Company: CALX
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001406666-25-000045
Chunk: 233

Company: CALIX, INC
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 4
Chunk 233
---
 data protection laws and regulations are often uncertain and changing, and it is possible that they may be interpreted and applied in a manner that is inconsistent with our data practices.

For example, in the U.S., certain states have adopted privacy and security laws and regulations which govern the privacy, processing and protection of personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the CCPA) requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business’s collection, use and disclosure of their personal information; (ii) receive and respond to requests from California residents to access, delete and correct their personal information or to opt out of certain disclosures of their personal information; and (iii) enter into specific contractual provisions with service providers that process California resident personal information on the business’s behalf. Additional compliance investment and potential business process changes may also be required. Similar laws have been passed in other states, and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the U.S. Most of the new or proposed laws include restrictions on processing consumer information for targeted advertising, which could negatively affect our marketing cloud products. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. If we are subject to or affected by the CCPA, or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

In 2024, the National Security Division of the U.S. Department of Justice (DOJ) issued a new rule—referred to as the “Data Security Program”, or DSP, aimed at preventing access to “bulk U.S. sensitive personal data” and “government-related data” by “countries of concern” (including China, Russia, Iran, North Korea, Cuba, and Venezuela) and “covered persons” (as all such terms are defined in the DSP). Effective as of April 8, 2025, and fully enforceable as of July 9, 2025, the DSP imposes stringent obligations on companies within its scope and prohibits or restricts “covered data transactions” that grant countries of concern or covered persons access to bulk U.S. sensitive personal data or any