Company: BLND
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001855747-25-000017
Chunk: 172

Company: Blend Labs, Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1A
Chunk 172
---
 certain disclosures to California consumers and affords such consumers certain data privacy rights. The California Attorney General can enforce the CCPA, including seeking an injunction and civil penalties of up to $7,500 per violation. The CCPA also provides a private right of action for certain data breaches that may increase data breach litigation. Additionally, the CPRA was approved by California voters in November 2020, and significantly modified the CCPA, including expanding California consumers’ rights with respect to certain personal information and creating a new state agency to oversee implementation and enforcement efforts. The CPRA created obligations relating to consumer data beginning on January 1, 2022 and it became effective on January 1, 2023. Numerous states have proposed, and in certain cases enacted, legislation addressing privacy and data security that in many cases are similar to the CCPA and CPRA. For example, Connecticut, Virginia, Colorado, and Utah have enacted legislation similar to the CCPA and CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that took effect in 2024; Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Tennessee have enacted similar legislation that has taken or will take effect in 2025; and Indiana, Kentucky, and Rhode Island have enacted similar legislation that will take effect in 2026. The California Age-Appropriate Design Code Act (“CAADCA”), which expands the CPRA for businesses with websites that are likely to be accessed by children, was signed into law on September 15, 2022 and went into effect on July 1, 2024. The New York governor signed a bill into law in June 2024 that, upon becoming effective on June 20, 2025, would, among other things, prohibit covered “operators” from collecting, using, sharing, and selling personal data of individuals under 18 years of age unless it is strictly necessary, as specified in such legislation, or where informed consent is obtained in accordance with specified requirements. This includes, in the case of individuals under 13 years of age, obtaining parental consent in a manner compliant with the Children’s Online Privacy Protection Act (“COPPA”). The FTC also has proposed significant updates to its rules implementing COPPA that, among other changes, would create new obligations, and strengthen certain existing obligations, relating to the collection and other processing of personal information from individuals under 13 years of age. 

The CCPA, CPRA, CAADCA