Company: CDLX
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001666071-25-000159
Chunk: 264

Company: Cardlytics, Inc.
Filing Date: 2025-11-05
Form: 10-Q
Item: Item 8
Chunk 264
---
 operate our business. Additionally, companies that transfer personal data out of the EEA and U.K. to other jurisdictions, particularly to the U.S., are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of the EEA for allegedly violating GDPR's cross-border data transfer limitations. 

Furthermore, our business relies on the acquisition and sale of personal data, including data obtained from third-party data suppliers. The acquisition and sale of personal data from or to third parties has become subject to increased regulatory scrutiny. For example, California's Delete Act requires the CPPA to establish, by January 1, 2026, a mechanism to allow California consumers to submit a single, verifiable request to delete all of their personal information held by all registered data brokers and their service providers. Moreover, third-party data suppliers have recently been subject to increased litigation under various claims of violating certain state privacy laws. Obtaining and selling personal data from third parties carries risk to us. These challenges may make it so difficult for us and our suppliers to provide the data and the costs associated with the data materially increase or may materially decrease the availability of data that we or our data suppliers can provide.

Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

In addition to data privacy and security laws, we are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. We publish privacy policies, marketing materials, white papers and other statements, such as statements related to compliance with certain certifications or self-regulatory principles concerning data privacy and security. Regulators in the U.S. are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresent our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

66

Our business is materially reliant on revenue from behavioral, interest-based, or tailored advertising (collectively, "targeted advertising"), but delivering targeted advertisements is becoming