Company: CDLX
Filing Date: 2025-04-03
Form Type: ARS
Source: 0001666071-25-000048
Chunk: 49

Company: Cardlytics, Inc.
Filing Date: 2025-04-03
Form: ARS
Chunk 49
---
 business, for legal and marketing purposes, and for other business-related purposes. We, our FI partners, our marketers and other third parties with whom we work are subject to a number of data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy policies, contractual requirements, and other obligations relating to data privacy and security as well as laws and regulations regarding online services and the Internet generally. In the U.S., the rules and regulations to which we, directly or contractually through our partners, or our marketers are or may be subject, include but are not limited to those promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act, the Gramm-Leach-Bliley Act and state cybersecurity, privacy and breach notification laws, as well as regulator enforcement positions and expectations reflected in federal and state regulatory actions, settlements, consent decrees and guidance documents. The regulatory framework for online services and data privacy and security issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future. Many of these obligations conflict with each other, and interpretation of these laws, rules and regulations and their application to our solutions in the U.S. and foreign jurisdictions is ongoing and cannot be fully determined at this time. A number of existing bills are pending in the U.S. federal and state legislatures that contain provisions that would regulate how companies can use various tracking technologies to collect and utilize user information. Additionally, new legislation proposed or enacted in various states will continue to shape the data privacy environment nationally. The California Consumer Privacy Act ("CCPA") is an example of the trend towards increasingly comprehensive privacy legislation being introduced in the U.S. The CCPA gives California residents expanded rights to request access to and deletion of their personal data, opt out of certain personal data sharing, and receive detailed information about how their personal data is used. The CCPA also increases the data privacy and security obligations on entities handling personal data, which is broadly defined under the law. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches, and includes statutorily defined damages for intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages, which is expected to increase data breach litigation. The CCPA also imposes requirements on businesses that "sell" information (which is defined broadly under the CCPA); there is significant