Company: CRCT
Filing Date: 2025-03-05
Form Type: 10-K
Source: 0001828962-25-000039
Chunk: 116

Company: Cricut, Inc.
Filing Date: 2025-03-05
Form: 10-K
Item: Item 1A
Chunk 116
---
 the event a court finds the exclusive forum provision contained in our amended and restated bylaws to be unenforceable or inapplicable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could harm our results of operations.

General Risk Factors

Our business is subject to a large number of U.S. and non-U.S. laws, many of which are evolving, including laws specific to e-commerce.

We are subject to a variety of laws and regulations in the United States and around the world, including those relating to traditional businesses, such as employment laws and taxation, as well as laws and regulations focused on e-commerce and online marketplaces, such as online payments, privacy, anti-spam, data security and protection, online platform liability, intellectual property and consumer protection, the ability to collect and/or share necessary information that allows us to conduct business on the Internet, marketing communications and advertising, content protection, electronic contracts or gift cards. In addition, emerging technologies we utilize, including artificial intelligence and machine learning, may also become subject to regulation under new laws or new applications of existing laws. In some cases, non-U.S. privacy, data protection, information security, consumer protection, e-commerce and other laws and regulations are more detailed than those in the United States and, in some countries, are actively enforced.

These laws and regulations are continuously evolving, and compliance is costly and could require changes to our business practices and significant management time and effort, or may result in enforcement actions or litigation. For example, California’s Automatic Renewal Law requires companies to adhere to enhanced disclosure requirements when entering into automatically renewing contracts with consumers. As a result, a wave of consumer class action lawsuits was brought against companies that offer online products and services on a subscription or recurring basis. Other laws, like the CCPA and the EU’s GDPR, require us to implement reasonable privacy and security measures, including applying security requirements by contract to certain service providers and processors acting on our behalf, as well as requiring certain privacy and security disclosures to consumers and employees. In some jurisdictions, these laws and regulations may be subject to attempts to apply such domestic rules world-wide against us or our subsidiaries. Additionally, it is not always clear how existing laws apply to online marketplaces as many of these laws do not address the unique issues raised by online marketplaces or e-commerce. For example, as described elsewhere in this Risk Factors section, laws relating to privacy, data protection and information security are evolving differently in different jurisdictions. Federal, state and