Company: ASAN
Filing Date: 2025-09-03
Form Type: 10-Q
Source: 0001477720-25-000200
Chunk: 180

Company: Asana, Inc.
Filing Date: 2025-09-03
Form: 10-Q
Item: Part I, Item 4
Chunk 180
---
 agreements. Violations of the rule could lead to significant civil and criminal fines and penalties.

Furthermore, the Federal Trade Commission and many state attorneys general continue to enforce federal and state consumer protection laws against companies and individuals for online data collection, use, dissemination, and security and privacy practices that appear to be unfair or deceptive. We also publish privacy policies, marketing materials, white papers, and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning privacy, data protection, and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may become subject to investigation, enforcement actions by regulators, or other adverse consequences. 

Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal information. For example, some of our data processing practices have been, and may in the future continue to be, subject to challenges or lawsuits under privacy, data protection, and communications laws, including, for example, challenges based on wiretapping laws for sharing consumer information with third parties through various methods, including chatbot and session replay providers, or via third-party marketing pixels. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands. 

There are a number of legislative proposals in the United States, at both the federal and state level, and in the European Union and more globally, that could impose new obligations in areas such as e-commerce, data processing, and other related legislation or liability for copyright infringement by third parties. We cannot yet determine the impact that future laws, regulations, and standards may have on our business. For example, the European Union’s Data Act (the “Data Act”) will be fully applicable on September 12, 2025. Among other things, the Data Act will affect customers’ ability to terminate service agreements with us or our competitors. Compliance with the Data Act may require us to adjust contract terms and technical measures for data portability. These changes may impact the duration of customer relationships and result in additional compliance and operational costs, which may affect our business.

64

In addition to privacy, data protection, and security laws, we are or may become contractually subject to industry standards adopted by industry groups and may become subject to such obligations in the future. We are also bound by other contractual obligations related to privacy, data protection, and security, and our efforts to comply with