Company: PCOR
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-008121
Chunk: 40

Company: PROCORE TECHNOLOGIES, INC.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 40
---
 laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our 

23

business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. 

For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights. The CCPA provides for administrative fines and allows private litigants affected by certain data breaches to recover significant statutory damages. Additionally, several states and localities have enacted measures related to the use of AI in products and services. Moreover, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data. Our data processing practices are subject to increased challenges by class action plaintiffs. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands. Additional data privacy and security laws have also been proposed at the federal, state, and local levels in recent years, which could further complicate compliance efforts.

As we continue to expand globally, our obligations related to data protection will increase. Outside the U.S., an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the European Union’s (“EU”) General Data Protection Regulation (the “EU’s GDPR”) and the United Kingdom’s (“U.K.”) General Data Protection Regulation (the “U.K.’s GDPR”) impose strict requirements for processing personal data. Under the EU’s GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines of up to 20 million euros or 4% of annual global revenue, whichever is greater, for certain violations. Similarly, under the U.K.’s GDPR, government regulators may impose fines of up to 17.5 million pounds sterling or 4% of annual global turnover, whichever