Company: ASAN
Filing Date: 2025-12-02
Form Type: 10-Q
Source: 0001477720-25-000237
Chunk: 407

Company: Asana, Inc.
Filing Date: 2025-12-02
Form: 10-Q
Item: Part I, Item 2
Chunk 407
---
 The enactment of such laws could have potentially conflicting requirements that would make compliance challenging, and increase legal risk and compliance costs for us and the third parties with whom we work.

Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, and Iran) and covered individuals (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions) that may impact certain business activities such as vendor engagements, sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties.

Furthermore, the Federal Trade Commission and many state attorneys general continue to enforce federal and state consumer protection laws against companies and individuals for online data collection, use, dissemination, and security and privacy practices that appear to be unfair or deceptive. We also publish privacy policies, marketing materials, white papers, and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning privacy, data protection, and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may become subject to investigation, enforcement actions by regulators, or other adverse consequences. 

Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal information. For example, some of our data processing practices have been, and may in the future continue to be, subject to challenges or lawsuits under privacy, data protection, and communications laws, including, for example, challenges based on wiretapping laws for sharing consumer information with third parties through various methods, including chatbot and session replay providers, or via third-party marketing pixels. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands. 

There are a number of legislative proposals in the United States, at both the federal and state level, and in the European Union and more globally, that could impose new obligations in areas such as e-commerce, data 

65

processing, and other related legislation or liability for copyright infringement by third parties. We cannot yet determine the impact that future laws, regulations, and standards may have on our business. For example, the European Union’s Data Act (the “Data Act”)