Company: CDLX
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001666071-25-000159
Chunk: 262

Company: Cardlytics, Inc.
Filing Date: 2025-11-05
Form: 10-Q
Item: Item 8
Chunk 262
---
 foreign jurisdictions is ongoing and cannot be fully determined at this time. A number of existing bills are pending in the U.S. federal and state legislatures that contain provisions that would regulate how companies can use various tracking technologies to collect and utilize user information. Additionally, new legislation proposed or enacted in various states will continue to shape the data privacy environment nationally. 

The California Consumer Privacy Act ("CCPA") is an example of the trend towards increasingly comprehensive privacy legislation being introduced in the U.S. The CCPA gives California residents expanded rights to request access to and deletion of their personal data, opt out of certain personal data sharing, and receive detailed information about how their personal data is used. The CCPA also increases the data privacy and security obligations on entities handling personal data, which is broadly defined under the law. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches, and includes statutorily defined damages for intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages, which is expected to increase data breach litigation. The CCPA also imposes requirements on businesses that "sell" information (which is defined broadly under the CCPA); there is significant ambiguity regarding what constitutes a sale and many of our or our partner's business practices may qualify. Further the California Privacy Rights Act ("CPRA") significantly modifies the CCPA, including by expanding consumers' rights with respect to certain sensitive personal data. The CPRA also created a new state agency that is vested with authority to implement and enforce the CCPA and the CPRA.

In the past few years, numerous states have also passed comprehensive privacy laws that impose certain obligations on covered businesses, including requiring covered businesses to provide specific disclosures in privacy notices and to afford residents with certain rights concerning their personal data. Similar laws are being considered in several other states, as well as at the federal and local levels. These developments may further complicate compliance efforts, and may increase legal risk and compliance costs for us and the third parties with whom we work. 

65

Outside of the U.S., an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the European Union's General Data Protection Regulation ("EU GDPR") and the United Kingdom's GDPR ("U.K. GDPR") impose strict requirements for processing personal data. For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions, fines of up to 20 million euros or 4% of annual