E Corporation and the Utility are subject to federal and state privacy laws, which grant consumers rights and protections, including, among other things, the ability to opt out of receiving certain communications and data sharing with third parties.

Read in the 10-K filed Feb 13, 2025 ↗

Many different regulatory bodies govern our company. We are required to comply with securities laws; insurance regulations; employee benefit plan regulations; financial services regulations; U.S. and international tax regulations; environmental, social and governance (“ESG”) requirements; and cybersecurity and privacy regulations. Complying with the various regulations can increase our cost of doing business, limit our available capital or impact how we do business. We could also face potential fines or reputational risk if we do not comply. In addition, changes in tax laws can reduce sales of certain tax-advantaged products or increase our operating expenses. Changes in accounting standards may adversely impact reported results of operations and financial condition. Litigation and tax audits can increase costs and create adverse publicity.

Read in the 10-K filed Feb 19, 2025 ↗

We increasingly rely on services and products provided by many vendors in the United States and abroad. These include, for example, vendors of computer hardware and software and vendors of services. In the event that one or more of our vendors suffers a bankruptcy or otherwise becomes unable to continue to provide products or services or fails to protect personal information of our customers or employees, we may suffer operational impairments, reputational damage and financial losses.

Read in the 10-K filed Feb 19, 2025 ↗

misuse of customer, third-party payor, employee, supplier, or Company data, could result in significant costs, lost sales, fines, lawsuits, and damage to our reputation. In addition, as the regulatory environment related to information security, data collection and use, and privacy becomes increasingly rigorous, with new and constantly changing requirements applicable to our business, compliance with those requirements could also result in additional costs.

Read in the 10-K filed Feb 21, 2025 ↗

The GDPR applies to the transfer and processing of personal data of those who live in the EU or UK, respectively. As interpretation and enforcement of the GDPR evolves, it creates a range of new compliance obligations, which could cause us to incur additional costs. Failure to comply could result in significant penalties that may materially adversely affect our business, reputation, results of operations and cash flows.

Read in the 10-K filed Feb 21, 2025 ↗

The CCPA, which came into effect on January 1, 2020, gives California residents specific rights in relation to their personal information, requires that companies take certain actions, including notifications for security incidents and may apply to activities regarding personal information that is collected by us, directly or indirectly, from California residents. As interpretation and enforcement of the CCPA evolves, it creates a range of new compliance obligations, with the possibility for significant financial penalties for noncompliance that may materially adversely affect our business, reputation, results of operations and cash flows.

Read in the 10-K filed Feb 21, 2025 ↗

Comprehensive privacy laws with some similarities to the CCPA have been proposed or passed at the U.S. federal and state levels, such as the Colorado Privacy Act. Additionally, the Federal Trade Commission and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination and security of data as well as requiring disclosures about these practices. Existing and potential future data privacy laws pose increasingly complex compliance challenges and potentially elevate our costs. Any failure by us to comply with these laws and regulations, including as a result of a security or privacy breach, could result in significant penalties and liabilities for us. Additionally, if we acquire a company that has violated or is not in compliance with applicable data protection laws, we may incur significant liabilities and penalties as a result.

Read in the 10-K filed Feb 21, 2025 ↗

development or marketing of certain products or services, or increase the costs of offering them to customers. For more information concerning our legal and regulatory obligations with respect to privacy and cybersecurity, please see the “Privacy and Cybersecurity” discussion within Item 1. “Business” and the “Technology Risks” discussion within in Item 1. “Risk Factors.”

Read in the 10-K filed Feb 21, 2025 ↗

customers and licensing partners due to forced closures or other operational restrictions, such as reduced capacity limits and operating hours, declines in tourism, and/or potential changes in consumer behavior and shopping preferences, such as their willingness to congregate in shopping centers or other populated locations and the overall growing preference to shop online versus at traditional brick and mortar locations; (iv) potential declines in the level of consumer purchases of discretionary items and luxury retail products, including our products, caused by higher unemployment and lower disposable income levels, inflationary pressures, travel and social gathering restrictions, work-from-home arrangements, or other factors beyond our control; (v) the potential build-up of excess inventory as a result of store closures and/or lower consumer demand; (vi) temporary closures or other operational restrictions of our distribution centers and/or corporate facilities; (vii) our ability to attract, retain, and manage employees; (viii) additional costs to protect the health and safety of our employees, customers, and communities, such as more frequent and thorough cleanings of our facilities and supplying personal protection equipment; (ix) the potential loss of one or more of our significant wholesale customers or licensing partners, or the loss of a large number of smaller wholesale customers or licensing partners, if they are not able to withstand prolonged periods of adverse economic conditions, and our ability to collect outstanding receivables; (x) increased vulnerability to data security or privacy breaches as a result of remote working arrangements; (xi) our ability to successfully negotiate with landlords to obtain rent abatements, rent deferrals, and other relief; (xii) our ability to access capital markets and maintain compliance with covenants associated with our existing debt instruments, as well as the ability of our key customers, suppliers, and vendors to do the same with regard to their own obligations; (xiii) our ability to generate sufficient cash flows to support our operations, including repayment of our debt obligations as they become due, as well as to return value to our shareholders in the form of dividend payments and repurchases of our common stock; (xiv) diversion of management attention and resources from ongoing business activities and/or a decrease in employee morale; and (xv) our ability to maintain an effective system of internal controls and compliance with the requirements under the Sarbanes-Oxley Act of 2002.

Read in the 10-K filed May 22, 2025 ↗

Our business and financial performance may be adversely affected by cyber-attacks on information technology (IT) infrastructure and products, as well as changes in cybersecurity regulations. Our business may be impacted by disruptions to our own or third-party IT infrastructure, and the products and services that we provide our customers are also at risk of being adversely affected by cyber-attacks. Like other companies, we regularly experience cyber-based attacks. Cybersecurity threats are continuously evolving and may have an impact on our customers, suppliers, subcontractors, and other third parties with whom we do business routinely, both on premises and in the cloud, attempting to gain unauthorized access to our confidential, proprietary, or otherwise protected information, classified information, or personal data or other information relating to our employees, customers, and other third parties, or to disrupt our systems or the systems of third parties. Cybersecurity threats also include attacks targeting the security, confidentiality, integrity, and/or availability of the hardware, software, and information installed, stored, or transmitted in our products, including after the purchase of those products and when they are

Read in the 10-K filed Feb 3, 2025 ↗

SharpLink’s collection, storage and use of personal data are subject to applicable data protection and privacy laws, and any failure to comply with such laws may harm our reputation and business or expose SharpLink to fines and other enforcement action.

