sustained, we could be required to pay additional taxes, interest and penalties, which could result in one-time tax charges, higher effective tax rates, reduced cash flows and lower overall profitability of our operations.
We are subject to federal, state, and local income, sales, and other taxes in the U.S. and income, withholding, transaction, and other taxes in numerous foreign jurisdictions. Significant judgment is required in evaluating our tax positions and our worldwide provision for taxes. During the ordinary course of business, there are many activities and transactions for which the ultimate tax determination may be uncertain. In addition, our tax obligations and effective tax rates could be adversely affected by changes in the relevant tax, accounting and other laws, regulations, principles and interpretations, including those relating to income tax nexus, by recognizing tax losses or lower than anticipated earnings in jurisdictions where we have lower statutory rates and higher than anticipated earnings in jurisdictions where we have higher statutory rates, by changes in foreign currency exchange rates, or by changes in the valuation of our deferred tax assets and liabilities. We may be audited in various jurisdictions, and such jurisdictions may assess additional taxes, sales taxes and value added taxes against us. Although we believe our tax estimates are reasonable, the final determination of any tax audits or litigation could be materially different from our historical tax provisions and accruals, which could have an adverse effect on our results of operations or cash flows in the period or periods for which a determination is made.
Failure to comply with laws and regulations relating to privacy, data protection, cybersecurity, advertising, and consumer protection, or the expansion of current or the enactment of new laws or regulations relating to such matters, could adversely affect our business, financial condition, and results of operations.
We rely on a variety of techniques when marketing to Customer Partners, and we are subject to various laws and regulations that govern such marketing and advertising practices. Additionally, our business relies on our ability to collect, receive, store, process, use, generate, transfer, disclose, make accessible, protect, share, and otherwise process personal data and other sensitive information (such as personal data that identifies or is identifiable to actual or prospective customers, suppliers, personnel, or others), proprietary and confidential business information, trade secrets, intellectual property, and sensitive third-party information. As a result, we are, or may become, subject to numerous federal, state, local and foreign data laws, regulations, industry standards, policies, contracts and other actual and asserted obligations relating to privacy, data protection, and cybersecurity, particularly in the context of online advertising. For example, we are or may become subject to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, numerous other state laws, the European Union General Data Protection Regulation (“EU GDPR”), the UK Data Protection Act, the EU GDPR as it forms part of United Kingdom law by virtue of section 3 of the European Union (Withdrawal) Act 2018, the Privacy and Electronic Communications Directive (2002/58/EC), and other national legislation.
Laws and regulations relating to privacy, data protection, marketing and advertising and consumer protection are evolving and subject to potentially differing interpretations. These requirements may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another or may conflict with other rules or our practices. We may publish privacy policies, notices, and other documentation and statements regarding our collection, processing, use and disclosure of personal data and/or other data. Although we endeavor to comply with our published policies, notices, documentation, and statements, we may at times fail to do so or may be perceived to have failed to do so. Despite our efforts, we may not be successful in achieving compliance if our personnel, Customer Partners or Service Providers fail to comply with our published policies and documentation. Although we endeavor to comply with our published policies and notices, other statements and documentation, and all applicable laws and regulations, and certain other guidance, industry standards, policies, contracts and other actual and asserted obligations, relating to privacy, data protection, cybersecurity, advertising, and consumer protection, we may at times fail to do so or may be perceived to have failed to do so. If we fail, or are perceived to have failed, to address or comply with any actual or asserted obligations related to data privacy and security, we could face private claims, demands, and litigation, including class action litigation; government enforcement actions and proceedings that could include investigations, fines, penalties, audits and inspections; additional reporting requirements and/or oversight; temporary or permanent bans on all or some processing of data;
38