Company: GROVW
Filing Date: 2025-05-14
Form Type: 10-Q
Source: 0001628280-25-025541
Chunk: 38

Company: Grove Collaborative Holdings, Inc.
Filing Date: 2025-05-14
Form: 10-Q
Item: Part I, Item 3
Chunk 38
---
 rules and regulations promulgated under the authority of the Federal Trade Commission, the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the CCPA and other state and federal laws relating to privacy and data security. The CCPA, requires companies that process information of California residents to make new disclosures to consumers about their data collection, use and sharing practices, allows consumers to opt out of the sale of personal information with third parties and prohibits covered businesses from discriminating against California residents (for example, charging more for services) for exercising any of their rights under the CCPA. The law also provides a private right of action and statutory damages for certain data breaches that result in the loss of personal information. This private right of action is expected to increase the likelihood of, and risks associated with, data breach litigation. However, it remains unclear how various provisions of the CCPA will be interpreted and enforced. Therefore, the CCPA may increase our compliance costs and potential liability. In addition, the CPRA significantly modifies the CCPA, and imposes additional data protection obligations on companies doing business in California, resulting in further complexity. The law, among other things, gives California residents the ability to limit the use of their sensitive information, provides for penalties for CPRA violations concerning California residents under the age of 16, and establishes a new California Privacy Protection Agency to implement and enforce the law. The effects of this legislation are potentially far-reaching and may impact our business. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent privacy legislation in the United States, which could increase our potential liability and adversely affect our business, financial condition, results of operations and prospects.

Other jurisdictions in the United States have already passed or are considering laws similar to the CCPA and CPRA, with potentially greater penalties and more rigorous compliance requirements relevant to our business. Many state legislatures have already adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security, data breaches and the protection of sensitive and personal information. For example, on March 2, 2021, Virginia enacted the Virginia Consumer Data Protection Act (the “CDPA”), a comprehensive privacy statute that shares similarities with the CCPA, CPRA, and legislation proposed in other states. The CDPA, which became effective on January 1, 2023, has required and will require us to incur additional costs and expenses in an effort to comply with it. Colorado also has a similar law, the Colorado Privacy Act, which became effective on July