Company: WW
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029511
Chunk: 110

Company: WW INTERNATIONAL, INC.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 110
---
 and products. In addition, the GDPR requires submission of personal data breach notifications to our designated European privacy regulator. The GDPR also includes significant penalties for non-compliance with any of several requirements of the regulation. Data protection and privacy laws have also been enacted by the U.S. federal and state governments, including the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”), the Health Insurance Portability and Accountability Act, as amended, and implementing privacy, security, and breach regulations (collectively, “HIPAA”), state laws on sensitive health information, and other relevant statutes and regulations. The FTC also has authority to initiate enforcement actions against entities where such companies’ failure to keep personal information secure may constitute unfair and/or deceptive acts or practices in violation of Section 5(a) of the Federal Trade Commission Act. The FTC may also impose penalties for violations of the Health Breach Notification Rule. These laws also typically include notification obligations and impose significant penalties and potential liability for non-compliance. The data privacy and security regulatory regime continues to evolve and is increasingly demanding. Recently, several states enacted broadly applicable laws to protect the privacy of personal health information. These laws generally require consent for the collection, use, or sharing of any “consumer health data”, which is defined as personal information that is linked or reasonably linkable to a consumer and that identifies a consumer’s past, present, or future physical or mental health. Many states are considering privacy and security legislation and there are ongoing discussions regarding a national privacy law. Variations in requirements across jurisdictions could result in increased compliance challenges and costs, and any failures to comply with such requirements may have an adverse effect on our business or results of operations.

Further, many jurisdictions require that customers be notified if a security breach results in the disclosure of their personal financial account or other information, and additional jurisdictions and governmental entities are considering such laws. In addition, other public disclosure laws require that material security breaches be reported timely. If we experience, or in certain cases suspect, a security breach and such notice or public disclosure is required in the future, our reputation, brands and business may be harmed. Prospective and existing customers and clients may have concerns regarding our use, or the use by third parties, of private information or data collected on our apps and websites or through our services and products, such as weight management information, health information, financial data, email addresses and home addresses. These privacy concerns could keep customers and clients from using our apps and websites or purchasing our services or products, and