Company: CDLX
Filing Date: 2025-08-06
Form Type: 10-Q
Source: 0001666071-25-000126
Chunk: 84

Company: Cardlytics, Inc.
Filing Date: 2025-08-06
Form: 10-Q
Item: Item 1A
Chunk 84
---
 requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to the services, information, technologies, systems and practices of any third parties that process personal data on our behalf. In addition, these obligations may require us to change or business model. We may, for example, be required to, or otherwise may determine that it is advisable to, develop or obtain additional tools and technologies for validation of certain of our limited sales related to online purchases to compensate for a potential lack of cookie data. Even if we are able to do so, such additional tools may be subject to further regulation, time consuming to develop or costly to obtain, and less effective than our current use of cookies. 

We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third with whom we work may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including, but not limited to: government enforcement actions (which could result in investigations, fines, penalties, audits and inspections), litigation (including class-action claims), additional reporting requirements and/or oversight, bans on processing personal data and orders to destroy or not use personal data. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class action litigation and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business or financial condition, potentially resulting in negative consequences including, but not limited to loss of customers, interruptions or stoppages in our business operations, inability to process personal data or to operate in certain jurisdictions, limited ability to develop or commercialize our products, expenditure of time and resources to defend any claim or inquiry, adverse publicity or substantial changes to our business model or operations.

Failure to protect our proprietary technology and intellectual property rights could substantially harm our business, financial condition and operating results.

Our future success and competitive position depend in part on our ability to protect our intellectual property and proprietary technologies. To safeguard these rights, we rely on a combination of patent, trademark, copyright