Company: FOACW
Filing Date: 2025-05-20
Form Type: 10-K/A
Source: 0001828937-25-000032
Chunk: 72

Company: Finance of America Companies Inc.
Filing Date: 2025-05-20
Form: 10-K/A
Chunk 72
---
, and contractors, provide such individuals new data protection and privacy rights, including the ability to opt-out of the sale of personal information or the sharing of personal information for cross-context behavioral advertising, and create additional requirements to limit the retention of personal information. The CCPA also established the California Privacy Protection Agency, an agency charged with data privacy enforcement and issuing clarifying privacy regulations. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information. The private right of action may increase the likelihood of, and risks associated with, data breach litigation. In addition, laws in all 50 U.S. states and territories require businesses to provide notice to consumers whose personal information has been disclosed as a result of a data breach. State laws are changing rapidly, including the passage of new privacy laws in several states, and there have been discussions in the U.S. Congress of a comprehensive federal data privacy law to which we would become subject if such a law was enacted. Related laws imposing requirements in areas such as cybersecurity impose further requirements enhancing compliance obligations with respect to data privacy and security.

All of these evolving compliance and operational requirements, as well as changing consumer expectations around privacy, impose significant costs. Such costs include those related to organizational changes, implementing additional protection technologies and processes, training employees, and engaging consultants, which are likely to increase over time. In addition, such requirements are likely to require us to modify our data processing practices and policies, distract management, or divert resources from other initiatives and projects, all of which could have a material adverse effect on our business, financial condition, results of operations, and prospects. Any failure or perceived failure by us to comply with any applicable federal, state, or similar foreign laws and regulations relating to data privacy and security could result in damage to our reputation, as well as regulatory proceedings or litigation by governmental agencies or other third parties, including class action privacy litigation in certain jurisdictions, which would subject us to significant fines, sanctions, awards, penalties, or judgments, all of which could have a material adverse effect on our business, financial condition, and operating results.

Unlike competitors that are national banks, we are subject to state licensing and operational requirements that result in substantial compliance costs and risks.

Because we are not a depository institution, we do not benefit from a federal exemption to state mortgage banking, loan servicing, or debt collection licensing and regulatory requirements. We must comply with state licensing requirements and varying compliance requirements in all 50 states and the