Company: CAVA
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-007882
Chunk: 113

Company: CAVA GROUP, INC.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 113
---
 and protections, and provides for civil penalties for certain violations. Furthermore, in November 2020, California voters passed the California Privacy Rights and Enforcement Act of 2020 (“CPRA”), which amended and expanded CCPA with additional data privacy compliance requirements and establishes a regulatory agency dedicated to enforcing those requirements. On March 2, 2021, Virginia enacted the Virginia Consumer Data Protection Act, creating the second comprehensive U.S. state privacy law, which took effect on January 1, 2023 (the same day as CPRA took effect). An additional 17 states (Colorado, Connecticut, Iowa, Utah, Oregon, Montana, Tennessee, Indiana, Delaware, New Jersey, New Hampshire, Kentucky, Maryland, Minnesota, Nebraska, Rhode Island, and Texas), have since also passed comprehensive state privacy laws that impose additional obligations and requirements on businesses. Data privacy laws and regulations are constantly evolving and can be subject to significant change or interpretive application. Varying jurisdictional requirements could increase the costs and complexity of our compliance efforts and violations of applicable data privacy laws can result in significant penalties. In addition, laws, regulations, and standards covering marketing and advertising activities conducted by telephone, email, mobile devices and the internet are applicable to our business, including the Telephone Consumer Protection Act (the “TCPA”) and the Controlling the Assault of Non‑Solicited Pornography and Marketing Act (“CAN-SPAM Act”). The TCPA places certain restrictions on making outbound calls, faxes, and text messages to consumers. The CAN-SPAM Act imposes penalties for the transmission of commercial emails that do not comply with certain requirements, such as providing an opt-out mechanism for stopping future emails from the sender. 

Compliance with the current and future privacy and data protection laws can be costly and time-consuming and there is no assurance that our compliance efforts will be successful in preventing breaches or data loss. Any failure, or perceived failure, by us to comply with applicable data protection or other laws, properly respond to security breaches of our or a third party’s information technology systems or properly respond to or honor consumer requests under any of the foregoing privacy laws could result in reputational damage, loss of consumer confidence, reduced sales and profits, proceedings or actions against us by governmental entities or others, subject us to significant fines, penalties, judgments, and negative publicity, require us to change our business practices, increase the costs and complexity of compliance, and adversely affect our business.

In addition, laws relating to online privacy are evolving differently in different jurisdictions. Federal,