Company: CRCL
Filing Date: 2025-08-04
Form Type: DRS
Source: 0000950123-25-006942
Chunk: 98

Company: Circle Internet Group, Inc.
Filing Date: 2025-08-04
Form: DRS
Chunk 98
---
 be
required to change some

55

CONFIDENTIAL TREATMENT REQUESTED BY CIRCLE INTERNET GROUP, INC. PURSUANT TO 17 C.F.R. § 200.83

portions of our marketing strategy, or could face negative publicity, and our business, results of operations, financial condition, and prospects could be adversely affected. Even an unsuccessful
challenge of our calling or SMS texting practices by our customers, regulatory authorities, or other third parties could result in negative publicity and could require a costly response from and defense by us.

In the United States, federal and state lawmakers and regulatory authorities have increased their attention to the collection and use of consumer data. For
example, certain states in the United States have enacted stringent privacy and data protection legislation and regulations, such as the California Consumer Privacy Act (the “CCPA”), which gives California residents the right to access and
request deletion of their personal data, opt out of the sale of personal data, and receive detailed information about how their personal data is processed, and provides a private right of action for certain data breaches involving the loss of
personal data. The California Privacy Rights Act modified the CCPA by expanding consumers’ rights with respect to certain personal data and creating a new state agency to oversee implementation and enforcement efforts. Another example is the
Virginia Consumer Data Protection Act, which regulates how businesses collect and share personal information. With bills proposed in many other jurisdictions, it remains quite possible that other states will enact similar privacy and data protection
legislation. Such proposed legislation, if enacted, may add additional complexity, conflicting requirements, additional restrictions, and potential legal risk. The existence of comprehensive privacy laws in different states will make our compliance
obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance.

As a result of our presence in Europe and some of our customers being located in the European Union and the United Kingdom, we are subject to the GDPR and the
UK GDPR. These regimes impose stringent data protection requirements and may increase both the risk of noncompliance and the costs of providing our products and services in a compliant manner. These regimes grant rights for data subjects in regard
to their personal data (including the right to be “forgotten” and the right to data portability) and enhance preexisting rights (e.g., data subject access requests). A breach of the GDPR or UK GDPR could result in regulatory
investigations, reputational damage, fines and sanctions