Our business is subject to the risk of earthquakes, fires, power outages, floods, pandemics and other health events and other catastrophic events, and to interruption by manmade problems such as political or military actions and acts of terrorism.
Our business is vulnerable to damage or interruption from earthquakes, fires, floods, power losses, telecommunications failures, terrorist attacks, political or military conflicts, human errors, break-ins, and similar events. The third-party systems and operations and manufacturers we rely on are subject to similar risks. For example, a significant natural disaster, such as an earthquake, fire, or flood, could have an adverse effect on our business, financial condition and operating results, and our insurance coverage may be insufficient to compensate us for losses that may occur. Acts of terrorism, which may be targeted at metropolitan areas that have higher population density than rural areas, or geopolitical unrest or armed conflict, such as the war in Ukraine and the Israel-Hamas conflict, could also cause disruptions in our or our suppliers’ and manufacturers’ businesses or the economy as a whole. Our suppliers and manufacturers in China may be reactive to pandemics and other health events, resulting in restrictions on shipping or manufacturing. If our suppliers or manufacturers are impacted by such events, it could adversely affect our ability to manufacture product and meet demand. We may not have sufficient protection or recovery plans in some circumstances, such as natural disasters affecting locations that store significant inventory of our products or that house our servers. As we rely heavily on our computer and communications systems, and the internet to conduct our business and provide high-quality customer service, these disruptions could negatively impact our ability to run our business and either directly or indirectly disrupt suppliers’ and manufacturers’ businesses, which could have an adverse effect on our business, financial condition, and operating results.
Risks Related to Legal and Regulatory Matters
We collect, store, use, and otherwise process personal information of our customers and their residents, and of our employees, service providers, and others, which subjects us to laws, regulations, and legal and contractual obligations related to privacy, data protection, and cybersecurity, and any actual or perceived failure to meet those obligations could harm our business.
We collect, store, use, and otherwise process a wide variety of data from current and prospective customers and their residents, including personal information, such as home addresses and geolocation. Federal, state, and international laws and regulations governing privacy, data protection, and e-commerce transactions require us to safeguard our customers’ personal information. The scope of laws and regulations relating to privacy and cybersecurity is evolving rapidly. We also maintain privacy policies and other notices, and are subject to contractual obligations to third parties, related to privacy, data protection, and cybersecurity. We strive to comply with applicable laws, regulations, policies, and other legal obligations relating to privacy, data protection, and cybersecurity. However, the regulatory framework for privacy, data protection, and information security is, and is likely to remain, uncertain for the foreseeable future, and it is possible that these or other actual or alleged obligations may be interpreted by regulators or asserted as tort claims in civil litigation and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other actual or alleged obligations or our practices.
We also expect that there will continue to be new laws, regulations, and industry standards concerning privacy, data protection, and cybersecurity proposed and enacted in various jurisdictions. Various states throughout the U.S. are increasingly adopting or revising privacy, information security, and data protection laws and regulations that could have a significant impact on our current and planned privacy, data protection, and cybersecurity-related practices, our collection, use, sharing, retention, safeguarding, and processing of customer, consumer, resident, employee, or any other third-party information we receive, and some of our current or planned business activities. For example, California enacted the CCPA, which affords California resident consumers expanded privacy protections and control over the collection, use and sharing of their personal information. The CCPA went into effect on January 1, 2020 and, among other things, gives California residents expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. The CCPA also provides for a private right of action for data breaches that may increase data breach litigation. The CPRA, which significantly amended and supplemented the CCPA, was adopted by California voters in 2020. The CPRA imposes additional privacy obligations on covered companies doing business in California, including additional consumer rights processes and opt outs for certain uses of sensitive data. It also creates a new California agency tasked to enforce the law, which is likely to result in increased regulatory scrutiny of California businesses in the areas of privacy and cybersecurity. The CPRA’s primary substantive requirements went into effect on January 1, 2023. Following enactment of the CCPA, many other states have adopted or considered privacy legislation, many of which are comprehensive laws similar to the CCPA and CPRA. For example, Virginia, Colorado, Utah, and Connecticut have adopted such legislation that became effective in 2023, Texas, Montana, Oregon, and Florida have adopted such legislation that became effective in 2024, Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey and Tennessee have adopted such legislation that became effective in 2025, and Indiana, Kentucky, and Rhode Island have adopted such legislation that has become effective in 2026. Numerous U.S. states also have considered, and in certain cases enacted, legislation addressing particular subject matter such as biometrics and health-related information. Broad federal privacy legislation has also been proposed. These and other new and evolving laws and regulations relating to privacy in the U.S. could increase our potential liability and adversely affect our business.
