Company: FSLY
Filing Date: 2025-05-07
Form Type: 10-Q
Source: 0001517413-25-000111
Chunk: 494

Company: Fastly, Inc.
Filing Date: 2025-05-07
Form: 10-Q
Item: Part I, Item 2
Chunk 494
---
 products, services, or benefits.

Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development, deployment and use of AI, such as the European Union’s (the “EU”) AI Act. We expect other jurisdictions will adopt similar laws. Additionally, existing laws and regulations may be interpreted in ways that could affect our use of AI, or could be rescinded or amended as new administrations take differing approaches to evolving AI. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet completely determine the impact future laws, regulations, standards, or market perception of their requirements may have on our business and may not always be able to anticipate how to respond to these laws or regulations. Therefore, this uncertainty may make it harder for us to conduct our business using AI, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI, or prevent or limit our use of AI. If we cannot use or are restricted in using AI technologies, or deployment of AI by our customers using our platform is affected, our business and results of operations may be harmed, and we may be at a competitive disadvantage.

Outside of the United States, an increasing number of foreign laws and regulations apply to privacy and data security. For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), (collectively “GDPR”) Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais or “LGPD”) (Law No. 13,709/2018), Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and Canada’s Anti-Spam Legislation (“CASL”), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing the personal information of individuals. For example, under the GDPR, government regulators may impose restrictions or injunctions on data processing, and fines of up to 20 million euros (£17.5 million) or 4% of annual global revenue, whichever is greater. The GDPR also provides for private litigation related to the processing of personal information, which can be brought by classes of data subjects or consumer protection organizations authorized by law to represent the interests of such classes. European legislative proposals and existing laws and regulations also apply to cookies and similar tracking technologies, electronic communications, and marketing. In the EU and the United Kingdom ("UK"), regulators are increasingly focusing