Company: AIP
Filing Date: 2025-05-13
Form Type: 10-Q
Source: 0001667011-25-000022
Chunk: 310

Company: Arteris, Inc.
Filing Date: 2025-05-13
Form: 10-Q
Item: Part I, Item 8
Chunk 310
---
 information and expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is collected, used and shared. The CCPA provides for civil penalties for violations, as well as a private right of action for security breaches that may increase security breach litigation. The California Privacy Rights Act (CPRA) passed in California significantly amended the CCPA and imposed additional data protection obligations on covered businesses, including additional consumer rights, new cybersecurity audit requirements for businesses whose processing of personal information presents significant risk to consumer’s privacy or security, and opt outs for certain uses of sensitive personal information. As part of the CPRA, a new California Privacy Protection Agency is authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The majority of the provisions went into effect on January 1, 2023, and additional compliance investment and potential business process changes may be required, including as the California Privacy Protection Agency continues to issue regulations. Further, several other states have passed state privacy laws. These state privacy laws may increase our compliance costs and potential liability, and could harm our business, including how we use personal information. A number of other proposals exist for new federal and state privacy legislation that, if passed, could increase our potential liability, increase our compliance costs and harm our business.

Our operations abroad may also be subject to increased scrutiny or attention from data protection authorities. For example, the EU General Data Protection Regulation (EU GDPR) and the U.K. General Data Protection Regulation and the U.K. Data Protection Act 2018 (UK GDPR) (collectively, the GDPR) imposes comprehensive data privacy compliance obligations on our collection, processing, sharing, disclosure, transfer and other use of data relating to an identifiable living individual or “personal data”. The EU and U.K. regimes also include laws which, among other things, require European Economic Area (EEA) member states and the U.K. to regulate marketing by electronic means and the use of cookies and similar technologies. The GDPR has resulted in, and will continue to result in, significant compliance burdens and costs for companies with customers and/or operations in the EEA and the U.K. The GDPR, and national implementing legislation in each member state, imposes a data protection compliance regime including: (i) providing detailed disclosures about how personal data is collected and processed; (ii) demonstrating that an appropriate legal basis is in place or otherwise exists to justify data processing activities; (iii) granting certain rights for data subjects in regard to