Company: VHC
Filing Date: 2025-05-14
Form Type: 10-Q
Source: 0001140361-25-018930
Chunk: 54

Company: VirnetX Holding Corp
Filing Date: 2025-05-14
Form: 10-Q
Item: Part I, Item 2M
Chunk 54
---
 data protection requirements and provides for substantial penalties for noncompliance. The United Kingdom has
        enacted a Data Protection Act and legislation referred to as the UK GDPR that substantially implements the GDPR and provides for a penalty regime similar to the GDPR. We may be required to incur substantial expense in order to make significant
        changes to our products and operations to address compliance with the GDPR and similar legislation, such as the UK GDPR and UK Data Protection Act, all of which may adversely affect our revenue and product sales. California has enacted legislation,
        the California Consumer Privacy Act (the “CCPA”) that, among other things, requires covered companies to provide disclosures to California consumers, and afford such consumers abilities to opt-out of certain sales of personal information. The CCPA
        was modified and expanded by the California Privacy Rights Act (the “CPRA”), which was approved by California voters in the November 2020 election. Additionally, other U.S. states continue to propose, and in certain cases adopt, privacy-focused
        legislation. For example, Connecticut, Virginia, Utah and Colorado enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that has become effective in 2024;
        Delaware, Nebraska, Maryland, New Hampshire, New Jersey, Minnesota, Tennessee, and Iowa have enacted similar legislation that has or will become effective in 2025; and Indiana, Kentucky, and Rhode Island have enacted similar legislation that will
        become effective in 2026. We cannot yet fully determine the impact these or future laws, regulations and standards may have on our business, but they may require us to modify our data processing practices and policies and to incur substantial costs
        and expenses in efforts to comply. Privacy, data protection and information security laws and regulations are often subject to differing interpretations, may be inconsistent among jurisdictions, and may be alleged to be inconsistent with our
        current or future practices. Additionally, we may be bound by contractual requirements applicable to our collection, use, processing, and disclosure of various types of data, including personal data, and may be bound by, or voluntarily comply with,
        self-regulatory or other industry standards relating to these matters. These and other requirements could reduce demand for our products, increase our costs, impair our ability to grow our business, or restrict our ability to store and process data
        or, in some cases, impact our ability to offer our service in some locations and may subject