Company: CDLX
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001666071-25-000159
Chunk: 32

Company: Cardlytics, Inc.
Filing Date: 2025-11-05
Form: 10-Q
Item: Item 4
Chunk 32
---
.S. and foreign privacy and data security laws, rules, contractual obligations, regulation, industry standards, policies and other obligations related to data privacy and security. The actual or perceived failure by us, our partners, or other third parties with whom we work to comply with such obligations could lead to regulatory investigations or actions, litigation (including class action claims), mass arbitration demands, disruptions of our business operations, or loss of customers or sales, harm our reputation, result in significant expense or loss of revenue or profits, subject us to significant fines and liability or otherwise adversely affect our business.

In the ordinary course of business, we collect, receive, store, process, use, generate, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share personal data and other sensitive information including proprietary and confidential business data, trade secrets, and intellectual property ("process" or "processing") necessary to operate our business, for legal and marketing purposes, and for other business-related purposes. We, our FI partners, our marketers and other third parties with whom we work are subject to a number of data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy policies, contractual requirements, and other obligations relating to data privacy and security as well as laws and regulations regarding online services and the Internet generally. 

In the U.S., the rules and regulations to which we, directly or contractually through our partners, or our marketers are or may be subject, include but are not limited to those promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act, the Gramm-Leach-Bliley Act and state cybersecurity, privacy and breach notification laws, as well as regulator enforcement positions and expectations reflected in federal and state regulatory actions, settlements, consent decrees and guidance documents. 

The regulatory framework for online services and data privacy and security issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future. Many of these obligations conflict with each other, and interpretation of these laws, rules and regulations and their application to our solutions in the U.S. and foreign jurisdictions is ongoing and cannot be fully determined at this time. A number of existing bills are pending in the U.S. federal and state legislatures that contain provisions that would regulate how companies can use various tracking technologies to collect and utilize user information. Additionally, new legislation proposed or enacted in various