Company: ZM
Filing Date: 2025-11-25
Form Type: 10-Q
Source: 0001585521-25-000202
Chunk: 365

Company: Zoom Communications, Inc.
Filing Date: 2025-11-25
Form: 10-Q
Item: Part I, Item 8
Chunk 365
---
 the future. These developments may further complicate compliance efforts and increase legal risk and compliance costs for us and the third parties upon whom we rely. Under various laws and other obligations related to privacy, data protection, and information security, we are required to obtain certain consents to process personal information. For example, some of our data processing practices may be challenged under wiretapping laws when we obtain consumer information from third parties through various methods, including AI features, chatbot and session replay providers, or via third-party marketing pixels. These practices are subject to increased challenges by class action plaintiffs. Several states and foreign jurisdictions have enacted statutes imposing obligations on businesses collecting or processing biometric information.  For example, Illinois’ Biometric Information Privacy Act (“BIPA”) regulates the collection, use, safeguarding, and storage of biometric information and provides for substantial penalties and statutory damages.  The Federal Trade Commission (“FTC”), has indicated that use of biometric technologies (including facial recognition technologies) may be subject to additional scrutiny. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation, mass arbitration demands, and regulatory attention. Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or 

58

Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered individuals (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties.

Laws Outside of the United States

Outside the United States, an increasing number of laws, regulations, and industry standards related to privacy, data protection, and information security may govern. For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing personal information. For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million