Company: SPWH
Filing Date: 2025-04-02
Form Type: 10-K
Source: 0000950170-25-048890
Chunk: 209

Company: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.
Filing Date: 2025-04-02
Form: 10-K
Item: Item 1B
Chunk 209
---
, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the CCPA imposes obligations on covered businesses regarding their processing of personal data and provides for fines and a private right of action for certain data breaches.  Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data. Our inability or failure to do so could result in adverse consequences, such as threats of class-action litigation alleging violations of wiretapping laws.

In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups, such as the PCI DSS, and we are, and may become in the future subject to such obligations. We rely on vendors to process payment card data, and those vendors are subject to PCI DSS, and our business may be negatively affected if our vendors are fined or suffer other consequences as a result of PCI DSS noncompliance. 

We are also bound by other contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. 

We publish privacy policies, marketing materials, and other statements concerning data privacy and security.  Regulators in the United States are increasingly scrutinizing these statements, and if these are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences.

Our business is materially reliant on revenue from behavioral, interest-based, or tailored advertising (collectively, “targeted advertising”), but delivering targeted advertisements is becoming increasingly difficult due to changes to our ability to gather information about user behavior through third party platforms, new laws and regulations, and consumer resistance. In the United States, the CCPA, for example, grants California residents the right to opt-out of a company’s sharing of personal data for advertising purposes in exchange for money or other valuable consideration, and requires covered businesses to honor user-enabled browser signals from the Global Privacy Control. Partially because of these developments, individuals are becoming increasingly resistant to the collection, use, and sharing of