Company: RSKD
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001851112-25-000006
Chunk: 32

Company: RISKIFIED LTD.
Filing Date: 2025-03-06
Form: 20-F
Item: Item 3
Chunk 32
---
 produce a legal effect concerning an individual and also acts which similarly significantly affect the individual.

Depending on how regulators and courts apply this judgment going forward, it may have a significant impact on our business operations including our use of automated data processing to enable merchants to accept or decline an order.

In addition to the GDPR, we are subject to evolving EU and UK laws on cookies, tracking technologies and e-marketing. European and regulator court decisions are driving increased attention to cookies and tracking technologies. If the trend of increasing enforcement by regulators of the strict approach to opt-in consent for all but essential use cases, as seen in recent guidance and decisions continues, this could lead to additional costs, and could require significant systems changes, limit the effectiveness of our fraud detection capabilities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities. Regulation of cookies and similar technologies, and any decline of cookies or similar online tracking technologies as a means to identify and potentially target individuals, may lead to broader restrictions and impairments on our marketing and personalization activities, may negatively impact our efforts to understand users, and, as a result of us being able to process less data, make our automated decisioning process less accurate. In light of the complex and evolving nature of EU, EU Member State and UK privacy laws on cookies and tracking technologies, there can be no assurances that we will be successful in our efforts to comply with such laws; violations of such laws could result in regulatory investigations, fines, orders to cease/change our use of such technologies, as well as civil claims including class actions, and reputational damage.

On November 1, 2022, the Digital Markets Act, or the DMA, entered into force and on November 16, 2022, the Digital Services Act, or the DSA, followed. For the DSA, most provisions became applicable on February 17, 2024. The DSA and the DMA focus on creating a safer digital space, protecting fundamental rights of all users of digital services, and establishing a level playing field for businesses and consumers with regards to online platforms. The DSA and DMA, to the extent applicable, may require us to modify our practices and policies and we could incur substantial costs as a result.

In addition, we are also subject to the Israeli Privacy Protection Law, 5741-1981, and its regulations, including the Israeli Privacy Protection Regulations (Data Security), 5767-2017, or the Data Security Regulations, as well as the guidelines of