Company: TRUE
Filing Date: 2025-08-07
Form Type: 10-Q
Source: 0001327318-25-000036
Chunk: 119

Company: TrueCar, Inc.
Filing Date: 2025-08-07
Form: 10-Q
Item: Part II, Item 1A
Chunk 119
---
 applicable laws and regulations and other mandatory obligations relating to privacy and data protection. However, it is possible that these obligations may be interpreted and applied in new ways or in a manner that is inconsistent from one jurisdiction to another, that they may conflict with other rules or our practices or that new regulations could be enacted. In addition to the increasing technical and financial burdens they impose on our business, the rapid legislative and other legal developments in this field create considerable uncertainties and impose substantial compliance costs and challenges. Any failure or perceived failure by us to comply with our privacy policies, our privacy-related obligations to consumers or other third parties or our privacy-related legal obligations, including those imposed by the CCPA and other state privacy laws, or any compromise of security that results in the unauthorized release or transfer of sensitive information, which may include personally identifiable information or other user data, may result in governmental enforcement actions, litigation or public statements against us by consumer advocacy groups or others. Any of these consequences could cause consumers and automobile dealers to lose trust in us, which could have a material adverse effect on our business and prospects. Additionally, if vendors, developers or other third parties that we work with violate applicable laws or our policies, such violations may also put consumer or dealer information at risk and could in turn harm our reputation, business and operating results.

58

Security breaches and improper access to or disclosure of our data or user data, or other hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business.

Our industry is prone to cyberattacks by third parties seeking unauthorized access to our data or users’ data or to disrupt our ability to provide service. Any failure to prevent or mitigate security breaches and improper access to or disclosure of our data or user data, including personal information, content or payment information from users, could result in the loss or misuse of such data, which could harm our business and reputation and diminish our competitive position. In addition, computer malware, ransomware, viruses, social engineering (such as spear phishing attacks) and general hacking have become more prevalent in our industry, have occurred on our systems in the past and are likely to occur on our systems in the future. Such attacks may cause interruptions to the services we provide, degrade the user experience, cause users to lose confidence and trust in our products, impair our internal systems or result in financial harm to us. Further, these risks could be heightened by the fact that most of our employees work from home.

Our efforts to protect our data or the data we receive could also be unsuccessful due to