Company: LPSN
Filing Date: 2025-03-14
Form Type: 10-K
Source: 0001102993-25-000018
Chunk: 55

Company: LIVEPERSON INC
Filing Date: 2025-03-14
Form: 10-K
Item: Item 1A
Chunk 55
---
 businesses to divergent parallel regimes that may be subject to potentially different interpretations and enforcement actions for certain violations and related uncertainty. The GDPR and U.K. GDPR also impose certain technological requirements that may, from time to time, require us to make changes to our services to enable LivePerson and/or our customers to meet legal requirements and may impact how data protection is addressed in our customer and vendor agreements. E.U. and U.K. regulators have issued numerous fines pursuant to the GDPR and U.K. GDPR, respectively. Ensuring compliance with the GDPR and U.K. GDPR is an ongoing commitment that involves substantial costs, and it is possible that despite our efforts, governmental authorities or third parties will assert that our services or business practices fail to comply. We also must require vendors that process personal data to take on additional privacy and security obligations, and some may refuse, causing us to incur potential disruption and expense related to our business processes. If our policies and practices, or those of our vendors, are, or are perceived to be, insufficient, we could be subject to enforcement actions or investigations by Data Protection Authorities (including in the E.U. and U.K.) or lawsuits by private parties, and our business could be negatively impacted.

The E.U. has also released a proposed Regulation on Privacy and Electronic Communications (“e-Privacy Regulation”) to replace the E.U.’s Privacy and Electronic Communications Directive (“e-Privacy Directive”) to, among other things, better align with the GDPR, to amend the current e-Privacy Directive’s rules on the use of cookies and other tracking technologies, and to harmonize across current E.U. member state e-privacy data protection laws. Compliance with changes in laws and regulations related to privacy may require significant cost, limit the use and adoption of our services, and require material changes in our business practices that result in reduced revenue. Noncompliance could result in material fines and penalties, litigation, regulatory investigation and/or governmental orders requiring us to change our data practices, which could damage our reputation and harm our business.

Additionally, complexity and regulatory compliance uncertainty under the GDPR regarding certain transfers of personal information from the European Economic Area (the “EEA”) to the United States and certain other third countries remains. For example, on October 7, 2022, President Biden signed an Executive Order on “Enhancing Safeguards for United States Intelligence Activities,” which introduced new redress mechanisms and binding safeguards to address concerns raised in 2020 by the Court of Justice of the European Union in relation to data transfers from the