Read in the 10-K filed Mar 14, 2025 ↗

In the ordinary course of business, SharpLink collects, stores, uses and transmits certain types of information that are subject to different laws and regulations. In particular, data security and data protection laws and regulations relating to personal and consumer information that we are, or may become subject to, often vary significantly by jurisdiction and are evolving significantly as legislators and regulators continue to grapple with policy considerations surrounding the collection and use of data. Compliance with such data protection and privacy laws will require significant time and expense, particularly as we continue to expand our businesses across multiple jurisdictions.

Read in the 10-K filed Mar 14, 2025 ↗

For example, California has enacted the California Consumer Privacy Act, or CCPA, which became effective on January 1, 2020. The CCPA requires new disclosures to California consumers, imposes new rules for collecting or using information, requires companies to comply with data subject access and deletion requests, and affords California consumers new abilities to opt out of certain disclosures of personal information. It remains unclear what, if any, regulations will be implemented pursuant to the law or how it will be interpreted. The Stop Hacks and Improve Electronic Data Security Act, otherwise known as the SHIELD Act, is a New York State bill, the data protection portions of which became effective on March 23, 2020. The SHIELD Act requires companies to adopt reasonable safeguards to protect the security, confidentiality, and integrity of private information. A company should implement a data security program containing specific measures, including risk assessments, employee training, vendor contracts, and timely data disposal. The effects of the CCPA and the SHIELD Act potentially are significant and may require us and our clients to modify data collection or processing practices and policies and to incur substantial costs in an effort to comply.

Read in the 10-K filed Mar 14, 2025 ↗

In addition, the new EU-wide General Data Protection Regulation, or GDPR, became applicable on May 25, 2018, replacing the data protection laws of each EU member state. The GDPR implemented more stringent operational requirements for processors and controllers of personal data, including, for example, expanded disclosures about what and how personal information is to be used, limitations on retention of information, increased requirements to erase an individual’s information upon request, mandatory data breach notification requirements and higher standards for data controllers to demonstrate that they have obtained valid consent from individuals to process their personal data (or reliance on another appropriate legal basis) for certain data processing activities. It also significantly increased penalties for noncompliance, including where the Company may act as a data processor.

Read in the 10-K filed Mar 14, 2025 ↗

Although we continue to review and improve our policies and procedures with respect to data protection and privacy to ensure compliance with applicable laws, rules and regulations, if our privacy or data security measures fail to comply with applicable current or future laws and regulations, we may be subject to fines, litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data or our marketing practices, or other liabilities, such as compensation claims by individuals affected by a personal data breach, as well as negative publicity and a potential loss of business. Compliance with data protection and privacy laws and regulations will become more complex, time intensive and costly as we grow, particularly when we begin to rely on the movement of data across national boundaries.

Read in the 10-K filed Mar 14, 2025 ↗

There is no assurance that the time and resources expended on pursuing a particular acquisition or strategic investment opportunity will result in a completed transaction, or that any completed transaction will ultimately be successful. In addition, the assumptions we use to evaluate investment and acquisition opportunities may not prove to be accurate, and intended benefits may not be realized. Our due diligence investigations may fail to identify all of the issues, liabilities or other challenges associated with an acquired business, which could result in increased risk of unanticipated or unknown issues or liabilities, including with respect to privacy, competition and other regulatory matters, and our mitigation strategies for such risks that are identified may not be effective. Further, we may be unable to identify suitable acquisition or strategic investment opportunities, or may be unable to obtain any required financing or regulatory approvals, and therefore may be unable to complete such acquisitions or strategic investments on favorable terms, if at all. We may decide to pursue acquisitions with which our investors may not agree, and we cannot assure you that any acquisition or investment will be successful or otherwise provide a favorable return on investment.

Read in the 10-K filed Mar 14, 2025 ↗

Any compromise or breach of our security measures, or those of our third-party service providers, could violate applicable privacy, data protection, data security, network and information systems security and other laws and cause significant legal and financial exposure, adverse publicity and a loss of confidence in our security measures, which could have a material adverse effect on our business, financial condition, results of operations and prospects. We continue to devote significant resources to protect against security breaches or we may need to in the future to address problems caused by breaches, including notifying affected users and responding to any resulting litigation, which in turn, diverts resources from the growth and expansion of our business.

Read in the 10-K filed Mar 14, 2025 ↗

Erosion of trust in our brand value can be caused by isolated or recurring incidents originating both from us or our business partners, or from external events. Such incidents can potentially trigger boycotts of our stores or result in civil or criminal liability, which can have a negative impact on our financial results. Incidents that can erode trust in our brand value include actual or perceived breaches of privacy or violations of domestic or international privacy laws, contaminated food, product recalls, store employees or other food handlers infected with communicable diseases, safety-related incidents, or other potential incidents discussed in this risk factors section. The impact of such incidents may be exacerbated if they receive considerable publicity, including rapidly through social or digital media (including for malicious reasons), or if they result in litigation. Negative postings or comments on social media or networking websites about Starbucks, even if inaccurate or malicious, have in the past, and could in the future, generate negative publicity about Starbucks across media channels that could damage the value of our brand. It may be difficult to address such negative publicity, including as a result of fictitious media content (such as content produced by generative artificial intelligence or bad actors) across media channels. Additionally, consumer demand for our products and our brand value could diminish significantly if we, our employees, licensees, or other business partners fail to preserve the quality of our products, act or are perceived to act in an unethical, illegal, racially-biased, unequal, inequitable, or socially irresponsible manner, including with respect to the sourcing, content, or sale of our products, service and treatment of customers at Starbucks stores, treatment of employees, including our responses to unionization efforts, or the use of customer data for general or direct marketing or other purposes. Allegations, even if untrue, that we are not respecting internationally recognized human rights, are failing to comply with applicable workplace and labor laws, or are aligned with positions on social or geopolitical issues could also negatively impact our brand value. Additionally, if we fail to comply with laws and regulations, take controversial positions or actions, fail to deliver a consistently positive consumer experience in each of our markets, including by failing to invest in the right balance of wages and benefits to attract and retain employees who represent the brand well, or fail to foster an inclusive and diverse environment, our brand value may be diminished. In addition, we cannot ensure that our store partners, licensees, or other business partners will not take actions that adversely affect the value and relevance of our brand.

