Company: FWRG
Filing Date: 2025-03-11
Form Type: 10-K
Source: 0001789940-25-000010
Chunk: 44

Company: First Watch Restaurant Group, Inc.
Filing Date: 2025-03-11
Form: 10-K
Item: Item 1A
Chunk 44
---
 The California Consumer Privacy Act (“CCPA”), for example, requires, among other things, covered companies to provide new disclosures to California consumers and allows such consumers new abilities to opt-out of certain sales of personal data. The CCPA also provides for civil penalties for violations as well as a private right of action for data breaches that may increase data breach litigation. Further, the California Privacy Rights Act, which became fully effective in January 2023, significantly modifies the CCPA. Colorado, Connecticut, Colorado, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia have enacted similar data privacy legislation and Indiana, Kentucky, Maryland, Minnesota, Rhode Island and Tennessee have enacted similar data privacy legislation that will take effect at various points in 2025 and beyond. Several other states and countries are considering expanding or passing privacy laws in the near term. These laws and regulations have required and will require us to incur additional costs and expenses in our effort to comply. Our failure to adhere to or successfully implement appropriate processes to adhere to the requirements of evolving laws and regulations in this area could expose us and our franchisees to financial penalties and legal liability. Our and our franchisees’ systems may not be able to satisfy these changing requirements and customer and employee expectations, or may require significant additional investments or time in order to do so. 

Any failure, or perceived failure, by us to comply with our posted privacy policies or with any federal or state privacy or consumer protection-related laws, regulations, industry self-regulatory principles, industry standards or codes of conduct, regulatory guidance, orders to which we may be subject or other legal obligations relating to privacy or consumer protection could adversely affect our reputation, brand and business, and may result in claims, proceedings or actions against us by governmental entities, customers, suppliers or others or other liabilities or may require us to change our operations and/or cease using certain data sets. We may also be contractually required to indemnify and hold harmless third parties from the costs or consequences of non-compliance with any laws, regulations or other legal obligations relating to 

22

privacy or consumer protection or any inadvertent or unauthorized use or disclosure of data that we store or handle as part of operating our business. 

Federal and state governmental authorities continue to evaluate the privacy implications inherent in the use of third-party “cookies” and other methods of online tracking for behavioral advertising and other purposes. The U.S. government has enacted, has considered or is considering legislation or regulations that could significantly restrict the ability of companies and