Company: XTIA
Filing Date: 2025-04-15
Form Type: 10-K
Source: 0001213900-25-032213
Chunk: 56

Company: XTI Aerospace, Inc.
Filing Date: 2025-04-15
Form: 10-K
Item: Item 1
Chunk 56
---
’ use of our services, thereby rendering our business unprofitable.

In
the U.S., these privacy rules and regulations include those promulgated under the authority of the Federal Trade Commission, the Electronic
Communications Privacy Act, the Computer Fraud and Abuse Act, the California Consumer Privacy Act of 2018 (the “CCPA”) and
other state and federal laws relating to privacy and data security. By way of example, the CCPA requires covered businesses to provide
new disclosures to California residents, provide them new ways to opt-out of certain disclosures of personal information, and allows
for a cause of action for data breaches. It includes a framework that includes potential statutory damages and private rights of action.
There is some uncertainty as to how the CCPA, and similar privacy laws emerging in other states, could impact our business as it depends
on how such laws will be interpreted. As we expand our operations, compliance with privacy laws may increase our operating costs.

Some
features of our services may trigger the data protection requirements of certain foreign jurisdictions, such as the EU General Data Protection
Regulation (the “GDPR”), and the EU ePrivacy Directive. In addition, our services may be subject to regulation under current
or future laws or regulations. For instance, as the EU ePrivacy Directive transitions in its entirety to the ePrivacy Regulation, it
will bring an updated set of rules relevant to many aspects of our business. If our treatment of data, privacy practices or data security
measures fail to comply with these current or future laws and regulations in any of the jurisdictions in which we collect and/or process
information, we may be subject to litigation, regulatory investigations, civil or criminal enforcement, financial penalties, audits or
other liabilities in such jurisdictions, or our customers may terminate their relationships with us.

29

In
addition, data protection laws, such as the GDPR, foreign court judgments or regulatory actions could affect our ability to transfer,
process and/or receive transnational data that is critical to our operations, including data relating to users, customers, or partners
outside the United States. For instance, the GDPR restricts transfers of personal data outside of the European Economic Area, including
to the United States, subject to certain requirements. Additionally, certain countries have passed or are considering passing laws requiring
local data residency. The costs of compliance with, and other burdens imposed by, privacy laws, regulations and standards may limit the
use and adoption of our services, reduce overall demand for our services, make it