Church & Dwight Co. Inc.: 10-K Risk Factor Changes

The development, manufacturing, processing, formulation (including stability), packaging, labeling, marketing, distribution and sale of our products are subject to regulation by federal agencies, including the U.S. FDA, the FTC, the EPA and the CPSC and foreign regulators and agencies. In addition, our and our suppliers’ operations are subject to the oversight of the Occupational Safety and Health Administration and the National Labor Relations Board. Our activities are also regulated by various agencies of the states, localities and foreign countries in which our products and their constituent materials and components are manufactured and sold. In particular, the FDA and foreign counterparts regulate the formulation, safety, development, manufacturing, packaging, labeling and distribution of condoms, home pregnancy test kits, vaginal lubricants, electric and battery powered medical devices, wound dressings, over-the-counter medicines, homeopathic products and dietary supplements. The FDA or a similar foreign agency also exercises oversight over cosmetic products such as depilatories, hair care and skin care products. In addition, under a memorandum of understanding between the FDA and the FTC, the FTC has jurisdiction over the promotion and advertising of these products, and the FTC regulates the promotion and advertising of our other products as well. As part of its regulatory authority, the FDA may periodically conduct inspections of the physical facilities, machinery, processes and procedures that we and our suppliers use to manufacture regulated products and may identify compliance issues that would require us and our suppliers to make certain changes in our manufacturing facilities and processes. The failure of a facility to be in compliance may lead to regulatory action against the products made in that facility, including seizure, injunction or recall, as well as to possible action against the owner of the facility/manufacturer. We may be required to make additional expenditures to address these issues or possibly stop selling certain products until the compliance issue has been remediated. Likewise, any future determination by the FDA, the EPA or a similar foreign agency, or by us in reviewing our compliance with applicable rules and regulations, that our products or quality systems do not comply with applicable regulations could result in future compliance activities, including product withdrawals or recalls, import detentions, injunctions preventing the shipment of products, or other enforcement actions. For example, the FDA may determine that a particular claim that we use to support the marketing of a product is not substantiated or permissible under products’ regulatory classification, may not accept the evidence of safety for a new product that we may wish to market, may challenge the safety or effectiveness of existing products based on, among other things, changes in formulations, inadequate stability or “shelf-life,” consumer complaints, or improper labeling, may take action against our homeopathic products, such as our Zicam products, on the basis that they are unapproved drugs, and may determine that our dietary supplement business manufacturing, packaging, labeling and holding operations do not comply with cGMPs. Similarly, we may identify these or other issues in internal compliance reviews of our operations and the operations and products of vendors and acquired companies. These other issues may include the identification of contaminants or non-compliant levels of particular ingredients. Any of the foregoing could subject us to adverse publicity, force us to incur unanticipated costs and have a material adverse effect on our business, financial condition, results of operations and cash flows. Additionally, delays in the acceptance, review and approval of products by the FDA or the EPA, or other required governmental approvals, may result from government shutdowns due to the failure by Congress to enact regular appropriations. We are subject to regulations regarding the transportation, storage or use of certain chemicals to protect the environment, as well as the Commission’s rules with respect to “conflict minerals.” Recent trade policies, tariffs and government regulations affecting trade between the U.S. and other countries, as well as sanctions by the U.S. and the European Union in response to the Russia/Ukraine war, have introduced greater uncertainty and volatility. In addition, renewed significant governmental actions pertaining to pandemics or other health emergencies, including lockdowns, quarantines or other restrictions on the ability of our employees to travel or perform necessary business functions or our ability to develop, manufacture, distribute, market or sell our products, or the ability of our suppliers, customers or third-party partners to effectively run their operations, may negatively impact our ability to manufacture, distribute, market and sell our products. We are not able to predict the nature of these changes or of such future laws, regulations, repeals or interpretations or to predict the effect additional or shifting governmental regulation, when and if it occurs, would have on our business in the future. Such developments could require reformulation of certain products to meet new standards, recalls or discontinuance of certain products not able to be reformulated, additional record-keeping requirements, increased documentation of the properties of certain products, additional or different labeling, additional scientific substantiation, expanded adverse event reporting or other new requirements. There is also an increased risk of fraud or corruption in certain foreign jurisdictions and related difficulties in maintaining effective internal controls. Additionally, we could be subject to future inquiries or investigations by governmental and other regulatory bodies, which may be delayed or disrupted due to any government furlough. We could also be adversely affected by violations, or allegations of violations, of the Foreign Corrupt Practices Act and similar international anti-bribery laws. The Foreign Corrupt Practices Act and similar international 24 24 anti-bribery laws generally prohibit companies and their intermediaries from making improper payments to government officials or other third parties for the purpose of obtaining or retaining business.