Company: TRUE
Filing Date: 2025-08-07
Form Type: 10-Q
Source: 0001327318-25-000036
Chunk: 48

Company: TrueCar, Inc.
Filing Date: 2025-08-07
Form: 10-Q
Item: Part I, Item 4
Chunk 48
---
 may impact how we operate our websites or mobile application, engage in digital marketing, transact with consumers, or process or monetize our data assets.

Further, many laws, including the Telephone Consumer Protection Act of 1991, the CAN-SPAM Act of 2003 and the Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence Act of 2019, regulate outbound contacts with consumers, such as phone calls, texts or emails. If we, or dealers on our network, are perceived to have violated these or other similar laws and regulations, our brand and reputation could be negatively affected, and we could face potentially costly litigation. In addition, in December 2023, the Federal Communications Commission (“FCC”) adopted new rules that expanded the requirements related to collecting consumer consent prior to initiating outbound contact with consumers via phone call or text by restricting the practice of collecting a single consumer consent to authorize covered communications from multiple sellers. Although these new rules were vacated by the United States Court of Appeals for the Eleventh Circuit in January 2025, and the FCC has reinstated the prior version of the rules, if the FCC proposes similar rules in the future, the implementation of such rules could require us to make certain changes to our consumer consent collection practices and user experience. If any such changes cause consumers to view our products and user experience as less appealing, our close rate and value proposition to consumers and dealers could be negatively impacted.  

There are also emerging cases in which plaintiffs have asserted novel claims under existing privacy and data security laws in the United States, such as federal and state wiretapping laws, in ways which may impact our ability to offer certain products or employ widely-used technologies that allow website and mobile application operators to understand how users interact with their services. The outcome of these cases could cause us to make changes to our products or operations to avoid costly litigation, government enforcement actions, damages, and penalties under these laws, which could adversely affect our business, results of operations, and our financial condition.

Our business operations and data handling procedures are based on industry standards. We maintain and update privacy and information security policies and employ an audit and assurance program designed to ensure that we comply with privacy and security-related obligations to third parties. We strive to monitor the changing regulatory environment and to address the new requirements of applicable laws and regulations and other mandatory obligations relating to privacy and data protection. However, it is possible that these obligations may be interpreted and applied in new ways or in a manner that is inconsistent from one jurisdiction to