Company: FSLY
Filing Date: 2025-08-06
Form Type: 10-Q
Source: 0001517413-25-000218
Chunk: 419

Company: Fastly, Inc.
Filing Date: 2025-08-06
Form: 10-Q
Item: Part I, Item 8
Chunk 419
---
 of our customers (including their end users). Our handling of data is subject to a variety of obligations related to privacy and data security, contractual obligations, internal and external privacy policies, guidance, industry standards, and other obligations that govern the processing of personal information. Additionally, we are or may become subject to other laws and regulations around the world with respect to the Internet related to, among other things, content liability, security requirements, critical infrastructure designations, Internet resiliency, law enforcement access to information, net neutrality, data localization requirements, and restrictions on social media or other content.

In the United States, federal, state, and local governments have enacted numerous privacy and data security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the FTC Act), and other similar laws (e.g., wiretapping laws). Domestically, states have also begun to introduce more comprehensive privacy and data security legislation, including data breach notification laws, personal information privacy laws, and consumer protection laws. 

77

In the past few years, numerous U.S. states—including California, Virginia, Colorado, Connecticut, and Utah—have enacted comprehensive privacy and data security laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal information. As applicable, such rights may include the right to access, correct, or delete certain personal information, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal information, including Sensitive Information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CPRA”), collectively ("CCPA") applies to personal information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights related to their personal information. The CCPA allows for statutory fines for noncompliance (up to $7,500 per violation), as well as a private right of action for individuals affected by certain data breaches to recover significant statutory damages. 

Similar laws have been proposed in several other states and at the federal and local levels, and we expect more states