Company: SERV
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0001832483-25-000010
Chunk: 95

Company: Serve Robotics Inc. /DE/
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1A
Chunk 95
---
, 2022, and enforcement beginning July 1, 2023. The CPRA significantly modifies the CCPA, potentially resulting in further uncertainty. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent privacy legislation in the United States. Other states have begun to propose and enact similar laws. For example, Virginia has enacted the Virginia Consumer Data Protection Act, which provides for obligations similar to the CCPA, and which will go into effect January 1, 2023. As we expand our operations, the CCPA, CPRA, and other laws and regulations relating to privacy and data security may increase our compliance costs and potential liability. Compliance with any applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms to comply with such laws and regulations.

Additionally, as our international presence expands, we may become subject to or face increasing obligations under laws and regulations in countries outside the United States, many of which, such as the GDPR and national laws supplementing the GDPR, as well as legislation substantially implementing the GDPR in the United Kingdom, are significantly more stringent than those currently enforced in the United States. The GDPR requires companies to meet stringent requirements regarding the handling of personal data of individuals located in the European Economic Area (“EEA”). The GDPR also includes significant penalties for noncompliance, which may result in monetary penalties of up to the higher of €20 million or 4% of a group’s worldwide turnover for the preceding financial year for the most serious violations. The United Kingdom’s version of the GDPR, the UK GDPR, which it maintains along with its Data Protection Act (collectively, the “UK GDPR”), also provides for substantial penalties that, for the most serious violations, can go up to the greater of £17.5 million or 4% of a group’s worldwide turnover for the preceding financial year. Many other jurisdictions globally are considering or have enacted legislation providing for local storage of data or otherwise imposing privacy, data protection and data security obligations in connection with the collection, use and other processing of personal data.

We publish privacy policies and other documentation regarding our collection, processing, use and disclosure of personal information and/or other confidential information. Although we endeavor to comply with our published policies and other documentation, we may at times fail to do so or may be perceived to have failed to do so. Moreover, despite our efforts, we may not be successful in achieving compliance, including if our employees, contractors, service providers