We collect user profile, user location and other personal data from our users in order to better understand our users and their needs and to support our social interest graph engine and our big data analytical capabilities for more targeted services such as interest- or location-based user groups and mobile marketing services. Concerns about the collection, use, disclosure or security of personal information, chat history or other privacy-related matters, even if unfounded, could damage our reputation, cause us to lose users, customers and platform partners and subject us to regulatory investigations, all of which may adversely affect our business. While we strive to comply with applicable data protection laws and regulations, as well as our privacy policies pursuant to our terms of use and other obligations we may have with respect to privacy and data protection, any failure or perceived failure to comply with these laws, regulations or policies may result, and in some cases have resulted, in inquiries and other proceedings or actions against us by government agencies or others, as well as negative publicity and damage to our reputation and brand, each of which could cause us to lose users, customers and platform partners and have an adverse effect on our business and operating results.
Our practices may become inconsistent with new laws or regulations concerning data protection, or the interpretation and application of existing consumer and data protection laws or regulations, which is often uncertain and in flux. If so, in addition to the possibility of fines, this could result in an order requiring that we change our practices, which could have an adverse effect on our business and operating results. For example, the European Union General Data Protection Regulation (“GDPR”), which came into effect on May 25, 2018, includes operational requirements for companies that receive or process personal data of residents of the European Economic Area. The GDPR establishes new requirements applicable to the processing of personal data, affords new data protection rights to individuals and imposes penalties for serious data breaches. Individuals also have a right to compensation under the GDPR for financial or
non-financial
losses. Although we do not conduct any business in the European Economic Area, in the event that residents of the European Economic Area access our platform and input protected information, we may become subject to provisions of the GDPR. Additionally, California recently enacted legislation that has been dubbed the first “GDPR-like” law in the U.S. Known as the California Consumer Privacy Act, or CCPA, it creates new individual privacy rights for consumers (as that word is broadly defined in the law) and places increased privacy and security obligations on entities handling personal data of consumers or households. The CCPA, which went into effect on January 1, 2020, requires covered companies to provide new disclosures to California consumers, and provides such consumers new ways to
opt-out
of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. With some other conditions, the CCPA requires companies “doing business in California” to follow the CCPA. However, the phrase “doing business in California” is not defined in the CCPA. With reference to the California tax code, the phrase “doing business in California” is described as “
engaging in any transaction for the purpose of financial or pecuniary gain or profit.” We are currently not actively doing business in California, and thus, there is still uncertainty regarding whether the CCPA will apply to us. If further interpretations or court decisions render us “doing business in California,” the CCPA will apply to us and it may increase our compliance costs and potential liability. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent privacy legislation in the U.S., which could increase our potential liability and adversely affect our business. On May 28, 2020, the National People’s Congress adopted the Civil Code of the PRC, or the Civil Code, which came into effect on January 1, 2021. Pursuant to the Civil Code, the personal information of a natural person shall be protected by the law. Any organization or individual shall legally obtain such personal information of others when necessary and ensure the safety of such information, and shall not illegally collect, use, process or transmit personal information of others, or illegally purchase or sell, provide or make public personal information of others. Civil subjects have a right to compensation under the Civil Code for financial or
non-financial
losses. In October 2020, the Standing Committee of the National People’s Congress issued the Draft Personal Information Protection Law for public comments. The Draft Personal Information Protection Law integrates provisions from several rules with respect to personal information rights and privacy protection. According to the Draft Personal Information Protection Law, personal information refers to information related to identified or identifiable natural persons which is recorded by electronic or other means (excluding the anonymized information). The Draft Personal Information Protection Law provides the circumstances under which a personal information processor could process personal information, such as where the consent of the individual concerned is obtained and where it is necessary for the conclusion or performance of a contract to which such individual is a party to such contract. It also stipulates certain specific provisions with respect to the obligations of a personal information processor. Violations of relevant provisions, if the Draft Personal Information Protection Law becomes effective, may subject the processor to rectification, confiscation of its illegal gains, fines, suspension of relevant business, revocation of the relevant business permit or business license or criminal liabilities. According to the Law of the PRC on the Protection of Minors (2020 Revision), which will take effect on June 1, 2021, information processors must follow the principles of legality, legitimacy and necessity when processing personal information of minors via internet, and must obtain consent from minors’ parents or other guardians when processing personal information of minors under age of 14. In addition, internet service providers must promptly alert upon the discovery of publishing private information by minors via the internet and take necessary protective measures. Violations of relevant provisions may subject the processor to rectification, confiscation of its illegal gains, fines, suspension of relevant business, revocation of the relevant business permit or business license or criminal liabilities. Complying with new laws and regulations could cause us to incur substantial costs or require us to change our business practices in a manner materially adverse to our business. See also “—Risks Related to Doing Businesses in China—Uncertainties in the interpretation and enforcement of PRC laws and regulations could limit the legal protections available to you and us.”