Company: DOMO
Filing Date: 2025-09-05
Form Type: 10-Q
Source: 0001505952-25-000075
Chunk: 35

Company: DOMO, INC.
Filing Date: 2025-09-05
Form: 10-Q
Item: Item 1A
Chunk 35
---
 could impair our efforts to maintain and expand our customer base, causing our growth to be limited and harming our business.

We receive, store, and otherwise process personal information and other data from and about customers and other individuals in addition to our employees and service providers. Our handling of data is subject to a variety of laws and regulations, including regulation by various government agencies, such as the U.S. Federal Trade Commission (the FTC) and various state, local, and foreign agencies. Our data handling also is subject to contractual obligations and may be alleged or deemed to be subject to industry standards, including certain industry standards that we undertake to comply with.

In the United States, various laws and regulations apply to the collection, disclosure, and other processing of certain types of data, including with respect to security measures used to protect such data. Additionally, the FTC and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the collection, use, dissemination, security, and other processing of data. The laws and regulations relating to privacy and cybersecurity are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. For example, California in 2018 enacted the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020. The CCPA requires covered companies to, among other things, provide disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in November 2020 and became effective January 1, 2023. The CPRA amended and expanded the CCPA in numerous respects, including by expanding the CCPA’s private right of action. Following enactment of the CCPA, many other states have adopted or considered privacy legislation, many of which are comprehensive laws similar to the CCPA and CPRA. For example, Virginia, Colorado, Utah, and Connecticut have adopted such legislation that has become effective in 2023, Texas, Montana, Oregon, and Florida have adopted such legislation that became effective in 2024, Delaware, Iowa, Maryland, Minnesota, 

62

Nebraska, New Hampshire, New Jersey, and Tennessee have adopted such legislation that will become effective in 2025, and Indiana, Kentucky, and Rhode Island have adopted such legislation that has become or will become effective in 2026. Broad federal privacy legislation has also been proposed. Additionally, states have adopted other laws