Company: YEXT
Filing Date: 2025-06-09
Form Type: 10-Q
Source: 0001614178-25-000077
Chunk: 95

Company: Yext, Inc.
Filing Date: 2025-06-09
Form: 10-Q
Item: Part I, Item 4
Chunk 95
---
, including unique online identifiers. For example, the California Consumer Privacy Act of 2018, or CCPA, originally became effective January 1, 2020 and an amended version became effective on January 1, 2023. The amended CCPA requires covered businesses to, among other things, make new disclosures to consumers about their data collection, use, and sharing practices, and allows consumers to opt out of certain data sharing with third parties. Under the amended CCPA, consumers include individuals that interact with us in a professional or employment capacity. The CCPA provides a limited private cause of action for certain data breaches. Numerous other states have proposed, and in many cases, enacted, privacy legislation. The effects of such state privacy laws are potentially significant and may require us to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation. We expect additional states may continue to enact data protection legislation that may be similar to or different from the state privacy laws already adopted. 

Additionally, the FTC and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the collection, use, dissemination, and security of personal data. We may be required to incur costs and expenses to stay in compliance with these interpretations, and if we were found to have violated consumer protection laws, we may face enforcement actions which could adversely affect our business. We also may be subject to laws and rules implemented and enforced by the FTC, the Federal Communications Commission, or FCC, and potentially other federal agencies, as well as state, local or international laws and regulations related to marketing, advertising, commercial electronic mail and other messages. Compliance with these requirements may limit our ability to engage in certain marketing and advertising activities. If we were found to have violated such requirements, we may face enforcement actions and/or face civil penalties, either of which could adversely affect our business.

Several foreign countries and governmental bodies, including the European Union, Switzerland and the United Kingdom have laws and regulations dealing with the processing of personal data obtained about their residents, which in certain cases are more restrictive than those in the United States. We expect that additional jurisdictions may enact similar requirements. Laws and regulations in these jurisdictions can apply broadly to the collection, use, storage, disclosure and security of various types of data, 

57

including personal data, such as names, email addresses and in some jurisdictions, unique online identifiers like Internet Protocol, or IP, addresses.

In particular, in the European Union, the GDPR became effective in May 2018