Company: MTCH
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000891103-25-000027
Chunk: 72

Company: Match Group, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 72
---
 monetary penalties, or other harm to our business” and “—Risks relating to our business—We may fail to adequately protect our intellectual property rights or may be accused of infringing the intellectual property rights of third parties.”

Because we receive, store, and use a substantial amount of information received from or generated by our users, we are particularly impacted by laws and regulations governing privacy; the storage, sharing, use, processing, disclosure, transfer, and protection of personal data; and data breaches, in many of the countries in which we operate. For example, in the EU we are subject to the General Data Protection Act (“GDPR”), which applies to companies established in the EU or otherwise providing services or monitoring the behavior of people located in the EU and provides for significant penalties in case of non-compliance as well as a private right of action for individual claimants. GDPR will continue to be interpreted by EU data protection regulators, which have and may in the future require that we make changes to our business practices, and could generate additional costs, risks, and liabilities. See “Item 3 Legal Proceedings—Irish Data Protection Commission Inquiry Regarding Tinder’s Practices.” The EU is also considering an update to its Privacy and Electronic Communications (so-called “e-Privacy”) Directive, notably to amend rules on the use of cookies, direct marketing and processing of private communications and related metadata, which may also require that we make changes to our business practices and could generate additional costs, risks and liabilities. In 2020, the Court of Justice of the EU declared transfers of personal data on the basis of the European Commission’s Privacy Shield Decision illegal and 

9

stipulated stricter requirements for the transfer of personal data based on standard contract clauses to non-EU countries. In 2023, the EU-U.S. Data Privacy Framework was adopted and extended to certain other European countries to provide U.S. organizations with reliable mechanisms for personal data transfers to the United States from the EU as well as certain other European countries, while ensuring data protection that is consistent with applicable law. Compliance with the various EU data transfer requirements, and the resulting interpretations, decisions, and guidelines from EU supervisory authorities, may require changes to our business practices and generate additional costs, risks, and liabilities.

At the same time, many countries in which we do business have already adopted or are also currently considering adopting privacy and data protection laws and regulations. For instance, multiple legislative proposals concerning privacy and the protection of user information have been introduced in the U.S. Congress. Various U