개인정보

Certain states have already passed laws regulating specific aspects of privacy.

•actual or perceived significant data privacy or cybersecurity incidents involving our advertising solutions;

The U.K.’s data protection regime (UK GDPR and Data Protection Act 2018) imposes significant compliance obligations and penalties of up to the greater of £17.5 million or 4% of global revenue.

Technology, Data Privacy and Cybersecurity

Regulators and legislators are also increasingly scrutinizing and restricting certain personal data transfers and transactions involving foreign countries.

Over twenty other U.S. states have enacted similar privacy laws.

In the U.S., federal, state, and local governments have enacted numerous privacy and data security laws, such as, the Telephone Consumer Protection Act ("TCPA"), which imposes various consumer

For example, many U.S. states have enacted laws allowing their residents to opt out of the use of their Personal Data for targeted advertising.

The California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act, is the most stringent state privacy law.

For example, the Dutch data protection authority, the Autoriteit Persoonsgegevens, has inquired about our content licensing efforts.

Certain countries have also established specific legal requirements for data localization, such as where personal data must remain stored in the country.

In Canada, the legal and regulatory framework governing privacy, including health information privacy, is evolving rapidly, particularly with respect to the use of artificial intelligence and digital health technologies.

•the exfiltration of customer personal data

•improper disclosure of data and violations of applicable data privacy and other laws; or

Digital Operational Resilience Act and other E.U. and U.K. laws that regulate personal data, non-personal data, and cybersecurity operations.

In addition to the GDPR, the EU has also enacted legislation that would regulate non-personal data and establish new cybersecurity standards, and other countries, including the U.K., may similarly do so in the future.

public disclosures of certain contract and company information; and mandatory security and privacy framework compliance requirements, including the handling of controlled unclassified information,

Additionally, we are also subject to the data privacy laws of the UK, including the UK General Data Protection Regulation (“UK GDPR”).

Data Privacy, Cybersecurity and Intellectual Property Risks

The U.S. Department of Justice also has issued regulations restricting and imposing obligations in connection with certain transfers of sensitive personal information.

Outside of the United States, foreign governments also have similar or sometimes more stringent data protection laws.

AI laws and regulations, such as the European Union's AI Act, impose compliance obligations on AI systems that process personal data.

We are subject to changing laws, regulations and contractual and other obligations concerning privacy, cybersecurity and data protection, including restrictions on cross-border data transfers and data localization as well as increasingly rigorous contractual provisions demanded by our customers and third-party providers.

We and our regulators have an increased focus on privacy, information security and emerging technologies, such as AI.

Risk Factors— Risk Related to Cybersecurity, Privacy, and Regulatory Requirements” heading.

We also provide confidential, proprietary and personal information to third parties in certain cases and use many third-party systems and software, which are also subject to compromise and other cyberattacks.

Possessing client assets and sensitive personal information exposes us to cybersecurity threats and data privacy obligations.

Our use or future adoption of artificial intelligence in our business, which may include tools developed by third parties, could expose us to breach of a data or software license, website terms of service claims, claimed violations of privacy rights or other tort claims.

Substantial fines may be imposed for breaches of data protection requirements, which, under the GDPR, can be up to 4% of a company's worldwide annual turnover or 20 million Euros, whichever is greater, and classes of individuals or consumer protection organizations may initiate litigation related to our processing of their personal data.

For example, juries have returned liability verdicts against us in certain trials, including in U.S. youth and privacy-related matters, and additional bellwether trials are scheduled for 2026 and beyond.

For example, the EU Data Act imposes service switching obligations, requires us to assist with data portability to facilitate switching, and imposes requirements related to the cross-border data transfer of non-personal data.

These laws, together with a growing patchwork of laws and regulations governing AI, automated decision-making, targeted advertising, profiling and consumer protection, impose additional obligations regarding the handling of personal data and other information, and these requirements continue to evolve.

Brazil and India similarly passed national privacy laws establishing new rights for individuals, and responsibilities for companies that collect personal data, in 2018 and 2023, respectively.

In addition, the DMA imposes interoperability obligations on the Company requiring it to make certain of its technologies and features available to third-party products and services for free, which increases security and privacy risks, requires significant engineering resources, and can adversely affect the functionality, competitiveness, and user experience of the Company’s products.

The use and availability of third-party AI models in our solutions could result in scrutiny and legal liability, including intellectual property infringement and privacy claims.

The use of AI may also increase the risk of inadvertent disclosure or misuse of proprietary, confidential or personal information.

There is a risk that these autonomous systems could bypass internal controls, lack adequate third-party governance, or result in unauthorized access to data, data leakage, and non-compliance with applicable data privacy laws.

Further, jurisdictions are increasingly applying existing data privacy, consumer protection and other laws to AI, including emerging AI technologies such as generative AI.

Failure to comply with the GDPR or the

•We and our third-party service providers are subject to stringent and changing laws, regulations standards, and contractual obligations related to data privacy and security.

