Company: SKLZ
Filing Date: 2025-11-06
Form Type: 10-K
Source: 0001801661-25-000050
Chunk: 57

Company: Skillz Inc.
Filing Date: 2025-11-06
Form: 10-K
Item: Item 1A
Chunk 57
---
 certain personal data, or require the adoption of minimum information security standards that are often vaguely defined and difficult to practically implement. 

Various government and consumer agencies have called for new regulation and changes in industry practices and are continuing to review the need for greater regulation for the collection of information concerning consumer behavior  on the Internet, including regulation aimed at restricting certain targeted advertising practices. In the United States, there are numerous federal and state privacy laws, data breach notification laws, and consumer protection laws. For example, the State of California’s passage of the CCPA, which went into effect on January 1, 2020, created new privacy rights for consumers residing in the state. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. The CCPA allows for the California Attorney General to impose civil penalties and also provides a privacy right of action for certain data breaches. California voters also recently passed the California Privacy Rights Act (“CPRA”), which went into effect on January 1, 2023. The CPRA significantly modifies the CCPA, including by imposing additional obligations on covered companies and expanding California consumers’ rights with respect to certain sensitive personal information, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. Other states such as Virginia have also adopted similar privacy laws that became enforceable in 2023, or are considering adopting similar data protection laws, which may go into effect throughout 2025 and beyond. In addition, laws in all 50 states require businesses to provide notice to consumers whose personal information has been disclosed as a result of a data breach. There is also increased attention being given to the collection of data from minors. For instance, the Children’s Online Privacy Protection Act (“COPPA”) requires companies to obtain parental consent before collecting personal information from children under the age of 13.

We are also subject to international laws, regulations and standards in many jurisdictions, which apply broadly to the collection, use, retention, security, disclosure, transfer and other processing of personal information. For example, the GDPR, which became effective in May 2018, greatly increased the European Commission’s jurisdictional reach of its laws and added a broad array of requirements for handling personal data. The European Union (“EU”) member states are tasked under the GDPR to enact, and have enacted, certain implementing legislation that adds to and/or further interprets the GDPR requirements and potentially extends our obligations and potential