Company: VHC
Filing Date: 2025-11-14
Form Type: 10-Q
Source: 0001140361-25-042294
Chunk: 51

Company: VirnetX Holding Corp
Filing Date: 2025-11-14
Form: 10-Q
Item: Part II, Item 1L
Chunk 51
---
 to make significant changes to our products and operations to address compliance with the GDPR and similar legislation, such
        as the UK GDPR and UK Data Protection Act, all of which may adversely affect our revenue and product sales. California has enacted legislation, the California Consumer Privacy Act (CCPA) that, among other things, requires covered companies to
        provide disclosures to California consumers, and afford such consumers abilities to opt-out of certain sales of personal information. The CCPA was modified and expanded by the California Privacy Rights Act (CPRA), which was approved by California
        voters in the November 2020 election. Additionally, other U.S. states continue to propose, and in certain cases adopt, privacy-focused legislation. For example, Connecticut, Virginia, Utah and Colorado enacted legislation similar to the CCPA and
        CPRA that took effect in 2023; Florida, Montana, Oregon, and Texas have enacted similar legislation that has become effective in 2024; Delaware, Nebraska, Maryland, New Hampshire, New Jersey, Minnesota, Tennessee, and Iowa have enacted similar
        legislation that has or will become effective in 2025; and Indiana, Kentucky, and Rhode Island have enacted similar legislation that will become effective in 2026. The U.S. Department of Justice has also issued regulations regarding certain bulk
        sensitive personal data transfers. We cannot yet fully determine the impact these or future laws, regulations and standards may have on our business, but they may require us to modify our data processing practices and policies and to incur
        substantial costs and expenses in efforts to comply. Privacy, data protection and information security laws and regulations are often subject to differing interpretations, may be inconsistent among jurisdictions, and may be alleged to be
        inconsistent with our current or future practices. Additionally, we may be bound by contractual requirements applicable to our collection, use, processing, and disclosure of various types of data, including personal data, and may be bound by, or
        voluntarily comply with, self-regulatory or other industry standards relating to these matters. These and other requirements could reduce demand for our products, increase our costs, impair our ability to grow our business, or restrict our ability
        to store and process data or, in some cases, impact our ability to offer our service in some locations and may subject us to liability. Any failure or perceived failure to comply with applicable laws, regulations, industry standards, and
        contractual obligations may adversely affect our business. Further, in view of new or modified federal,