Company: CALX
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001406666-25-000045
Chunk: 271

Company: CALIX, INC
Filing Date: 2025-10-30
Form: 10-Q
Item: Part II, Item 1A
Chunk 271
---
) receive and respond to requests from California residents to access, delete and correct their personal information or to opt out of certain disclosures of their personal information; and (iii) enter into specific contractual provisions with service providers that process California resident personal information on the business’s behalf. Additional compliance investment and potential business process changes may also be required. Similar laws have been passed in other states, and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the U.S. Most of the new or proposed laws include restrictions on processing consumer information for targeted advertising, which could negatively affect our marketing cloud products. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. If we are subject to or affected by the CCPA, or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

In 2024, the National Security Division of the U.S. Department of Justice (DOJ) issued a new rule—referred to as the “Data Security Program”, or DSP, aimed at preventing access to “bulk U.S. sensitive personal data” and “government-related data” by “countries of concern” (including China, Russia, Iran, North Korea, Cuba, and Venezuela) and “covered persons” (as all such terms are defined in the DSP). Effective as of April 8, 2025, and fully enforceable as of July 9, 2025, the DSP imposes stringent obligations on companies within its scope and prohibits or restricts “covered data transactions” that grant countries of concern or covered persons access to bulk U.S. sensitive personal data or any amount of government-related data. The DSP is new, complex and has yet to be enforced, and as such, there is a risk that our interpretation of its applicability, scope and requirements is incorrect, incomplete or misapplied.

Compliance with the DSP may require us to invest heavily in data security and compliance measures, such as implementing and complying with the Cybersecurity and Infrastructure Security Agency’s guidelines and other burdensome recordkeeping, reporting and auditing requirements. It may also require us to implement new processes, stop or restrict certain data transfers, alter the geographic scope of our operations, cease doing business with certain third parties or using certain tools or vendors, or change how data flows throughout our business, any of which could materially impact our business operations or hinder our ability to grow our business. Finally, non-compliance with the DSP could