Company: NET
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001477333-25-000141
Chunk: 186

Company: Cloudflare, Inc.
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 4
Chunk 186
---
 experienced increased regulatory scrutiny. The rapid growth of our business and the products that we offer may also result in increased regulatory scrutiny of our company in particular. Any reviews by regulatory agencies or legislatures may result in substantial regulatory fines, changes to our business practices, and other penalties, which could negatively affect our business and results of operations. Changes in social, political, and regulatory conditions or in laws and policies governing a wide range of topics may cause us to change our business practices. Further, our expansion into a variety of new fields also could raise a number of new regulatory issues. These factors could negatively affect our business and results of operations in material ways.

Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business.

85

We receive, store, use, and otherwise process personal information and other information relating to individuals. There are numerous federal, state, local, and international laws and regulations regarding privacy, data protection, information security, and the storing, sharing, use, processing, transfer, disclosure, and protection of personal information and other content, the scope of which are changing, subject to differing interpretations, and may be inconsistent among jurisdictions, or conflict with other rules. Not only is the number of data protection laws rising globally and within the United States, but existing laws and regulations are evolving. Together, this legislative framework may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. For example, the EU’s General Data Protection Regulation (GDPR) imposes stringent data protection requirements and provides for penalties for noncompliance of up to the greater of €20 million or four percent of worldwide annual revenues. In addition, the GDPR and the data protection laws of numerous other jurisdictions such as Japan, China, South Korea, and the United Kingdom prohibit cross-border data transfers unless certain contractual and other conditions are met. This requires us to incur substantial costs and engage in additional contract negotiations with some of our customers and vendors to ensure the conditions established by these data protection regulations are met. 

Some countries are also considering or have enacted legislation and/or certification schemes requiring local storage and processing of data, or other sovereignty-oriented requirements, that could increase the cost and complexity of delivering our services. 

In addition, the interpretation of existing privacy, data protection, and information security laws and regulations by governmental entities and the courts may change significantly over time in a manner that can have a significantly adverse impact on both our business and our customers’ businesses.