•We are subject to increasingly stringent privacy and data security regulation. We collect, use and store personal data of our employees, customers and other third parties in the ordinary course of business, and we are required to comply with increasingly complex and changing data privacy and security laws and regulations, as well as self-regulatory regimes, that apply to the collection, storage, use, transmission and protection of personal information and other consumer and employee data, including particularly the transfer of personal data between or among countries. High-profile security breaches of the information systems of a number of government agencies and U.S. companies may result in increased regulations and new security laws. The current administration and Congress in the United States, as well as state legislators, may seek to pass more stringent regulations in these areas, or more aggressively enforce existing regulations. As of January 1, 2026, comprehensive privacy laws are in effect in 20 states, complicating our privacy compliance obligations through the introduction of increasingly disparate requirements across the various U.S. jurisdictions in which we operate. Additionally, certain other states have enacted specific health data privacy laws and other states are considering similar legislation. This imposes significant compliance costs and exposes us to substantial risks, particularly with respect to health data and other sensitive data. While Congress is considering legislation that may preempt some or all of such U.S. state privacy laws, such legislation may also provide a more expansive private right of action for privacy claims than exists under current state laws. We are currently subject to numerous and evolving federal, state, local and foreign laws and regulations that protect the privacy and security of personal information, such as the California Consumer Privacy Act ( the "CCPA") as amended, other comprehensive US state privacy laws, the California Online Privacy Protection Act, the Personal information Protection and Electronic Documents Act, the Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act, the Telephone Consumer Protection Act of 1991, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and Section 5 of the Federal Trade Commission Act. Moreover, our use or sharing of certain data may subject us to the Video Privacy Protection Act (“VPPA“), and the California Invasion of Privacy Act (“CIPA”). Private plaintiffs and class action lawyers are increasingly bringing claims alleging violations of VPPA and CIPA, and courts have made inconsistent decisions regarding such claims. Such claims could thus lead to significant statutory damages or pressure to settle. The CCPA contains significant obligations and requirements that have resulted in a greater compliance burden with respect to our operations and data usage of California residents, which will continue to increase our costs. The CCPA covers businesses that obtain or access personal information of California consumers, grants consumers enhanced privacy rights and control over their personal information and imposes significant requirements on covered companies with respect to consumer data privacy rights. The CCPA provides consumers with the right to opt out of the sale and “sharing” of their personal information. In November 2020, California voters adopted the CPRA that amends the CCPA, including creating a new agency to implement and enforce the law and enhancing and strengthening regulatory requirements and individual protections under the CCPA. As of January 2026, 19 other states have enacted, and more are considering, similar privacy, data protection and information security laws, which may subject us to additional requirements and restrictions that could have an impact on our business, further complicating our privacy compliance obligations through the introduction of increasingly disparate requirements across the various U.S. jurisdictions in which we operate. Additionally, several states have enacted health-specific privacy laws or strengthened protections of health- and location-related data, and other states are considering similar legislation. Our website ecommerce and customer relations businesses that store, process or transmit payment cardholder data are subject to be Payment Card Industry (PCI) compliance requirements as mandated by the credit card companies (Visa, Mastercard, and American Express) and the Payment Card Institute Data Security Standard (PCI-DSS). Moreover, the increasing use of ad-blocking technologies, browser and device privacy settings, and consumer opt-out choices may reduce advertising effectiveness and negatively impact our revenue. In addition to state-specific data breach notification laws (which exist in all US states and territories), evolving federal cybersecurity laws may require us to provide notifications about cybersecurity incidents in limited timeframes and before investigations are complete. Our businesses’ failure to comply with these laws and regulations could expose us to breach of contract claims, substantial fines, penalties and other liabilities and expenses, costs for remediation and harm to our reputation. Outside of the USA and globally, legislators and regulators have adopted stricter and more complex privacy, cybersecurity, and data protection regimes. In Europe, the European Union (“EU”) has adopted strict data privacy regulations and similar regimes have been adopted in other jurisdictions (e.g. the UK). Following the passage of the EU’s General Data Protection Regulation ((EU) 2016/679) (“GDPR”) and the Regulation on Privacy and Electronic Communications (the “ePrivacy Regulation”), data privacy and security compliance in the EU are increasingly complex and challenging. The GDPR in particular has broad extraterritorial effect and imposes a strict data protection compliance regime with significant penalties for non-compliance (up to 4% of worldwide annual turnover or €20 million, whichever is higher). The United Kingdom (“UK”) has adopted the UK General Data Protection Regulation, or UK GDPR; the EU GDPR and UK GDPR are herein collectively referred to as GDPR. The GDPR imposes stringent data protection requirements for the processing of personal data, whenever GDPR applies to such processing, such as certain processing in the EEA, or in the UK. With respect to the personal data it protects, the GDPR requires, among other things, controller accountability, consents from Data Subjects or another acceptable legal basis to process the personal data, notification within 72 hours of a personal data breach where required, data integrity and security, and fairness and transparency regarding the storage, use or other processing of the personal data. The GDPR also provides rights to Data Subjects relating anti-bribery laws generally prohibit companies and their intermediaries from making improper payments to government officials or other third parties for the purpose of obtaining or retaining business.