Company: CRCT
Filing Date: 2025-03-05
Form Type: 10-K
Source: 0001828962-25-000039
Chunk: 32

Company: Cricut, Inc.
Filing Date: 2025-03-05
Form: 10-K
Item: Item 1
Chunk 32
---
 and state laws and foreign laws and regulations that involve matters central to our business, many of which are still evolving and could be interpreted in ways that could harm our business. These laws and regulations include laws governing, among other areas, privacy, data protection, information security, content regulation, intellectual property, competition, consumer protection, e-commerce, product liability, marketing, advertising, trade (e.g., sanctions, export controls and tariffs), and taxation. These laws and regulations are often complex, sometimes contradict other laws, and are frequently evolving. Laws and regulations may be interpreted, applied, created, amended, and enforced in different ways in various locations around the world, posing a significant challenge to our increasingly global business.

As we grow and expand our geographical reach and our offerings, we may become subject to additional regulations, in the United States and internationally.

In the European Union, or EU, the General Data Protection Regulation (EU) 2016/679, or GDPR, became effective on May 25, 2018. The GDPR is intended to create a single legal framework that applies across all EU member states. However, there are certain areas where EU member states can deviate from the requirements in their own legislation. It is therefore likely that we will need to comply with these local regulations in addition to the GDPR. Local supervisory authorities can impose fines for non-compliance and have the power to carry out audits, require companies to cease or change processing, request information and obtain access to premises. The GDPR created more stringent operational requirements for processors and controllers of personal data, including, for example, requiring enhanced disclosures to data subjects about how personal data is processed (including information about the profiling of individuals and automated individual decision-making), limiting retention periods of personal data, requiring mandatory data breach notification and requiring additional policies and procedures to comply with the accountability principle under the GDPR. In addition, data subjects have more robust rights with regard to their personal data. Similarly, other jurisdictions are instituting privacy and data protection and information security laws, rules, and regulations, which could increase our risk and compliance costs.

The United Kingdom has also adopted a version of the GDPR (combining the GDPR and the Data Protection Act 2018), each of which potentially authorizes similar fines and other potentially divergent enforcement actions. Furthermore, there will be increasing scope for divergence in application, interpretation and enforcement of data protection law between the United Kingdom and the EU. We continue to monitor and review the impact of any resulting changes to EU or United Kingdom law that could affect our operations