Company: CAVA
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-007882
Chunk: 114

Company: CAVA GROUP, INC.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 114
---
 state and non-U.S. governmental authorities, as well as courts interpreting the laws, continue to evaluate the privacy implications of the use of third-party cookies, pixels, and other methods of online tracking. The United States and other governments have enacted or are considering legislation that could significantly restrict the ability of companies and individuals to collect and store user information, such as by regulating the level of consumer notice and consent required before a company can employ cookies, pixels, or other electronic tracking tools or the use of data gathered with such tools. As the collection and 

26

use of data for digital advertising has received ongoing media attention over the past several years, there has been an array of ‘do-not-track’ efforts, suggestions and technologies introduced to address these concerns, and comprehensive state privacy laws are beginning to incorporate the obligations. Under various privacy laws and other obligations, we may be required to obtain certain consents to process personal information. Some of our data processing practices may be challenged under wiretapping laws, if we obtain consumer information from third parties through various methods, including chatbot and session replay providers, or via third-party marketing pixels. Recently, these practices have been subject to increased challenges by class action plaintiffs, as a number of recent lawsuits have pled claims under privacy legislation such as the Video Privacy Protection Act, Electronic Communications Privacy Act (including the WireTap Act and Stored Communications Act), Computer Fraud and Abuse Act, California Online Privacy Protection Act, and similar state laws alleging wiretapping, eavesdropping, tape recording and invasion of privacy through the use of marketing pixels, analytics software, session replay technology, voice recording, and live chat functionality. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands. Such a demand could allow for the recovery of statutory damages on a per violation basis, which could be significant depending on the volume of data and the number of violations. 

Additionally, the information, security, and privacy requirements imposed by governmental regulation are increasingly demanding and evolving. Laws require businesses to notify affected individuals, governmental entities, and/or credit reporting agencies of certain security incidents affecting personal information. Such laws are not all consistent, and compliance in the event of a widespread security incident is complex and costly and may be difficult to implement. Our existing general liability and cyber liability insurance policies may not cover, or may cover only a portion of, any potential claims related to security breaches to which we are exposed or may not be adequate to indemnify us for all or any portion of liabilities that