Company: IHETW
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001400891-25-000009
Chunk: 54

Company: iHeartMedia, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 54
---
 public perception of the effectiveness of our security measures or services could be harmed and we could lose listeners, consumers, business partners and advertisers. In the event of a security breach, we could suffer financial exposure in connection with penalties, remediation and restoration efforts, investigations and legal proceedings (such as class action lawsuits) and changes in our security and system protection measures. 

We may be subject to rapidly evolving data security frameworks and/or laws that require us to maintain a certain level of security. For example, the Federal Trade Commission expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. In the event a domestic or EU/UK regulator or court were to determine we had not adequately complied with the security requirements under state privacy laws, the EU/UK General Data Protection Regulation (“GDPR”), and/or other data privacy, cybersecurity, consumer protection or related rules or regulations, we may be subject to regulatory and litigation proceedings, financial fines and penalties, injunctive requirements that negatively affect our business model, and/or costly remediation requirements. We may also be required to notify affected individuals and authorities in the event of a personal information breach. For example, the California Consumer Privacy Act and California Privacy Rights Act provide a private right of action to individuals and statutory damages for certain types of data breaches, and the GDPR provides potential fines up to EUR 20 million or 4% of worldwide annual turnover of the preceding financial year, whichever is greater. We expect these and other developing rules and regulations to increase both upfront compliance costs and liability exposure in the event of a cyberattack or security incident.

18

Additionally, as we accept debit and credit cards for payment, we are subject to the Payment Card Industry Data Security Standard (“PCI DSS”), issued by the Payment Card Industry Security Standards Council. PCI DSS contains compliance guidelines with regard to our security surrounding the physical and electronic storage, processing and transmission of cardholder data. If we or our service providers are unable to comply with the security standards established by banks and the payment card industry, we may be subject to fines, restrictions and expulsion from card acceptance programs, which could materially and adversely affect our business.

Furthermore, any losses, costs and/or liabilities directly or indirectly related to cyberattacks or other security incidents may not be covered by, or may exceed the coverage limits of, any of our insurance policies.

We use artificial intelligence in our business, and