Read in the 10-K filed Nov 20, 2024 ↗

•data privacy and cybersecurity risks unique to the conduct of business in China; and

Read in the 10-K filed Nov 20, 2024 ↗

In addition, our business is subject to complex and rapidly evolving U.S. and international laws and regulations regarding data privacy and data protection, and companies are under increased regulatory scrutiny relating to these matters. The Federal Trade Commission and many state attorneys general are also interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination, and security of data. The interpretation and application of existing laws and regulations regarding data privacy and data protection are in flux, and authorities around the world are considering a number of additional legislative and regulatory proposals in this area. Current and future data privacy and data protection laws and regulations (including the General Data Protection Regulation and the California Consumer Privacy Act, discussed in more detail in this risk factors section, and other applicable international and U.S. privacy laws), or new interpretations of existing laws and regulations, may limit our ability to collect and use data, require us to otherwise modify our data processing practices and policies, or result in the possibility of fines, litigation, or orders, which may have an adverse effect on our business and

Read in the 10-K filed Nov 20, 2024 ↗

We have been, and in the future may be, subject to litigation and other legal proceedings that may adversely affect our business. These legal proceedings may involve claims brought by store partners, customers, government agencies, suppliers, shareholders, or others through private actions, administrative proceedings, regulatory actions, or other litigation, including litigation on a class or collective basis on behalf of what can be a large group of potential claimants. These legal proceedings have involved, and in the future may involve, allegations of illegal, unfair, or inconsistent employment practices, including those governing wage and hour, employment of minors, discrimination, harassment, wrongful termination, and vacation and family leave laws; food-safety issues including food-borne illness, food contamination, and adverse health effects from consumption of our food products; data security or privacy breaches; customer discrimination; personal injury in our stores; marketing and advertising claims, including claims that our environmental and social program claims are misleading or inaccurate; infringement of patent, copyright, or other intellectual property rights; violation of the federal securities laws; workers’ compensation; or other concerns. We are party to a number of pending lawsuits and governmental audits alleging violations of federal and state employment laws, including wage and hour claims, and we could be involved in similar or even more significant litigation and legal proceedings in the future. Even if the allegations against us in current or future legal matters are unfounded or we ultimately are held not liable, the costs to defend ourselves may be significant, and the litigation may subject us to substantial settlements, fines, penalties, or judgments against us and may divert management’s attention away from operating our business, all of which could negatively impact our financial condition and results of operations. Litigation also may generate negative publicity, regardless of whether the allegations are valid or we ultimately are not liable, which could damage our reputation and adversely impact our sales as well as our relationships with our store partners and customers. See Note 16, Commitments and Contingencies, to the consolidated financial statements included in Item 8 of Part II of this 10-K for information regarding certain legal proceedings in which we are involved.

Read in the 10-K filed Nov 20, 2024 ↗

Complex local, state, national, foreign, and international laws and regulations apply to the collection, use, retention, protection, disclosure, transfer, and other processing of personal data. These privacy and data protection laws and regulations are quickly evolving, with new or modified laws and regulations proposed and implemented frequently and existing laws and regulations subject to new or different interpretations and increased enforcement and litigation. In addition, our legal and regulatory obligations are subject to unexpected changes, including the potential for regulatory or other governmental entities to enact new or additional laws or regulations, to issue rulings that invalidate prior laws or regulations, or to increase penalties significantly. Complying with these laws and regulations can be costly and can impede the development and offering of new products and services.

Read in the 10-K filed Nov 20, 2024 ↗

For example, Europe’s General Data Protection Regulation (“GDPR”) and the U.K. General Data Protection Regulation (which implements the GDPR into U.K. law), impose stringent data protection requirements and provide for significant penalties for noncompliance. In China, the Personal Information Protection Law (“PIPL”) has established personal information processing rules, data subject rights, and obligations for personal information processors, among other things. In addition to the PIPL, China’s Data Security Law regulates data processing activities associated with personal and non-personal data. Noncompliance with these laws may result in significant civil and criminal penalties. Other newly enacted and proposed privacy and data protection laws in other jurisdictions served by Starbucks and its licensees may impose similar requirements, including restrictions on cross-border data transfers and stringent safeguards on personal and non-personal data. Such laws may impact our business operations and increase the cost and expense of compliance.

Read in the 10-K filed Nov 20, 2024 ↗

In the United States, the California Consumer Privacy Act (“CCPA”) requires, among other things, covered companies to provide new disclosures to California consumers and allows such consumers to exercise certain rights in connection with their personal information, such as the right to opt-out of certain sales of personal information. The CCPA also provides for civil penalties for violations as well as a private right of action for data breaches that may increase data breach litigation. Further, the California Privacy Rights Act, which became effective in January 2023, significantly modified the CCPA to include additional compliance obligations. Since the CCPA was first passed, 19 other states have enacted similar data privacy legislation, eight of which are in effect as of the end of 2024. In addition, a number of other states have passed or are considering additional privacy laws, including laws on health data and biometric data that are in effect, or are expected to take effect in the near future. These state privacy laws will require us to incur additional costs and expenses in our efforts to comply.

Read in the 10-K filed Nov 20, 2024 ↗

Our failure to comply with applicable laws and regulations or other obligations to which we may be subject relating to personal data, or to protect personal data from unauthorized access, use, or other processing, could result in enforcement actions and regulatory investigations against us, claims for damages by customers and other affected individuals or parties, or fines and damage to our brand reputation, any of which could have a material adverse effect on our operations, financial performance, and business. The amount and scope of insurance we maintain may not cover all types of claims that may arise.

Read in the 10-K filed Nov 20, 2024 ↗

Such security breaches also could result in a violation of applicable U.S. and international privacy, cyber, and other laws or trigger data breach notification laws, including new disclosure rules promulgated by the SEC, and subject us to private consumer, business partner or licensee, or securities litigation and governmental investigations and proceedings, any of which could result in our exposure to material civil or criminal liability. These risks also exist in acquired businesses, joint ventures, or companies we invest in or partner with that use separate information systems or that have not yet been fully integrated into our information systems.

Read in the 10-K filed Nov 20, 2024 ↗

Unauthorized access to or modification of, or actions disabling our ability to obtain authorized access to, our customers’ data, other external data, personal data, or our own data, as a result of a cyber incident, attack or exploitation of a security vulnerability, or loss of

Read in the 10-K filed Jan 22, 2025 ↗

Public health crises may negatively impact our workforce and operations, as well as those of our strategic partners, customers, suppliers and logistics providers. Impacts of public health crises may include, without limitation, closures of our manufacturing facilities; under-absorbed overhead; increased logistics, component and other costs; decreased demand for our products; and manufacturing challenges. Employee infections or government restrictions to contain the spread of infectious disease, like travel restrictions, quarantines, business shutdowns, or trade controls, could harm employees’ productivity and hinder operations in Flash Ventures’ factories or our other worksites and our business and results of operations as a whole. Further, global pandemics and other public health crises may cause financial market instability, credit issues, and increased cybersecurity and data privacy risks as more employees work remotely. The degree to which any public health crises ultimately impact our business will depend on many factors beyond our control, which are highly uncertain and cannot be predicted at this time.

