Company: FSLY
Filing Date: 2025-05-07
Form Type: 10-Q
Source: 0001517413-25-000111
Chunk: 495

Company: Fastly, Inc.
Filing Date: 2025-05-07
Form: 10-Q
Item: Part I, Item 2
Chunk 495
---
 on compliance with requirements related to the online behavioral advertising ecosystem. It is anticipated that the ePrivacy Regulation and national implementing laws will replace the current national laws that implement the ePrivacy Directive that governs electronic communications. Compliance with these laws may require us to make significant operational changes, limit the effectiveness of our marketing activities, divert the attention of our technology personnel, adversely affect our margins, and subject us to liabilities. Furthermore, there is a new regulation in the EU related to AI that will impose onerous obligations related to the use of AI-related systems and may require us to change our business practices. We may also become subject to new laws in the EU that regulate cybersecurity and non-personal information, such as the European Data Act. 

73

Depending on how these laws are interpreted, we may have to adapt our business practices and products to comply with such obligations.

Certain jurisdictions have enacted data localization laws and cross-border personal information transfer laws, which could make it more difficult to transfer information across jurisdictions. In particular, the European Economic Area (“EEA”) and the UK have significantly restricted the transfer of personal information to the United States and other countries whose privacy and data security laws are generally believed to be inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border personal information transfer laws. Although there are currently various mechanisms that may be used to lawfully transfer personal information to the United States, such as the standard contractual clauses for transfers from the EEA and UK, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the United States or elsewhere. Certain countries outside Europe (e.g., Russia, China, Brazil) have also passed or are considering laws requiring local data residency or otherwise impeding the transfer of personal information across borders, any of which could increase the cost and complexity of doing business. 

If there is no lawful manner for us to transfer personal information from the EEA, the UK or other jurisdictions to the United States or elsewhere, or if the requirements for a legally-compliant transfer are too onerous, we may face significant adverse consequences, such as the interruption or degradation of our operations, increased exposure to regulatory actions, substantial fines, injunctions against processing or transferring personal information, determinations by customers not to