Phillips 66: 10-K Risk Factor Changes

The potential physical effects of climate change and severe weather, as well as other chronic physical effects such as water shortages and rising sea levels, on our operations are highly uncertain and depend upon the unique geographic and environmental factors present. We have systems in place to manage potential acute physical risks, including those that may be caused by climate change, but such events could have an adverse effect on our assets and operations. Examples of potential physical risks include floods, hurricane-force winds, severe storms, droughts, heat waves, earthquakes, wildfires, freezing temperatures and snowstorms, as well as rising sea levels at our coastal facilities. We have incurred, and will continue to incur, costs to protect our assets from physical risks and to employ processes, to the extent available, to mitigate such risks. We operate facilities located in coastal regions of the United States, which have been impacted by hurricanes that have required us to temporarily, or even permanently, shut down operations at those sites. CPChem also operates facilities on the Gulf Coast and has had to temporarily shut down sites in the past as a result of hurricanes. Any extreme weather events or rising sea levels may disrupt the ability to operate our facilities located near coastal areas or to transport crude oil, refined petroleum or petrochemical and plastics products in these areas. Extended periods of such disruption could have an adverse effect on our results of operations. We could also incur substantial costs to prevent or repair damage to these facilities. Finally, depending on the severity and duration of any extreme weather events or climate conditions, our operations may need to be modified and material costs incurred, which could materially and adversely affect our business, financial condition and results of operations. 28 28 28 28 28 28

The potential physical effects of climate change and severe weather, as well as other chronic physical effects such as water shortages and rising sea levels, on our operations are highly uncertain and depend upon the unique geographic and environmental factors present. We have systems in place to manage potential acute physical risks, including those that may be caused by climate change, but such events could have an adverse effect on our assets and operations. Examples of potential physical risks include floods, hurricane-force winds, severe storms, droughts, heat waves, earthquakes, wildfires, freezing temperatures and snowstorms, as well as rising sea levels at our coastal facilities. We have incurred, and will continue to incur, costs to protect our assets from physical risks and to employ processes, to the extent available, to mitigate such risks. We operate facilities located in coastal regions of the United States, which have been impacted by hurricanes that have required us to temporarily, or even permanently, shut down operations at those sites. CPChem also operates facilities on the Gulf Coast and has had to temporarily shut down sites in the past as a result of hurricanes. Any extreme weather events or rising sea levels may disrupt the ability to operate our facilities located near coastal areas or to transport crude oil, refined petroleum or petrochemical and plastics products in these areas. Extended periods of such disruption could have an adverse effect on our results of operations. We could also incur substantial costs to prevent or repair damage to these facilities. Finally, depending on the severity and duration of any extreme weather events or climate conditions, our operations may need to be modified and material costs incurred, which could materially and adversely affect our business, financial condition and results of operations. 33 33 33 33 33 33