Read in the 10-K filed Aug 21, 2025 ↗

•Data Privacy and Cybersecurity Laws - Because Solventum is a business with a significant global footprint, compliance with evolving regulations and standards in data privacy and cybersecurity may result in increased costs, compliance challenges and the threat of increased regulatory enforcement activity. Solventum’s business relies on the secure electronic transmission, storage and hosting of sensitive information, including personal information, protected health information, financial information, intellectual property and other sensitive information related to our customers

Read in the 10-K filed Feb 28, 2025 ↗

In the ordinary course of business, Solventum relies on centralized and local information technology networks and systems, some of which are provided, hosted or managed by vendors and other third parties, to process, transmit and store electronic information, and to manage or support a variety of businesses. That technology includes systems that could be used to process, transmit and store sensitive information, including personal information, protected health information, employee data, financial

Read in the 10-K filed Feb 28, 2025 ↗

•Failure to comply with privacy and data protection requirements could result in significant penalties. The EU’s comprehensive General Data Privacy Regulation (“GDPR”), for example, is a comprehensive regulation applying across all EU member states, providing for penalties of up to the greater of €20 million or 4% of worldwide revenue, and the average GDPR penalties increased in 2023 compared to prior years.

Read in the 10-K filed Feb 11, 2025 ↗

The swift pace of technological change has led to a nonuniform and complex set of cybersecurity and data privacy laws, regulations, and standards. Meanwhile, the recent proliferation and rapid evolution of AI

Read in the 10-K filed Apr 23, 2025 ↗

Demand from Chinese customers may be adversely affected by China’s evolving laws and regulations, including those relating to taxation, import and export tariffs and restrictions, currency controls, environmental regulations, privacy and information

Read in the 10-K filed Nov 15, 2024 ↗

When cybersecurity or other technology related incidents occur, we follow our incident response protocols and address them in accordance with applicable governmental regulations and other legal requirements. Our response to these incidents and our investments to protect our product offerings and information technology infrastructure and data may not shield us from significant losses and potential liability or prevent any future interruption or breach of our systems. Moreover, given the increasing complexity and sophistication of the techniques used by threat actors to obtain unauthorized access or disable or degrade systems, a cyberattack could occur and persist for an extended period of time before being detected, and we may not anticipate these acts or mitigate them adequately or timely, which may compound damages before the incident is discovered or remediated. The extent of a particular cyber incident and the steps that we may need to take to investigate the incident may not be immediately clear, and it may take a significant amount of time before such investigation can be completed and full and reliable information about the incident is known. New regulations may require us to disclose information about a material cybersecurity incident before it has been resolved or fully investigated. Additionally, as threats continue to evolve and increase, and as the regulatory environment and customer requirements related to information security, data collection and use, and privacy become increasingly rigorous, we may be required to devote significant additional resources to modify and enhance our security controls and to identify and remediate any security vulnerabilities, which could adversely impact our net income. In addition, a significant number of our employees working remotely has exposed us, and may continue to expose us, to greater risks related to cybersecurity and cyber-liability.

Read in the 10-K filed Feb 12, 2025 ↗

Our insurance program may not be adequate to cover future losses: We maintain third-party insurance to cover our exposure to certain property and casualty losses and are self-insured for claims and expenses related to other property and casualty losses, including product liability, intellectual property infringement and enforcement, environmental, and cybersecurity and data privacy losses. We manage a portion of our exposure to self-insured losses through a wholly-owned captive insurance company. Insurance coverage limits provided by third-party insurers and/or our captive insurance company may not be sufficient to fully cover certain losses we may experience.

Read in the 10-K filed Feb 12, 2025 ↗

Our use of AI and other emerging technologies could adversely impact our business and financial results: We have begun to deploy AI and other emerging technologies in various facets of our operations and we continue to explore further use cases. The rapid advancement of these technologies presents opportunities for us in research, manufacturing, commercialization, and other business endeavors, but also entails risks, including that AI-generated content, analyses, or recommendations we utilize could be deficient, that our competitors may more quickly or effectively adopt AI capabilities, or that our use of AI or other emerging technologies increases regulatory, cybersecurity and other significant risks. In addition, any disruption or failure in the AI functionality we incorporate into our business activities, products or services could adversely impact our business or result in delays or errors in our product offerings. The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including in the areas of intellectual property, cybersecurity and privacy and data protection. Compliance with new or changing laws, regulations or industry standards relating to AI may impose significant costs on us and limit our ability to effectively develop, deploy or use AI technologies. Furthermore, if we are unable to effectively manage the use of AI technologies by our employees and service providers, our confidential information, intellectual property and reputation could be put at risk. Failure to appropriately respond to this evolving landscape may result in reputational, competitive and business harm as well as litigation and regulatory action and fines, penalties and expenses related thereto.

Read in the 10-K filed Feb 12, 2025 ↗

We are subject to privacy, data protection and data security regulations and laws globally, and could face substantial penalties if we fail to comply with such regulations and laws: We are subject to a variety of laws and regulations globally regarding privacy, data protection, and data security, including those related to the collection, storage, handling, use, disclosure, transfer and security of personally identifiable healthcare information. For example, in the United States, privacy and security regulations under the Health Insurance Portability and Accountability Act of 1996, including the expanded requirements under the Health Information Technology for Economic and Clinical Health Act of 2009, establish comprehensive standards with respect to the use and disclosure of protected health information (PHI), by covered entities, in addition to setting standards to protect the confidentiality, integrity and security of PHI. Regulators are also imposing new data privacy and security requirements, including new and greater monetary fines for privacy violations. For example, the European Union’s General Data Protection Regulation (GDPR) established rules regarding the handling of personal data. Non-compliance with the GDPR may result in monetary penalties of up to 4% of total company revenue. Various U.S. states and other governmental authorities around the world have imposed or are considering similar types of laws and regulations, data breach reporting and penalties for non-compliance and increasing security requirements. These laws and regulations are broad in scope and are subject to evolving interpretation and enforcement and we have in the past been, and in the future could be, required to incur substantial costs to monitor compliance or to alter our practices. As new privacy-related laws and regulations are implemented, the time and resources needed for us to comply with such laws and regulations, as well as our potential liability for non-compliance and reporting obligations in the case of data breaches, have increased and may further increase.

Read in the 10-K filed Feb 12, 2025 ↗

comply with data privacy laws can result in substantial fines or penalties, legal liability and / or reputational damage and litigation.

Read in the 10-K filed Aug 22, 2025 ↗

In the UK and Europe, the General Data Protection Regulation (the GDPR) places stringent requirements on companies when handling personal data and local regulatory guidance continues to evolve. For instance, in the UK, the adoption of the Data Use and Access Act may require more localized data storage facilities and could impact how we segregate personal data between markets. There also continues to be a growing trend of other countries adopting similar laws which we will have to assess and understand in order to implement required changes.

Read in the 10-K filed Aug 22, 2025 ↗

Additionally, both the GDPR and the California Consumer Privacy Act of 2018 (the CCPA) are continuously evolving and developing and may be interpreted and applied differently from jurisdiction to jurisdiction and may create inconsistent or conflicting requirements. For example, the California Privacy Rights Act (the CPRA) modifies the CCPA significantly, further enhancing and extending an individual’s rights over their personal data and the obligations placed on companies that handle this data. The resulting new regulations became effective on January 1, 2023. Most notably, employee and business data were brought into scope, which raises the compliance requirements for us significantly, in terms of internal controls, processes and governance requirements.

