Company: ARAI
Filing Date: 2025-01-27
Form Type: S-1/A
Source: 0001493152-25-003660
Chunk: 45

Company: Arrive AI Inc.
Filing Date: 2025-01-27
Form: S-1/A
Chunk 45
---
 to disclose their data collection, use and sharing practices. Further, the CCPA provides California residents with new data privacy rights (including the ability to opt out of certain disclosures of personal data), imposes new operational requirements for covered businesses, provides for civil penalties for violations as well as a private right of action for data breaches and statutory damages (which is expected to increase data breach class action litigation and result in significant exposure to costly legal judgements and settlements). Aspects of the CCPA and its interpretation and enforcement remain uncertain. In addition, the California Privacy Rights Act of 2020 (the “CPRA”), which took effect January 1, 2023, expanded the CCPA. The CPRA, among other things, gives California residents the ability to limit use of certain sensitive personal information, further restricts the use of cross-contextual advertising, establishes restrictions on the retention of personal information, expands the types of data breaches subject to the CCPA’s private right of action, provides for increased penalties for CPRA violations concerning California residents under the age of 16, and establishes a new California Privacy Protection Agency to implement and enforce the CPRA. The CCPA and other similar laws could impact our business activities depending on how they are interpreted. New legislation proposed or enacted in various other states will continue to shape the data privacy environment nationally. For example, Virginia recently passed its Consumer Data Protection Act, and Colorado recently passed the Colorado Privacy Act, both of which differ from the CPRA and became effective in 2023. Additional states have since also passed comprehensive privacy laws with additional obligations and requirements on businesses. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to confidential, sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which may complicate compliance efforts. Additionally, all U.S. states and the District of Columbia have enacted breach notification laws that may require that we notify customers, employees or regulators in the event of unauthorized access to or disclosure of personal or confidential information experienced by us or our service providers. These laws are not consistent, and compliance in the event of a widespread data breach is difficult and may be costly. Moreover, states have been frequently amending existing laws, requiring attention to changing regulatory requirements. We also may be contractually required to notify customers of a security breach. Although we may have contractual protections with our service providers, any actual or perceived security breach could harm our reputation and brand, expose us to potential liability or require