Company: BLND
Filing Date: 2025-11-06
Form Type: 10-Q
Source: 0001855747-25-000092
Chunk: 315

Company: Blend Labs, Inc.
Filing Date: 2025-11-06
Form: 10-Q
Item: Part II, Item 1A
Chunk 315
---
 (“FTC”) amended the GLBA’s Safeguards Rule, which requires covered financial services firms, which may include some of our customers, to develop, implement, and maintain a comprehensive information security program. The rule provides more prescriptive security controls that financial services firms must implement and oversight by a designated Qualified Individual who must provide annual written reports to the board of directors or equivalent governing body. The FTC further amended the GLBA’s Safeguards Rule in November 2023 to provide for reporting to the FTC certain security incidents in which unencrypted personal information involving 500 or more consumers is acquired without authorization. In addition, the FTC has brought enforcement actions against service providers of financial services firms directly and against financial services firms for failures by service providers to implement appropriate controls to safeguard consumers’ personal information. 

The CCPA went into effect on January 1, 2020, and, among other things, requires certain disclosures to California consumers and affords such consumers certain data privacy rights. The California Attorney General can enforce the CCPA, including seeking an injunction and civil penalties of up to $7,500 per violation. The CCPA also provides a private right of action for certain data breaches that may increase data breach litigation. Additionally, the CPRA was approved by California voters in November 2020, and significantly modified the CCPA, including expanding California consumers’ rights with respect to certain personal information and creating a new state agency to oversee implementation and engage in enforcement efforts. The CPRA created obligations relating to consumer data beginning on January 1, 2022 and it became effective on January 1, 2023. Numerous states have proposed, and in certain cases enacted, legislation addressing privacy and data security that in many cases are similar to the CCPA and CPRA. For example, Connecticut, Virginia, Colorado, and Utah have enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that took effect in 2024; Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Tennessee have 

69

enacted similar legislation that has taken or will take effect in 2025; and Indiana, Kentucky, and Rhode Island have enacted similar legislation that will take effect in 2026. The California Age-Appropriate Design Code Act (“CAADCA”), which expands the CPRA for businesses with websites that are likely to be accessed by children, was signed into law on September 15, 2022