Company: CRCL
Filing Date: 2025-02-13
Form Type: DRS/A
Source: 0000950123-25-001965
Chunk: 100

Company: Circle Internet Group, Inc.
Filing Date: 2025-02-13
Form: DRS/A
Chunk 100
---
 into force its adequacy decision for the EU-U.S. Data Privacy Framework (the
“EU-U.S. DPF”) (a new framework for transferring personal information from the EEA to the United States), having determined that such framework ensures that the protection of personal information transferred from the EEA to the United
States will be comparable to the protection offered in the EU. However, this decision will likely face legal challenges and ultimately may be invalidated by the Court of Justice of the European Union just as the
EU-U.S. Privacy Shield Framework was. Additionally, on October 12, 2023, a UK-U.S. Data Bridge went into effect to operate as an extension of the EU-U.S. DPF to
facilitate transfers of personal data from the United Kingdom to the United States. Such Data Bridge could not only be challenged, but also may be affected by any challenges to the EU-U.S. DPF. Complying with these obligations and applicable
guidance regarding cross-border data transfers could be expensive and time-consuming. It may require us to modify our data handling policies and procedures, update and implement revised standard contractual clauses and other relevant documentation
and measures for intragroup, customer, and vendor arrangements requiring transfers of personal information, and may ultimately prevent or restrict us from transferring personal data outside Europe or the United Kingdom, which could cause significant
business disruption and affect the manner in which we provide our services and the geographical location or segregation of our relevant systems and operations.

We
are also subject to evolving EU privacy laws on cookies and e-marketing. In the EU, regulators are increasingly focusing on compliance with requirements in the online behavioral advertising ecosystem, and EU
national laws that implement the ePrivacy Directive (Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector) may be replaced by an EU regulation known as the ePrivacy
Regulation, which may alter rules on tracking technologies, impose burdensome requirements surrounding obtaining consent, and significantly increase fines for noncompliance. In the EU, informed consent—including a prohibition on pre-checked consents and a requirement to ensure separate consents for each cookie—is required for the placement of a cookie or similar technologies on a user’s device and for direct electronic marketing
(and under the GDPR and the UK GDPR). Valid consent is tightly defined, including a prohibition on pre-checked consents for each type of cookie or similar technology. While the text of the ePrivacy Regulation
is still under development, enforcement