Shifting public policy regarding data privacy and the effects of artificial intelligence has caused and may in the future cause us to incur substantial costs to modify our operations or business practices, reduce consumers’ willingness to engage with our offerings, or cause delays or lapses in the availability of our products or services in various jurisdictions.

Significant loss of proprietary data, critical interruptions or delays in our business operations, and damage to our reputation, as well as the risk of claims alleging that we are non-compliant with applicable laws or regulations expose us to potentially substantial liability from private litigation or regulatory actions and related costs under laws protecting the privacy of personal information or unfair or deceptiv

Our employees, consultants, partners or third-party vendors may use AI tools without authorization or in a manner inconsistent with our policies, which could expose proprietary, confidential or regulated information to unauthorized recipients or create claims relating to privacy, open-source software, contractual obligations or other legal requirements.

Data protection laws and regulations around the world often require

With respect to information security, any single breach could require parallel notifications to data protection authorities, cyber authorities and/or law-enforcement, often requiring different thresholds, reporting deadlines and formats.

Our employees, contractors and vendors may adopt or use such AI tools, including through unauthorized or unsanctioned means, before we have had the opportunity to assess and mitigate the associated risks, which could result in the exposure of our or our customers' confidential, proprietary or personal information, interactions with unauthorized data sources or external tools, non-compliance with our internal security

These outcomes may give rise to public controversy, societal concerns, or regulatory actions relating to human rights, privacy, employment, or other social, economic, or political issues, and could adversely affect our reputation, competitive position, business, financial condition, and results of operations.

We manage AI-related risks through our existing cybersecurity, privacy, legal, compliance, information governance, and enterprise risk management processes.

We are subject to governmental regulation at the federal, state, and local levels in many areas of our business, such as employment laws, wage and hour laws, discrimination laws, immigration laws, human health and safety laws, import and export controls and customs laws, false claims or whistleblower statutes, tax codes, antitrust and competition laws, procurement regulations, intellectual property laws, supply chain

Our use of AI tools could also result in the loss of confidential information or intellectual property or an inability to claim or enforce intellectual property rights, as well as subject us to risks related to intellectual property infringement or misappropriation, data privacy, cybersecurity, and the unauthorized use of Company data.

In addition, in 2024 the National Security Division of the U.S. Department of Justice issued a new rule known as the “Data Security Program” related to the transfer of “bulk U.S. sensitive personal data” and “government related data” to “countries of concern” or “covered persons” (as defined in the rule) which is new, complex, and has yet to be enforced, but imposes stringent obligations on companies within its scope

The failure of one or more such service providers to meet our expectations, including by use of AI tools in contravention of agreements with us, inputting our confidential or proprietary information into AI tools, or roll-out of new AI tools without our approval, may have an adverse effect on our operations or financial condition, result in legal or regulatory violations, jeopardize our intellectual property rights o

Colorado’s Automated Decision-Making Technology Act, which is expected go into effect on January 1, 2027, imposes obligations on developers and deployers of technology that processes personal data and uses computation to generate outputs used to make or assist decisions about individuals;

Many other U.S. states have enacted their own distinct privacy laws and regulations, which often impose different, overlapping, and sometimes conflicting requirements across multiple jurisdictions.

They may access, misappropriate or otherwise compromise protected personal information or our proprietary or confidential information or that of third parties, and may develop and deploy malicious code (including viruses, ransomware and malware, among others) that can attack our systems, exploit security vulnerabilities, and disrupt or shut down our systems and operations.

A growing patchwork of AI laws and targeted privacy and consumer protection statutes may also create varying obligations around notice, customer rights and appeals, data minimization, restrictions on sensitive data, targeted advertising and certain forms of profiling, and these requirements continue to evolve.

regulations, including, among others, those related to financial and other disclosures, trade (including import and export regulations), antitrust, environment, health and safety, privacy, data protection, and anti-corruption,

Privacy

Following that, the European Data Protection Supervisor found in March 2024 that the European Commission’s use of Microsoft 365 violated the GDPR in part due to EU personal data being transferred to countries that had not been determined by the EU to provide adequate level of protection suggests that EU regulators are continuing to subject data transfers outside the EU to careful scrutiny.

We are required to comply with stringent, complex and evolving laws, rules, regulations and standards in many jurisdictions, as well as contractual obligations, relating to data privacy and security.

For example, judicial invalidation of the EU-U.S. Privacy Shield and Safe Harbor frameworks that we relied on to transfer data created additional compliance challenges for the transfer of EU personal data to the U.S. While a new

Other such as the Texas Data Privacy Security Act, the Colorado Privacy Act, and the Oregon Consumer Privacy Act,

•The EU has proposed the Regulation on Privacy and Electronic Communications, which, if adopted, would impose new obligations on using personal information in the context of electronic communications, particularly with respect to online tracking technologies and direct marketing.