Company: IBTA
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001628280-25-008240
Chunk: 173

Company: Ibotta, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 173
---
, the California Consumer Privacy Act of 2018 (the CCPA) went into effect on January 1, 2020. The CCPA requires covered companies (including Ibotta) to, among other things, provide certain disclosures to California consumers, and afford such consumers abilities to opt-out of the sale of, to review, and to delete their personal information that is collected by businesses. The California Privacy Rights Act of 2020 (the CPRA) amended the CCPA and took effect on January 1, 2023. The CPRA, among other things, expanded the CCPA with additional privacy compliance obligations for businesses, provided additional rights to California consumers, and established a regulatory agency dedicated to enforcing those requirements. Similar legislation has been proposed or adopted in numerous other states. 

We have implemented a variety of technical and organizational security and other measures designed to protect our data and other data that we maintain, including data pertaining to our redeemers, employees, and business partners. Despite implementation of these measures, we may be unable to anticipate or prevent unauthorized access to, or unavailability, acquisition, corruption, loss, disclosure, or other processing of such data. The CCPA and similar laws impose significant statutory damages as well as a private right of action for certain data breaches that implicate consumers’ personal information. 

Actual or perceived non-compliance with applicable laws and regulations relating to privacy, data protection, cybersecurity, marketing, and consumer protection could result in litigation, claims, proceedings, actions or investigations by governmental entities, authorities or regulators, and significant financial penalties and related legal liabilities. There can be no assurance that we will not be subject to private claims or litigation or regulatory investigations or other action, or be subject to penalties, liabilities, 

18

or other obligations, including financial penalties, in the event of a security breach or incident or any actual or alleged failure to comply with laws, regulations, industry standards, contractual obligations or other actual or asserted obligations relating to privacy, data protection, cybersecurity, marketing, or consumer protection. We also could be adversely affected if new legislation or regulations are passed or existing laws or regulations are expanded and interpreted in manners that are inconsistent with our policies or practices or require changes in our business practices. Further, new and evolving legislation and regulations, and changes in their enforcement and interpretation, may require changes to our business practices, including our AI platform, and may significantly increase our compliance costs and otherwise adversely affect our business and results of operations. Any of these circumstances could adversely affect our business, financial condition,