Company: PGYWW
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001883085-25-000050
Chunk: 192

Company: Pagaya Technologies Ltd.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1A
Chunk 192
---
 Virginia, Colorado, Connecticut, New Hampshire, Illinois, Nebraska, and Utah. On March 2, 2021, Virginia enacted the Virginia Consumer Data Protection Act (the “CDPA”), and on July 8, 2021, Colorado enacted the Colorado Privacy Act (the “CPA”), comprehensive privacy statutes that became effective on January 1, 2023 and July 1, 2023, respectively, and share similarities with the CCPA, CPRA, and legislation proposed in other states.

The CCPA, CPRA, CDPA, CPA and other changes in laws or regulations relating to privacy, cybersecurity, data protection, and information security, particularly any new or modified laws or regulations, or changes to the interpretation or enforcement of laws or regulations like the GLBA, that require enhanced protection of certain types of data or new obligations with regard to data retention, transfer, or disclosure, could greatly increase the cost of providing our network, require significant changes to our operations, or even prevent us from providing our network in jurisdictions in which we currently operate and in which we may operate in the future. Certain other state laws impose similar privacy obligations and we also expect that more states may enact legislation similar to the CCPA, CPRA, CDPA and CPA, which provide consumers with new privacy rights and increase the privacy and security obligations of entities handling certain personal information of such consumers. The CCPA has prompted a number of proposals for new federal and state-level privacy legislation. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions, and potential legal risk, require additional investment of resources in 

40

Table of Contents

compliance programs, impact strategies and the availability of previously useful data, and could result in increased compliance costs and/or changes in business practices and policies. In addition, some jurisdictions, such as New York, Massachusetts, and Nevada have enacted more generalized data security laws that apply to certain data that we process. We cannot yet fully determine the impact these or future laws, rules, regulations, and industry standards may have on our business or operations. Any such laws, rules, regulations, and industry standards may be inconsistent among different jurisdictions, subject to differing interpretations, or may conflict with our current or future practices. Additionally, our Partners’ customers may be subject to differing privacy laws, rules, and legislation, which may mean that they require us to be bound by varying contractual requirements applicable to certain other jurisdictions. Adherence to such contractual requirements may impact our receipt, use, processing, storage,