Read in the 10-K filed Aug 22, 2025 ↗

•compliance with non-U.S. data protection laws, including the EU General Data Protection Regulation (“GDPR”) in the European Union and the Personal Information Protection Law in China;

Read in the 10-K filed Feb 21, 2025 ↗

–cybersecurity, data protection and privacy, such as to comply with, or fines and penalties related to, General Data Protection Regulation in the European Union and the California Consumer Privacy Act;

Read in the 10-K filed Apr 2, 2025 ↗

types, including phishing and other attempts to breach or gain unauthorized access to our systems. As artificial intelligence becomes increasingly integrated into business systems, concerns about data exposure and privacy risks are intensifying. Additionally, artificial intelligence is being used to carry out advanced social engineering attacks, increasing potential for harm. To date, these attacks have not had a material impact on our operations, but we cannot provide assurance that cyber-attacks will not have a material impact in the future.

Read in the 10-K filed Aug 14, 2025 ↗

Furthermore, we are required to comply with laws and regulations that require us to maintain security measures designed to protect personal information and we may have contractual and other legal obligations to notify customers, regulators, government agencies, impacted individuals or other relevant stakeholders of security breaches. Such disclosures are costly, and the disclosures or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. Consequences associated with such security incidents may include: government enforcement actions and other actions or proceedings (for example, investigations, audits, and inspections), and related fines, penalties, required remedial actions, or other obligations and liabilities; additional reporting requirements and/or oversight; restrictions on processing or transferring data (including personal data); claims, demands, and litigation (including class claims); indemnification obligations; monetary fund diversions; interruptions in our operations (including availability of data); financial loss and other similar harms. Actual and perceived security incidents and attendant consequences could also lead to negative publicity and reputational harm, may cause our customers to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or mitigate the security incident. Accordingly, if our cybersecurity measures or those of our third-party service providers fail to protect against unauthorized access, attacks (which may include sophisticated cyberattacks), or if our employees or contractors compromise or mishandle data, then our reputation, customer trust, business, results of operations and financial condition could be adversely affected.

Read in the 10-K filed Feb 26, 2025 ↗

While we maintain errors, omissions and cyber liability insurance policies covering certain security and privacy damages, we cannot be certain that our existing insurance coverage will continue to be available on acceptable terms or will be

Read in the 10-K filed Feb 26, 2025 ↗

We and our customers are subject to numerous domestic (for example, the California Consumer Privacy Act (“CCPA”)) and foreign (for example, the General Data Protection Regulation (“GDPR”) in the European Union (“EU”)) privacy, data protection and cybersecurity laws and regulations that restrict the collection, use, disclosure and processing of personal information, including financial and health data. These laws and regulations are expanding globally, evolving, and being tested in courts, may result in increasing regulatory and public scrutiny of our practices relating to personal information and may increase our exposure to regulatory enforcement action, sanctions and litigation. The breadth and depth of changes in data protection obligations has required significant time and resources, including a review of our technology and systems against the requirements of the GDPR.

Read in the 10-K filed Feb 26, 2025 ↗

The CCPA (as amended by the California Privacy Rights Act of 2020) imposes obligations on businesses to which it applies. These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents (both consumers and employees) certain rights related to their personal information. The CCPA allows for statutory fines for noncompliance. Similar laws have been enacted in 18 other states with 13 laws currently in effect and the remainder becoming effective later in 2025 and 2026. Numerous other states, and the U.S. federal government, also have proposed general privacy legislation recently. Additionally, other states have proposed, and in certain cases enacted, other laws and regulations addressing privacy and cybersecurity, such as Washington’s My Health, My Data Act, which includes a private right of action. If we become subject to new privacy, data protection or cybersecurity laws, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase, including individuals, via a private right of action, and state actors.

Read in the 10-K filed Feb 26, 2025 ↗

Outside the United States, an increasing number of laws, regulations, and industry standards apply to privacy, data protection and cybersecurity. For example, the GDPR, the United Kingdom’s General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”) and the Swiss Federal Act on Data Protection, impose strict requirements for processing the personal information of individuals protected by the legislation, whether their data is processed within or outside the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland, respectively (such jurisdictions, collectively, “Europe”). For example, the GDPR imposes significant requirements regarding the processing of individuals’ personal information, including in relation to transparency, lawfulness of processing, individuals’ privacy rights, compliant contracting, data minimization, data breach notification, data re-usage, data retention, security of processing and international data transfers. Under the GDPR and UK GDPR, government regulators may impose temporary or definitive bans on data processing or data transfers, require a company to delete data, as well as impose significant fines, potentially ranging up to 20 million Euros under the GDPR, 17.5 million GBP under the UK GDPR, or 4% of a company’s worldwide revenue, whichever is higher. Further, individuals may initiate compensation claims or litigation related to our processing of their personal information. Other privacy and data protection laws in Europe impose strict requirements around marketing communications and the deployment of cookies on users’ devices. As another example, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018) may apply to our operations. The LGPD broadly regulates processing of personal information of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the GDPR. Additionally, we expect an increase in the regulation of the use of AI and ML in products and services. For example, in Europe, the Artificial Intelligence Act (“AI Act”), once effective, will impose onerous obligations related to the development, placing on the market and use of AI-related systems. In the United States, numerous states have established study commissions that could lead to regulation of AI, and certain states have enacted legislation regulating aspects of AI. Other countries also are contemplating laws regulating AI and ML. We may have to change our business practices to comply with obligations under these or other new and evolving regimes.

Read in the 10-K filed Feb 26, 2025 ↗

Similarly, with our registration as an interconnected VoIP provider for certain products with the Federal Communications Commission (“FCC”), we also must comply with privacy laws associated with customer proprietary network information rules in the United States. In addition, states such as California have increasingly adopted or proposed, or may propose, regulations that may classify our services in such a manner as to subject us to additional privacy-related compliance obligations under state law. If we fail or are perceived to have failed to maintain compliance with these requirements, we could be subject to regulatory audits or inquiries, civil and criminal penalties, fines and breach of contract claims, as well as reputational damage, which could impact the willingness of customers to do business with us.

Read in the 10-K filed Feb 26, 2025 ↗

Evolving laws, regulations, and other actual and asserted obligations relating to privacy, data protection, and cybersecurity, as well as any new or evolving obligations relating to the use of AI and ML technologies, could reduce demand for our platform, increase our costs, impair our ability to grow our business, or restrict our ability to store and process data or, in some cases, impact our ability to offer our service in some locations and may subject us to liability. Further, in view of new or modified federal, state or foreign laws and regulations, industry standards, contractual obligations and other actual and asserted obligations, or any changes in their interpretation, we may find it necessary or desirable to fundamentally change our business activities and practices or to expend significant resources to modify our practices and platform and otherwise adapt to these changes. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited.

