Company: GROVW
Filing Date: 2025-03-19
Form Type: 10-K
Source: 0001628280-25-013839
Chunk: 73

Company: Grove Collaborative Holdings, Inc.
Filing Date: 2025-03-19
Form: 10-K
Item: Item 1A
Chunk 73
---
 regarding the manner in which the express or implied consent of consumers for processing is obtained, could increase our costs and require us to modify our operations, possibly in a material manner, which we may be unable to complete and may limit our ability to store and process consumer data and operate our business.

We are or may also be subject to the terms of our external and internal privacy and security policies, codes, representations, certifications, industry standards, publications and frameworks (which we collectively refer to as “Privacy Policies”) and contractual obligations to third parties related to privacy, information security and processing, including contractual obligations to indemnify and hold harmless third parties from the costs or consequences of non-compliance with Data Protection Laws or Data Protection Obligations.

We may not be successful in achieving compliance if our employees, partners or vendors do not comply with applicable Data Protection Laws, Privacy Policies and Data Protection Obligations. If we or our vendors fail (or are perceived to have failed) to comply with applicable Data Protection Laws, Privacy Policies and Data Protection Obligations, or if our Privacy Policies are, in whole or part, found to be inaccurate, incomplete, deceptive, unfair, or misrepresentative of our actual practices, our business, financial condition, results of operations and prospects could be adversely affected.

In the United States, our obligations include rules and regulations promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the CCPA and other state and federal laws relating to privacy and data security. The CCPA, requires companies that process information of California residents to make new disclosures to consumers about their data collection, use and sharing practices, allows consumers to opt out of the sale of personal information with third parties and prohibits covered businesses from discriminating against California residents (for example, charging more for services) for exercising any of their rights under the CCPA. The law also provides a private right of action and statutory damages for certain data breaches that result in the loss of personal information. This private right of action is expected to increase the likelihood of, and risks associated 

33

with, data breach litigation. However, it remains unclear how various provisions of the CCPA will be interpreted and enforced. Therefore, the CCPA may increase our compliance costs and potential liability.

In addition, the CPRA significantly modifies the CCPA, and imposes additional data protection obligations on companies doing business in California, resulting in further complexity. The law, among other things, gives California residents the ability to limit the use of