Currently, multiple legislative and regulatory measures to address GHG and other emissions are in various phases of consideration, promulgation, implementation or reversal. These include actions to develop international, federal, regional or statewide programs, which could require reductions in our GHG or other emissions, establish a carbon tax and decrease the demand for our refined products. Requiring reductions in these emissions could result in increased costs to (i) operate and maintain our facilities, (ii) install new emission controls at our facilities and (iii) administer and manage any emissions programs, including acquiring emission credits or allotments. International climate change-related efforts, such as the 2015 United Nations Conference on Climate Change, which led to the creation of the Paris Agreement, and the 2023 United Nations Climate Change Conference, may impact the regulatory framework of states whose policies directly influence our present and future operations. In January 2026, President Trump issued a memorandum directing the United States to withdraw from various international organizations and treaties related to climate change, and the administration has generally been pursuing a de-regulatory posture on environmental matters. However, future emission reduction targets and other provisions of legislative or regulatory initiatives and policies enacted in the future by the United States could be brought by future administrations or, in the absence of federal action, states may become more active and focused on taking legislative or regulatory actions aimed at climate change and minimizing GHG emissions. 29 29 29 29 29 29 States have been and are expected to continue to adopt new and amended legislative and regulatory measures regarding climate change and GHG emissions controls. For example, in 2017, the California state legislature adopted Assembly Bill 398, which provides direction and parameters on utilizing cap and trade after 2020 to meet the 40% reduction target for GHG emissions from 1990 levels by 2030 specified in Senate Bill 32. Compliance with the cap and trade program is demonstrated through a market-based credit system. Additionally, in 2022, the CARB adopted regulations that effectively ban the in-state sales of new cars containing internal combustion engines beginning in 2035. Also, in 2022, CARB adopted its “2022 Scoping Plan for Achieving Carbon Neutrality,” which purports to provide a road map for California to achieve carbon neutrality (which it defines as removing as many carbon emissions from the atmosphere as it emits) by year 2045. Other states are proposing, or have already promulgated, low carbon fuel standards or similar initiatives to reduce emissions from the transportation sector. If we are unable to pass the costs of compliance on to our customers, sufficient credits are unavailable for purchase, we have to pay a significantly higher price for credits, or if we are otherwise unable to meet our compliance obligation, our financial condition and results of operations could be adversely affected. Additionally, certain states have recently passed, or are considering, legislation seeking to recover financial damages allegedly associated with climate change from fossil fuel companies like the Vermont Climate Superfund Act passed in 2024. The future of the U.S. climate change strategy and the impact to our industry and operations due to further GHG regulation is unknown at this time. Federal, regional and state climate change and air emissions goals and regulatory programs are complex, subject to change and impose considerable uncertainty due to a number of factors including technological feasibility, legal challenges and changes in federal policy. Increasing concerns about climate change and carbon intensity have resulted in heightened societal awareness and a number of international and national measures to limit GHG emissions. We cannot determine what final regulations will be enacted, modified or reversed, or whether stricter investor pressure can be expected in the future. Any of these changes may have a material adverse impact on our business or financial condition.

Currently, multiple legislative and regulatory measures to address GHG and other emissions are in various phases of consideration, promulgation, implementation or reversal. These include actions to develop international, federal, regional or statewide programs, which could require reductions in our GHG or other emissions, establish a carbon tax and decrease the demand for our refined products. Requiring reductions in these emissions could result in increased costs to (i) operate and maintain our facilities, (ii) install new emission controls at our facilities and (iii) administer and manage any emissions programs, including acquiring emission credits or allotments. International climate change-related efforts, such as the 2015 United Nations Conference on Climate Change, which led to the creation of the Paris Agreement, and the 2023 United Nations Climate Change Conference, may impact the regulatory framework of states whose policies directly influence our present and future operations. In January 2025, President Trump signed an executive order directing the United States to withdraw from the Paris Agreement, and it is expected that President Trump and the Republican-led Congress will diverge from the previous administration’s positions and GHG commitments. However, future emission reduction targets and other provisions of legislative or regulatory initiatives and policies enacted in the future by the United States could be brought by future administrations or, in the absence of federal action, states may become more active and focused on taking legislative or regulatory actions aimed at climate change and minimizing GHG emissions. 34 34 34 34 34 34 States have been and are expected to continue to adopt new and amended legislative and regulatory measures regarding climate change and GHG emissions controls. For example, in 2017, the California state legislature adopted Assembly Bill 398, which provides direction and parameters on utilizing cap and trade after 2020 to meet the 40% reduction target for GHG emissions from 1990 levels by 2030 specified in Senate Bill 32. Compliance with the cap and trade program is demonstrated through a market-based credit system. Additionally, on August 25, 2022, the CARB adopted regulations that effectively ban the in-state sales of new cars containing internal combustion engines beginning in 2035. Also, on December 15, 2022, CARB adopted its “2022 Scoping Plan for Achieving Carbon Neutrality,” which purports to provide a road map for California to achieve carbon neutrality (which it defines as removing as many carbon emissions from the atmosphere as it emits) by year 2045. Other states are proposing, or have already promulgated, low carbon fuel standards or similar initiatives to reduce emissions from the transportation sector. If we are unable to pass the costs of compliance on to our customers, sufficient credits are unavailable for purchase, we have to pay a significantly higher price for credits, or if we are otherwise unable to meet our compliance obligation, our financial condition and results of operations could be adversely affected. Additionally, certain states have recently passed legislation seeking to recover financial damages allegedly associated with climate change from fossil fuel companies like the Vermont Climate Superfund Act passed by the Vermont Legislature in May 2024. The future of the U.S.’s climate change strategy and the impact to our industry and operations due to further GHG regulation is unknown at this time. Federal, regional and state climate change and air emissions goals and regulatory programs are complex, subject to change and impose considerable uncertainty due to a number of factors including technological feasibility, legal challenges and potential changes in federal policy. Increasing concerns about climate change and carbon intensity have resulted in heightened societal awareness and a number of international and national measures to limit GHG emissions. We cannot determine what final regulations will be enacted, modified or reversed, or whether stricter investor pressure can be expected in the future. Any of these changes may have a material adverse impact on our business or financial condition.