Read in the 10-K filed Feb 26, 2025 ↗

As a provider of communications products, we are subject to existing or potential FCC and state regulations relating to privacy, telecommunications, consumer protection and other requirements. In addition, the extension of telecommunications regulations to our non-interconnected VoIP services could result in additional federal and state regulatory obligations and taxes. We are also in discussions with certain jurisdictions regarding potential sales and other taxes for prior periods that we may owe. In the event any of these jurisdictions disagree with management’s assumptions and analysis, the assessment of our tax exposure could differ materially from management's current estimates, which may increase our costs of doing business and negatively affect the prices our customers pay for our services. If we do not comply with FCC rules and regulations, we could be subject to FCC enforcement actions, fines, loss of licenses and possibly restrictions on our ability to operate or offer certain of our products. For example, in 2023, we received a “cease-and-desist” letter from the FCC related to reported fraudulent traffic on our messaging platform. We subsequently removed the identified traffic and sent a follow-up letter to the agency detailing our fraud mitigation practices and various planned improvements to reduce future risks. Any enforcement action by the FCC, which may be a public process, would hurt our reputation in the industry, could erode customer trust, possibly impair our ability to sell our VoIP, other telecommunications products and/or other services to customers and could adversely affect our business, results of operations and financial condition.

Read in the 10-K filed Feb 26, 2025 ↗

to implement, additional costly, technical and organizational measures designed to protect the privacy and security of each of our patient’s health and related financial information, and other personal information.

Read in the 10-K filed Feb 26, 2025 ↗

Our business relies on the processing of data across national borders. Legislators and regulators around the world are increasingly adopting or revising privacy, data protection, data management, data transfer, AI and cybersecurity laws and regulations. For example, our ongoing efforts to comply with complex U.S. and international privacy and data protection laws may increase the complexity of our compliance operations, entail substantial expenses, divert resources from other initiatives and projects, require us to modify our data processing practices, policies or services, and adversely impact our business. In addition, privacy laws in numerous jurisdictions, including but not limited to the U.S., China, India, Australia, New Zealand, Brazil, Kingdom of Saudi Arabia, Hong Kong and Japan, have established specific legal requirements for cross-border transfers of personal information and substantial compliance and audit obligations. Certain countries have also established specific legal requirements for data localization, such as where personal data must remain stored in the country. The global proliferation of new privacy and data protection laws may lead to inconsistent and conflicting requirements or legal interpretations, which create an uncertain regulatory environment. Noncompliance could also result in regulatory penalties and significant legal liability. Enforcement actions and investigations by regulatory authorities into companies related to data security incidents and privacy violations are generally increasing. In Europe, data protection authorities continue to apply and enforce the General Data Protection Regulation (GDPR), imposing record setting fines. As we develop integrated and personalized products and services and acquire new companies to meet the needs of a changing marketplace, we may expand our data profile through additional data types and sources, across multiple channels, and involving new partners. This potential expansion could amplify the impact of these various laws and regulations on our business. As a result, we are required to constantly monitor our privacy, data and cybersecurity practices and potentially change them when necessary or appropriate. We also may need to provide increased care in our data management, governance and quality practices, particularly as it relates to the use of data in products leveraging AI.

Read in the 10-K filed Nov 6, 2025 ↗

We are also subject to a variety of laws and regulations governing the development, use and deployment of AI technologies. These laws and regulations are increasingly complex, fragmented and still evolving, and there is no single global regulatory framework for AI. Our development, deployment and use of AI and machine learning is subject to various risks at each stage of use. In the context of AI development, risks include those related to intellectual property considerations, the collection and use of personal data, third party risks, technical limitations of algorithms and the accuracy of training data, and compliance with emerging AI legal standards. The increased risk of inadvertent disclosure of confidential information or personal data in connection with the utilization of AI technologies may result in stronger regulatory scrutiny, leading to legal and regulatory investigations and

Read in the 10-K filed Nov 6, 2025 ↗

In particular, the adoption of agentic commerce, in which autonomous AI agents initiate and execute transactions on behalf of users, presents novel and complex regulatory, privacy and cybersecurity risks. Legal frameworks governing such autonomous agents remain nascent, with limited direct guidance specific to payments. The interplay between payments regulations, data privacy laws and evolving AI regulations may create uncertainty around compliance obligations and potential liability exposure as more participants (including sellers, fintechs, AI developers and enablers) enter the agentic commerce ecosystem. The market is still assessing how regulators may apply existing consumer protection and other laws in the context of AI. For example, as agentic commerce solutions scale, we may see increased instances of erroneous or disputed payments, increased chargebacks and reputational harm. Furthermore, reliance on agentic AI introduces challenges in monitoring cross-border, prohibited or high-risk transactions, where conflicting regulatory requirements may apply. The fragmented regulatory landscape for emerging technologies such as AI and inconsistent requirements across legal frameworks may amplify difficulties in identifying, preventing or mitigating risk with a single global approach, potentially increasing our compliance costs or stratifying our ability to leverage certain data or technologies for innovation. For instance, the EU has adopted a comprehensive AI Act that establishes harmonized rules across Europe, with key provisions for high-risk AI systems taking effect in August 2026. Meanwhile, several U.S. states, including California, Colorado and Utah, have adopted AI-specific frameworks or are considering applying existing consumer and data protection laws to regulate AI. Depending on how these different regulations are interpreted and enforced, they may limit the ability to develop and deploy AI systems or significantly increase associated compliance costs. Our development and implementation of governance frameworks aimed at complying with emerging laws and regulations applicable to our AI and machine learning systems may not be successful in mitigating all of these emerging risks.

Read in the 10-K filed Nov 6, 2025 ↗

Our customers use our solutions to collect, use, store, disclose, and otherwise process personal data regarding their employees, healthcare professionals, and patients. Patient data may include sensitive health data. In many countries, governmental bodies have adopted or may adopt laws and regulations regarding the security, collection, use, storage, disclosure, and other processing of personal data, making compliance an increasingly complex task.

Read in the 10-K filed Mar 24, 2025 ↗

Other countries have imposed or may in the future impose data localization obligations, cross-border data transfer restrictions, and other country specific privacy and security requirements which could be problematic to cloud software and data providers. For example, in 2021, China adopted the Personal Information Protection Law, which, together with the Cybersecurity Law and the Data Security Law, require companies that process personal data of China residents above certain thresholds to seek approval from the Cyberspace Administration of China (CAC) to transfer such data outside of China. In 2023, certain of our Veeva CRM customers in China were required to request such approval from the CAC and had their requests denied. Customers required to request approval may need to implement a CRM solution that does not require data to be transferred outside of China and customers not subject to the requirement may nonetheless choose to do so. While we offer the China CRM Suite, a CRM solution that does not require data to be transferred outside of China, some customers have chosen, and other customers may choose, other CRM providers, which may negatively impact our CRM business in China. Currently, approximately 2% of our total revenue is attributable to China. Additionally, as we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations.

