Company: GROVW
Filing Date: 2025-11-13
Form Type: 10-Q
Source: 0001841761-25-000048
Chunk: 39

Company: Grove Collaborative Holdings, Inc.
Filing Date: 2025-11-13
Form: 10-Q
Item: Part I, Item 3
Chunk 39
---
 our business. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent privacy legislation in the United States, which could increase our potential liability and adversely affect our business, financial condition, results of operations and prospects.

Other jurisdictions in the United States have already passed or are considering laws similar to the CCPA and CPRA, with potentially greater penalties and more rigorous compliance requirements relevant to our business. Many state legislatures have already adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security, data breaches and the protection of sensitive and personal information. For example, on March 2, 2021, Virginia enacted the Virginia Consumer Data Protection Act (the “CDPA”), a comprehensive privacy statute that shares similarities with the CCPA, CPRA, and legislation proposed in other states. The CDPA, which became effective on January 1, 2023, has required and will require us to incur additional costs and expenses in an effort to comply with it. Colorado also has a similar law, the Colorado Privacy Act, which became effective on July 1, 2023. Many other states have adopted or are currently considering proposed comprehensive data privacy legislation and all 50 states have passed at least some form of data privacy legislation (for example, all 50 states have enacted laws requiring disclosure of certain personal 

64

data breaches). At the federal level, the United States Congress is also considering various proposals for comprehensive federal data privacy legislation and, while no comprehensive federal data privacy law currently exists, we are subject to applicable existing federal laws and regulations, such as the rules and regulations promulgated under the authority of the FTC, which regulates unfair or deceptive acts or practices, including with respect to data privacy and security. These state statutes, and other similar state or federal laws, may require us to modify our data processing practices and policies and incur substantial compliance-related costs and expenses.

We rely on a variety of marketing techniques and practices, including email and social media marketing, online targeted advertising, cookie-based processing, and postal mail to sell our products and services and to attract new consumers, and we, and our vendors, are subject to various current and future Data Protection Laws and Data Protection Obligations that govern marketing and advertising practices. Governmental authorities continue to evaluate the privacy implications inherent in the use of third-party “cookies” and other methods of online tracking for behavioral advertising and other purposes, such as by regulating the level of consumer notice and consent required before a company can employ cookies or other electronic