Company: GOOGL
Filing Date: 2025-02-05
Form Type: 10-K
Source: 0001652044-25-000014
Chunk: 106

Company: Alphabet Inc.
Filing Date: 2025-02-05
Form: 10-K
Item: Item 1A
Chunk 106
---
 world to consider and adopt new and evolving interpretations of data protection laws, imposing specific obligations with respect to the processing of personal data, including required notices, consents, and opt-outs. Further, the increased risk of inadvertent disclosure of confidential information or personal data in connection with the utilization of AI technologies may result in stronger regulatory scrutiny, leading to legal and regulatory investigations and enforcement actions that may negatively affect our business, even if unfounded. Adverse legal rulings, legislation, or regulation have resulted in, and may continue to result in, fines and orders requiring that we change our practices, which have had and could continue to have an adverse effect on how we provide services, harming our business, reputation, financial condition, and operating results. These laws and regulations are evolving and subject to interpretation, and compliance obligations could cause us to incur substantial costs or harm the quality and operations of our products and services in ways that harm our business. Examples of these laws include: 

•The EU General Data Protection Regulation and the United Kingdom General Data Protection Regulations, which apply to all of our activities conducted from an establishment in the EU or the United Kingdom, respectively, or related to products and services that we offer to EU or the United Kingdom users or customers, respectively, or the monitoring of their behavior in the EU or the UK, respectively.

•Various U.S. federal, U.S. state, and foreign privacy laws related to the processing and security of personal data, including (1) comprehensive privacy laws that provide data privacy rights (including, in California, a private right of action in the event of a data breach resulting from our failure to implement and maintain reasonable security procedures and practices) and impose significant obligations on controllers and processors of consumer data; (2) laws imposing obligations on businesses that collect or disclose biometric information (including, in Illinois, Texas, and Washington); (3) laws governing the collection and processing of children and minor’s data and how companies provide age appropriate online experiences (including, in the U.S., the Children’s Online Privacy Protection Act of 1998, the pending Children and Teens' Online Privacy Protection Act (COPPA 2.0), which passed the U.S. Senate in 2024, and similar U.S. state laws related to children’s privacy, such as the New York Child Data Protection Act, and the United Kingdom’s Age-Appropriate Design Code); and (4) laws regulating internet-connected devices (such as, in California, the Internet of Things Security Law).

•The EU’s Digital