Company: MFON
Filing Date: 2025-04-07
Form Type: 10-K
Source: 0001641172-25-002942
Chunk: 130

Company: MOBIVITY HOLDINGS CORP.
Filing Date: 2025-04-07
Form: 10-K
Item: Item 1
Chunk 130
---
 each individual
    text message). U.S. state laws impose additional regulations on voice and text calls. We believe that our platform does not employ
    an ATDS within the meaning of the TCPA based on case law construing that term.

    ●
    
    CAN-SPAM.
    The U.S. Controlling the Assault of Non-Solicited Pornography and Marketing Act, or CAN SPAM Act, prohibits all commercial e-mail
    messages, as defined in the law, to mobile phones unless the device owner has given “express prior authorization.” Recipients
    of such messages must also be allowed to opt-out of receiving future messages the same way they opted-in. Senders have ten business
    days to honor opt-out requests. The FCC has compiled a list of domain names used by wireless service providers to which marketers
    may not send commercial e-mail messages. Senders have 30 days from the date the domain name is posted on the FCC site to stop sending
    unauthorized commercial e-mail to addresses containing the domain name. Violators are subject to fines of up to $6.0 million and
    up to one year in jail for some spamming activities. Carriers, the FTC, the FCC, and State Attorneys General may bring lawsuits to
    enforce alleged violations of the Act.

-7-

    ●
    
    Communications
    Privacy Acts. Foreign and U.S. federal and state laws impose liability for intercepting communications while in transit or accessing
    the contents of communications while in storage. EU member state laws also require consent for our receiving this information, and
    if our carrier customers fail to obtain such consent we could be subjected to civil or even criminal penalties.

    ●
    
    Security
    Breach Notification Requirements. EU member state laws require notice to the member state data protection authority of a data
    security breach involving personal data if the breach poses a risk to individuals. In addition, Germany enacted a broad requirement
    to notify individuals in the event of a data security breach that is likely to be followed by notification requirements to data subjects
    in other EU member states. In the U.S., various states have enacted data breach notification laws, which require notification of
    individuals and sometimes state regulatory bodies in the event of breaches involving certain defined categories of personal information.
    Japan and Uruguay have also enacted security breach notice requirements. This new trend suggests that breach notice statutes may
    be enacted in other jurisdictions, including by the U.S. at