Company: VHC
Filing Date: 2025-05-14
Form Type: 10-Q
Source: 0001140361-25-018930
Chunk: 9

Company: VirnetX Holding Corp
Filing Date: 2025-05-14
Form: 10-Q
Item: Part II, Item 1A
Chunk 9
---
 the collection, processing, storage and use of confidential and proprietary business information and personal data is rapidly evolving. The United States federal, various state and foreign governments have adopted or
        proposed requirements regarding the collection, distribution, use, security, storage, and other processing of personal information and other data relating to individuals, and federal and state consumer protection laws are being applied to enforce
        regulations related to the online collection, use and dissemination of data.

Further, many foreign countries and governmental bodies, including the European Union (“EU”), where we conduct business, have laws and regulations concerning the collection and use of personal data
        obtained from their residents or by businesses operating within their jurisdiction. These laws and regulations often are more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection,
        use, storage, disclosure, and security of data that identifies or may be used to identify or locate an individual.

We also expect that there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection and information security in the United States, the EU, and other
        jurisdictions. For example, the European Commission maintains a General Data Protection Regulation (the “GDPR”) that imposes stringent data protection requirements and provides for substantial penalties for noncompliance. The United Kingdom has
        enacted a Data Protection Act and legislation referred to as the UK GDPR that substantially implements the GDPR and provides for a penalty regime similar to the GDPR. We may be required to incur substantial expense in order to make significant
        changes to our products and operations to address compliance with the GDPR and similar legislation, such as the UK GDPR and UK Data Protection Act, all of which may adversely affect our revenue and product sales. California has enacted legislation,
        the California Consumer Privacy Act (the “CCPA”) that, among other things, requires covered companies to provide disclosures to California consumers, and afford such consumers abilities to opt-out of certain sales of personal information. The CCPA
        was modified and expanded by the California Privacy Rights Act (the “CPRA”), which was approved by California voters in the November 2020 election. Additionally, other U.S. states continue to propose, and in certain cases adopt, privacy-focused
        legislation. For example, Connecticut, Virginia, Utah and Colorado enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that has become effective in 2024;
        Delaware, Nebraska