Company: BLND
Filing Date: 2025-11-06
Form Type: 10-Q
Source: 0001855747-25-000092
Chunk: 65

Company: Blend Labs, Inc.
Filing Date: 2025-11-06
Form: 10-Q
Item: Part I, Item 2
Chunk 65
---
 rescission rights held by investors in securities offerings and civil and criminal liability, all of which would adversely affect our business, financial condition, and results of operations. 

Changes in laws or regulations relating to privacy, information security, data protection, or the protection or transfer of personal information, or any actual or perceived failure by us to comply with such laws and regulations or any other obligations relating to privacy, information security, data protection, or the protection or transfer of personal information, could adversely affect our business. 

We, and our partners, vendors, and other service providers, receive, collect, use, disclose, share, transfer, transmit, store, and otherwise process a large volume of personal information and other sensitive data relating to individuals, such as consumers and our employees. Our collection, use, receipt, and other processing of data in our business subjects us to numerous state, federal, and foreign laws and regulations, addressing privacy, information security, data protection, and the collection, storing, sharing, use, transfer, disclosure, protection, and processing of certain data. Such regulations include, for example, the GLBA, FCRA, California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (the “CPRA”). These laws, rules, and regulations evolve frequently and their scope may continually change, through new legislation, amendments to existing legislation, and changes in interpretation or enforcement, and may impose conflicting and inconsistent obligations. 

For example, in 2021, the Federal Trade Commission (“FTC”) amended the GLBA’s Safeguards Rule, which requires covered financial services firms, which may include some of our customers, to develop, implement, and maintain a comprehensive information security program. The rule provides more prescriptive security controls that financial services firms must implement and oversight by a designated Qualified Individual who must provide annual written reports to the board of directors or equivalent governing body. The FTC further amended the GLBA’s Safeguards Rule in November 2023 to provide for reporting to the FTC certain security incidents in which unencrypted personal information involving 500 or more consumers is acquired without authorization. In addition, the FTC has brought enforcement actions against service providers of financial services firms directly and against financial services firms for failures by service providers to implement appropriate controls to safeguard consumers’ personal information. 

The CCPA went into effect on January 1, 2020, and, among other things, requires certain disclosures to California consumers and affords such consumers certain data privacy rights. The California Attorney General can enforce the CCPA, including