We are also subject to a number of U.S. federal and state and foreign laws and regulations that affect companies conducting business on the Internet, including consumer protection regulations that regulate retailers and govern the promotion and sale of merchandise. Many of these laws and regulations are still evolving and being tested in courts, and could be interpreted in ways that could harm our business. These may involve user privacy, data protection, content, intellectual property, distribution, electronic contracts and other communications, competition, protection of minors, consumer protection, telecommunications, product liability, taxation, economic or other trade prohibitions or sanctions and online payment services. We are subject to federal, state, local and international laws regarding privacy and protection of people’s data. U.S. federal, state and foreign laws and regulations are evolving and can be subject to significant change. In addition, the application, interpretation and enforcement of these laws and regulations are often uncertain, and may be interpreted and applied inconsistently from country to country and inconsistently with our current policies and practices. In the E.U., the GDP, is a E.U. law instrument seeking to strengthen individuals’ fundamental rights and facilitate business by clarifying rules for companies and public bodies by setting a high standard for personal data protection throughout the E.U., imposing a strict data protection compliance regime and providing for stricter punitive enforcement regime. The GDPR applies to the processing and transfer of personal data. The term ‘processing’ is broadly defined to include collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. From 1 January 2021, the GDPR has been retained in U.K. national law by virtue of the U.K. GDPR and U.K. DPA. Additionally, a recent decision from the CJEU and related regulatory guidance may impact our ability to transfer personal data from the EEA or U.K. to the United States and other jurisdictions. The CCPA requires many companies that process information about California residents, including us, to make disclosures to consumers about their data collection, use and sharing practices, and, in some instances, allows California residents to request access to or the erasure of their personal information as well as to opt out of the sale of such information to third parties. It also creates a private right of action and statutory damages where the failure to adopt certain security measures results in a data breach compromising specific data elements related to California residents. In addition, in November 2020, California voters approved the CPRA, the most material provisions of which go into operation on January 1, 2023. The CPRA would, among other things, give California residents the ability to limit the use of their sensitive information, provide for penalties for CPRA violations concerning California residents under the age of 16, and establish a new California Privacy Protection Agency to implement and enforce the law. There are also a number of legislative proposals pending before the U.S. Congress, various state legislative bodies and foreign governments concerning privacy and data protection, which could affect us. Some observers have noted that the CCPA, CPRA and the newly passed VCDPA could mark the beginning of a trend toward more stringent privacy legislation in the United States, which could increase our potential liability and adversely affect our business, results of operations, and financial condition. If our privacy or data security measures fail to comply with applicable current or future laws and regulations, we may be subject to litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data or our marketing practices, fines or other liabilities, as well as negative publicity and a potential loss of business.