Read in the 10-K filed Mar 24, 2025 ↗

In the United States, the U.S. Department of Health and Human Services has promulgated privacy and security rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) that cover protected health information (PHI) by limiting use and disclosure and giving individuals the right to access, amend, and seek accounting of disclosures of their PHI. Certain of our customers may be either business associates or covered entities under HIPAA, which means we must maintain a HIPAA compliance program. There is also the potential for the U.S. federal government to pass additional data privacy laws.

Read in the 10-K filed Mar 24, 2025 ↗

U.S. federal and state data privacy laws are rapidly evolving. These laws impose new and modify existing obligations on businesses that collect personal information, create new privacy rights for individuals, and contain enhanced requirements for and restrictions on data brokers. For example, under the California Consumer Privacy Act (CCPA), as amended, we are generally considered a “service provider” for our software solutions and a “business” for our data products. Some of these laws and regulations also target certain types of marketing and advertising based on the use of personal information. The State of Washington, for example, passed the My Health My Data Act, which became effective on March 21, 2024, establishing significant new restrictions on how businesses can collect, use, and disclose consumer health data. Veeva Crossix’s data platform combines large-scale data sets, inclusive of de-identified health and consumer data, to provide insights, analytics, and audience segmentation for our life sciences customers in the U.S. In response to the Washington law, we made modifications to our audience segments that may reduce demand for our Crossix products, which, in turn, could adversely impact the business. Other states have considered, and in certain cases enacted, similar laws. Additionally, the U.S. Department of Justice recently issued a final rule that takes effect on April 8, 2025, and places limitations, and in some cases prohibitions, on certain transfers of sensitive personal data to data to business partners located in China or with other specified links to China and other designated countries. These various laws, regulations, and legislative developments have potentially far-reaching consequences and have and may continue to require us to modify our solutions and data management practices and incur substantial expense in order to comply.

Read in the 10-K filed Mar 24, 2025 ↗

•government regulations affecting the internet, internet access and availability, domain name registrations or the provision of registry services, data security, privacy, or data localization, e-commerce or telecommunications.

Read in the 10-K filed Feb 13, 2025 ↗

We are subject to data privacy and security laws and regulations in various jurisdictions that apply to the collection, storage, use, sharing, and security of personal data, including health information, and impose significant compliance obligations. In addition, numerous other federal and state laws, including state security breach notification laws, state health information privacy laws and federal and state consumer protection laws, govern the collection, use, disclosure and security

Read in the 10-K filed Feb 13, 2025 ↗

of personal information. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing focus on privacy and data protection issues with the potential to affect our business. As we enter into new disease areas and jurisdictions both commercially and for clinical trials, we must continue to evaluate new and evolving privacy laws.

Read in the 10-K filed Feb 13, 2025 ↗

For example, the E.U. General Data Protection Regulation (“GDPR”) went into effect in 2018 and has imposed new obligations on us with respect to our processing of personal data and the cross-border transfer of such data, including higher standards of obtaining consent, more robust transparency requirements, data breach notification requirements, requirements for contractual language with our data processors, and stronger individual data rights. Different E.U. member states have interpreted the GDPR differently and many have imposed additional requirements, which add to the complexity of processing personal data in the E.U. The GDPR also imposes strict rules on the transfer of personal data to countries outside the E.U., including the U.S. and the U.K., and permits data protection authorities to impose large penalties for violations of the GDPR. Similarly, other jurisdictions have either introduced or enacted legislation or executive orders restricting cross-border data transfers. These regulations restrict the transfer of certain types of data (e.g., sensitive personal data) or restrict the transfer of data to certain jurisdictions. The rules related to cross border data transfers continue to evolve based on court decisions and regulator guidance, which presents certain practical challenges to compliance. Regulators also continue to focus enforcement efforts on behavioral advertising and other online tracking technologies commonly used by companies. Compliance with these evolving rules is challenging, as country specific guidance and rules are continually changing and limited alternatives currently exist in the market. Compliance with the these laws and regulations is a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with any activities falling within the scope of the GDPR or other privacy laws or regulations.

Read in the 10-K filed Feb 13, 2025 ↗

In the U.S., numerous states have introduced or enacted comprehensive privacy legislation. Similar to the California Consumer Rights Act, which came into effect in January 2023), these comprehensive privacy laws place numerous obligations on businesses with respect to the collection and processing of personal data. Some states have passed privacy legislation focusing specifically on the collection and processing of consumer health data. Enforcement at the federal level in the U.S. from the FTC has been focused on the use of health information for targeted advertising. While we continue to address the implications of the new data privacy regulations, data privacy remains an evolving landscape at both the domestic and international level, with new regulations coming into effect and continued legal challenges. Each law is also subject to various interpretations by courts and regulatory agencies, creating even more uncertainty. While we have a global privacy program that addresses such laws and regulations, our efforts to comply with the evolving data protection rules may be unsuccessful.

Read in the 10-K filed Feb 13, 2025 ↗

We must devote significant resources to understanding and complying with the changing landscape in this area. Failure to comply with data protection laws may expose us to risk of enforcement actions taken by data protection authorities, private rights of action in some jurisdictions, and potential significant penalties if we are found to be non-compliant. Failure to comply with the GDPR and applicable national data protection laws of European Economic Area member states could lead to fines of up to €20,000,000 or up to 4% of the total worldwide annual revenue of the preceding financial year, whichever is higher. Some of these laws and regulations also carry the possibility of criminal sanctions. For example, while we are not directly subject to the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (“HIPAA”), we could be subject to penalties, including criminal penalties if we knowingly obtain or disclose individually identifiable health information from a HIPAA-covered health care provider or research institution that has not complied with HIPAA’s requirements for disclosing such information. In addition, the commercialization of cell and gene therapies requires the collection and processing of a greater amount of personal data than traditional therapies, potentially increasing risk. Furthermore, the number of government investigations and enforcement actions related to data security incidents and privacy violations, with a specific focus on online data sharing, continue to increase and government investigations typically require significant resources and generate negative publicity, which could harm our business and our reputation.

