Company: CRCT
Filing Date: 2025-03-05
Form Type: 10-K
Source: 0001828962-25-000039
Chunk: 92

Company: Cricut, Inc.
Filing Date: 2025-03-05
Form: 10-K
Item: Item 1A
Chunk 92
---
 to data protection and went into effect on October 1, 2022. To comply with the decree, we may be required to further invest in potentially duplicative infrastructure and personnel in 

44

Vietnam, establish and maintain a local data protection program, and incur other costs and expenses related to these new requirements. 

California has also enacted legislation affording consumers expanded privacy protections. The CCPA, which was amended by the CPRA, gives California residents various rights, including rights to access their personal information, request deletion of their personal information, opt out of certain sale sand sharing of their personal information, and receive detailed information about how their personal information is collected and used. The CCPA also provides for civil penalties for violations (up to $7,500 per violation), as well as a private right of action for certain data breaches that may increase data breach litigation. Numerous other states have also enacted or proposed similar data privacy laws. For example, Virginia, Colorado, Utah, Connecticut, Florida, Montana, Oregon, Texas Tennessee, Delaware, Iowa, Indiana, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Kentucky and Rhode Island have enacted similar laws that have gone into effect, or will go into effect through 2026. The CCPA, these other state laws and other proposed laws at the state and federal level in the United States are far-reaching and in certain cases are overlapping but different l, resulting in further uncertainty and potentially requiring changes in our business practices and policies and our incurring, require us to incur additional costs and expenses in an effort to comply.

Further, some countries also are considering or have passed legislation requiring local storage and processing of data, or similar requirements, which could increase the cost and complexity of operating our products and services and other aspects of our business.

With laws and regulations such as the GDPR, LGPD and CCPA imposing new and relatively burdensome obligations, and with substantial uncertainty over the interpretation and application of these and other laws and regulations, there is a risk that the requirements of these or other laws and regulations, or of contractual or other obligations relating to privacy, data protection or information security, are interpreted or applied in a manner that is, or is alleged to be, inconsistent with our management and processing practices, our policies or procedures, or the features of our products and services. We may face challenges in addressing their requirements and making any necessary changes to our policies and practices, and we may find it necessary or appropriate to assume additional burdens with respect to data handling, to restrict our data processing or