Company: WRBY
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001504776-25-000010
Chunk: 201

Company: Warby Parker Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 201
---
 limited exceptions, allow individuals to access and correct their personal information, and report certain data breaches. In addition, Canada’s 

32

Anti-Spam Legislation, or CASL, prohibits email marketing without the recipient’s consent, with limited exceptions. Failure to comply with PIPEDA, CASL, or provincial privacy or data protection laws could result in significant fines and penalties or possible damage awards. In the event we expand to the European Economic Area, we may become subject to the General Data Protection Regulation, or the GDPR, which imposes strict obligations on the ability to collect, analyze, transfer, and otherwise process personal data and the UK has a similar law. The GDPR provides for monetary penalties and companies may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm. Furthermore, regulatory guidance is evolving and monitoring developments and compliance will lead to increased costs.

In addition, privacy advocates and industry groups have regularly proposed, and may propose in the future, self-regulatory standards by which we are legally or contractually bound. If we fail to comply with these contractual obligations or standards, we may face substantial liability or fines. Consumer resistance to the collection and sharing of the data used to deliver targeted advertising, increased visibility of consent or “do not track” mechanisms as a result of industry regulatory or legal developments, the adoption by consumers of browser settings or “ad-blocking” software, and the development and deployment of new technologies could materially impact our ability to collect data or reduce our ability to deliver relevant promotions or media, which could materially impair the results of our operations.

Further, we are subject to the Payment Card Industry Data Security Standard (“PCI”), which is a multifaceted security standard that is designed to protect cardholder data as mandated by by the Payment Card Industry Security Standards Council. We work with our merchant services providers to ensure PCI compliance across our payment processing channels. Despite our compliance efforts, in the event of a breach of the security of payment card data, we may become subject to claims that we have violated the PCI based on past, present, and future business practices, which could have an adverse impact on our business and reputation. In addition, we are subject to the risk of changes to or disruption in our providers’ service. Costs and potential problems and interruptions associated with the implementation of new or upgraded systems and technology such as those necessary to achieve compliance with the PCI or with maintenance or