Company: CAVA
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-007882
Chunk: 39

Company: CAVA GROUP, INC.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 39
---
 international laws and regulations regarding privacy, data protection, and cybersecurity that govern the Processing of personal information and other information. The scope of these laws and regulations is expanding and evolving, subject to differing interpretations, may be inconsistent among jurisdictions, or conflict with other rules. We are also subject to the terms of our privacy policies and obligations to third parties related to privacy, data protection, and cybersecurity.

For example, the California Consumer Privacy Act of 2018 (“CCPA”) took effect on January 1, 2020, which broadly defines personal information, gives California residents expanded privacy rights and protections, and provides for civil penalties for certain violations. Furthermore, in November 2020, California voters passed the California Privacy Rights and Enforcement Act of 2020 (“CPRA”), which amended and expanded CCPA with additional data privacy compliance requirements and establishes a regulatory agency dedicated to enforcing those requirements. On March 2, 2021, Virginia enacted the Virginia Consumer Data Protection Act, creating the second comprehensive U.S. state privacy law, which took effect on January 1, 2023 (the same day as CPRA took effect). An additional 17 states (Colorado, Connecticut, Iowa, Utah, Oregon, Montana, Tennessee, Indiana, Delaware, New Jersey, New Hampshire, Kentucky, Maryland, Minnesota, Nebraska, Rhode Island, and Texas), have since also passed comprehensive state privacy laws that impose additional obligations and requirements on businesses. Data privacy laws and regulations are constantly evolving and can be subject to significant change or interpretive application. Varying jurisdictional requirements could increase the costs and complexity of our compliance efforts and violations of applicable data privacy laws can result in significant penalties. In addition, laws, regulations, and standards covering marketing and advertising activities conducted by telephone, email, mobile devices and the internet are applicable to our business, including the Telephone Consumer Protection Act (the “TCPA”) and the Controlling the Assault of Non‑Solicited Pornography and Marketing Act (“CAN-SPAM Act”). The TCPA places certain restrictions on making outbound calls, faxes, and text messages to consumers. The CAN-SPAM Act imposes penalties for the transmission of commercial emails that do not comply with certain requirements, such as providing an opt-out mechanism for stopping future emails from the sender. 

Compliance with the current and future privacy and data protection laws can be costly and time-consuming and there is no assurance that our compliance efforts will be successful in preventing breaches or data loss. Any failure, or perceived failure, by us to comply with applicable