Read in the 10-K filed Feb 13, 2025 ↗

We have expanded our international operations over the past several years to market our medicines and expand our research and development capabilities. New laws and industry codes in the E.U. and elsewhere have expanded transparency requirements regarding payments and transfers of value to healthcare professionals, requirements surrounding patient-level clinical trial data, the protection of personal data and increased sanctions for violations. Collectively, our expansion and these new requirements are adding to our compliance costs and potentially exposes us to sanctions in the event of an infringement or failure to report in these jurisdictions. In addition, a significant portion of our commercial supply chain, including sourcing of raw materials and manufacturing, is located in China and the E.U. Consequently, we are, and will continue to be, subject to risks related to operating in foreign countries, including risks relating to intellectual property protections and business interruptions. Risks associated with operating a global biotechnology company include:

Read in the 10-K filed Feb 13, 2025 ↗

We are or may be involved in various legal proceedings, including securities/shareholder matters and claims related to product liability, intellectual property, employment law, competition law, data privacy, and breach of contract. Such proceedings may involve claims for, or the possibility of, damages or fines and penalties involving substantial amounts of money or other relief, including civil or criminal fines and penalties. If any of these legal proceedings were to result in an adverse outcome, it could have a material adverse effect on our business.

Read in the 10-K filed Feb 13, 2025 ↗

We maintain and rely extensively on information technology systems and network infrastructures for the effective operation of our business. In the course of our business, we collect, store, and transmit confidential information (including personal information and intellectual property), and it is critical that we do so in a secure manner to maintain the confidentiality, integrity, and availability of such confidential information. A disruption, infiltration, or failure of our information technology systems or any of our data centers as a result of software or hardware malfunctions, computer viruses, cyber-attacks, employee theft or misuse, power disruptions, natural disasters, floods or accidents could cause breaches of data security and loss of critical data, which in turn could materially adversely affect our business and subject us to both private and governmental causes of action. While we have implemented security measures to minimize these risks to our data and information technology systems and have adopted a business continuity plan to deal with a disruption to our information technology systems, there can be no assurance that our efforts to protect our data and information systems will prevent breakdowns or breaches in our systems that could adversely affect our business. In addition, we maintain cyber liability insurance, however, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems and those of critical third parties.

Read in the 10-K filed Feb 13, 2025 ↗

Cyber-attacks are increasing in their frequency, sophistication, and intensity, and are becoming increasingly difficult to detect. They are often carried out by well-resourced and skilled parties, including nation states, organized crime groups, “hacktivists” and employees or contractors acting carelessly or with malicious intent. Cyber-attacks include deployment of harmful malware and key loggers, ransomware, denial-of-service attacks, malicious websites, the use of social engineering, and other means to affect the confidentiality, integrity and availability of our technology systems and data. Cyber-attacks also include manufacturing, hardware or software supply chain attacks, which could cause a delay in the manufacturing of products or products produced for contract manufacturing or lead to a data privacy or security breach. Our business partners face similar risks and when they experience a security breach of their systems, our security can be adversely affected. Similar to other companies, we have experienced immaterial cybersecurity incidents, including temporary service interruptions of third-party suppliers. In addition, our increased use of cloud technologies heightens these third party and other operational risks, and any failure by cloud or other technology service providers to adequately safeguard their systems and prevent cyber-attacks could disrupt our operations and result in misappropriation, corruption, or loss of confidential or propriety information. A significant portion of our workforce continues to leverage hybrid work. Risk of cyber-attack is increased with employees working remotely. Remote work increases the risk we may be vulnerable to cybersecurity-related events such as phishing attacks and other security threats.

Read in the 10-K filed Feb 13, 2025 ↗

Social media is being used by third parties to communicate about our products and product candidates and the diseases our therapies are designed to treat. We believe that members of the communities supporting serious diseases may be more active on social media as compared to other patient populations due to the demographics of those patient populations. Social media practices in the pharmaceutical and biotechnology industries are evolving, which creates uncertainty and risk of noncompliance with regulations applicable to our business. For example, patients may use social media platforms to comment on the effectiveness of, or adverse experiences with, a product or a product candidate, which could result in reporting obligations. In addition, our employees may engage on social media in ways that may not comply with legal or regulatory requirements, which may give rise to liability, lead to the loss of trade secrets and other intellectual property, or result in public disclosure of protected personal information. There is a risk of inappropriate disclosure of sensitive information or negative or inaccurate posts or comments about us on any social networking website. Negative sentiment about us or our business shared over social media, or misinformation disseminated from fraudulent accounts impersonating our employees or our business, or otherwise, could harm our business and reputation, whether or not it is based in fact. Certain data protection regulations, such as the GDPR, apply to personal data contained on social media. If any of these events were to occur or we otherwise fail to comply with applicable regulations, we could incur liability, face regulatory actions or incur harm to our business, including damage to our reputation. Similar risks relating to inappropriate disclosure of sensitive information or inaccurate information appearing in the public domain may also apply from our employees engaging with and use of new artificial intelligence tools, such as ChatGPT.

Read in the 10-K filed Feb 13, 2025 ↗

data privacy and security, and other related and similar subjects. Among other things, governmental regulations and enforcement actions restrict our operations at times and may adversely affect our financial condition, results of operations and cash flows by imposing conditions such as:

Read in the 10-K filed Feb 19, 2025 ↗

Generative Artificial Intelligence, such as large language models like ChatGPT, present a range of challenges and potential risks as we consider impacts to the business. These challenges involve navigating the complexities of creating and deploying AI models that generate content autonomously. Data privacy, legal concerns, and security issues are all risks as this technology continues to be adopted.

Read in the 10-K filed Feb 27, 2025 ↗

We have significant operations and direct and indirect suppliers located in China, which have been in the past, or could in the future be, adversely affected by: i) China’s evolving laws, regulations and policies, including as respects public health crises, import and export tariffs and restrictions, and information security and privacy, and ii) changes in the political and geopolitical environment, including China's relations with the U.S., European Union and Taiwan. The U.S.’s imposition of tariffs on goods imported from China or deemed to be of Chinese origin, as well as the potential for new or increased tariffs, other governmental actions, trade embargoes or sanctions by the U.S., or similar measures or countermeasures imposed by China in response, has in the past and could in the future have an adverse direct or indirect impact our global supply chain, manufacturing costs, business and operating results. Geopolitical changes in China-Taiwan relations could disrupt the operations of several companies in Taiwan that are critical to the global supply chain for semiconductors (“chips”) and other electronic components. Such changes could have significant negative effects on the global semiconductor industry and could adversely affect our ability to manufacture our digitally-enabled products, such as pumps, controllers and smart meters.

Read in the 10-K filed Mar 3, 2025 ↗

The increasingly complex, restrictive and evolving regulatory environment at the international, federal and state level related to data privacy and data protection may require significant continued effort and cost, changes to our business practices and impact our ability to obtain and use data to provide personalized experiences for our customers. In addition, failure to comply with applicable requirements may subject us and our Concepts’ franchisees to fines, sanctions, governmental investigation, lawsuits and other potential liability, as well as reputational harm.

Read in the 10-K filed Feb 19, 2025 ↗

• Laws relating to information and data security, privacy, cashless payments, consumer protection, and the use of AI and other emerging technologies.

Read in the 10-K filed Feb 19, 2025 ↗