Company: AFRM
Filing Date: 2025-08-28
Form Type: 10-K
Source: 0001820953-25-000080
Chunk: 34

Company: Affirm Holdings, Inc.
Filing Date: 2025-08-28
Form: 10-K
Item: Item 1
Chunk 34
---
 continue to evolve for the foreseeable future. Legislators and regulators are increasingly adopting or revising privacy and data protection laws, rules, directives, and regulations that could have a significant impact on our current and planned privacy and data protection-related practices; our processing of consumer or employee information; and our current or planned business activities.

Furthermore, an increasing number of state, federal, and international jurisdictions have enacted, or are considering enacting, privacy laws, such as the CCPA, which became effective on January 1, 2020, and the EU GDPR, which regulates the collection, control, sharing, disclosure and use and other processing of personal information of data subjects in the EU and the European Economic Area. The CCPA gives residents of California expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used, and also provides for civil penalties for violations and a private right of action for data breaches. Meanwhile, the GDPR provides data subjects with greater control over the collection and use of their personal information (such as the “right to be forgotten”) and has specific requirements relating to cross-border transfers of personal information to certain jurisdictions, including to the U.S., with fines for noncompliance of up to the greater of 20 million euros or up to 4% of the annual global revenue of the noncompliant company. In addition, on November 3, 2020, California voters approved a new privacy law, the California Privacy Rights Act (“CPRA”), which significantly modifies the CCPA, including by expanding consumers’ rights with respect to certain personal information and creating a new state agency to oversee implementation and enforcement efforts. Many of the CPRA’s provisions became effective on January 1, 2023. The CCPA, CPRA, GDPR, and any other applicable state, federal, and international privacy laws, may increase our compliance costs and potential liability.

Various regulatory agencies in the U.S. and in foreign jurisdictions continue to examine a wide variety of issues that are applicable to us and may impact our business. These issues include account management guidelines, anti-discrimination, consumer protection, identity theft, privacy, disclosure rules, electronic transfers, cybersecurity, and marketing. As our business continues to develop and expand, we continue to monitor the additional rules and regulations that may become relevant in order to maintain compliance with applicable law.

The legal and regulatory framework for privacy and security issues worldwide is rapidly evolving, and, although we endeavor to comply with these laws and regulations and