Our industry is highly competitive with respect to both feedstock supply and refined petroleum product markets. We compete with many companies for available supplies of crude oil and other feedstocks and for outlets for our refined products. We do not produce any of our crude oil feedstocks. Some of our competitors, however, obtain a portion of their feedstocks from their own production and some have more extensive retail outlets than we have. Competitors that have their own production or extensive retail outlets, including those with greater brand-name recognition, are at times able to offset losses from refining operations with profits from producing or retailing operations, and may be better positioned to withstand periods of depressed refining margins or feedstock shortages. Some of our competitors also have materially greater financial and other resources than we have. Such competitors have a greater ability to bear the economic risks inherent in all aspects of our business. In addition, we compete with other industries that provide alternative means to satisfy the energy and fuel requirements of our industrial, commercial and individual customers. 24 24 24 24 24 24

The refining and marketing industry is highly competitive with respect to both feedstock supply and refined petroleum product markets. We compete with many companies for available supplies of crude oil and other feedstocks and for outlets for our refined products. We do not produce any of our crude oil feedstocks. Some of our competitors, however, obtain a portion of their feedstocks from their own production and some have more extensive retail outlets than we have. Competitors that have their own production or extensive retail outlets (and greater brand-name recognition) are at times able to offset losses from refining operations with profits from producing or retailing operations, and may be better positioned to withstand periods of depressed refining margins or feedstock shortages. Some of our competitors also have materially greater financial and other resources than we have. Such competitors have a greater ability to bear the economic risks inherent in all aspects of our business. In addition, we compete with other industries that provide alternative means to satisfy the energy and fuel requirements of our industrial, commercial and individual customers. 29 29 29 29 29 29

In connection with our separation from ConocoPhillips in 2012, we entered into an Indemnification and Release Agreement and certain other agreements pursuant to which ConocoPhillips agreed to indemnify us for certain liabilities, and we agreed to indemnify ConocoPhillips for certain liabilities. Indemnities that we may be required to provide are not subject to any cap and may be significant. Third parties could also seek to hold us responsible for any of the liabilities that ConocoPhillips has agreed to retain. Further, the indemnity from ConocoPhillips may not be sufficient to protect us against the full amount of such liabilities, and ConocoPhillips may not be able to fully satisfy its indemnification obligations. Each of these risks could negatively affect our business, results of operations and financial condition. 35 35 35 35 35 35

In connection with our separation from ConocoPhillips in 2012, we entered into an Indemnification and Release Agreement and certain other agreements pursuant to which ConocoPhillips agreed to indemnify us for certain liabilities, and we agreed to indemnify ConocoPhillips for certain liabilities. Indemnities that we may be required to provide are not subject to any cap and may be significant. Third parties could also seek to hold us responsible for any of the liabilities that ConocoPhillips has agreed to retain. Further, the indemnity from ConocoPhillips may not be sufficient to protect us against the full amount of such liabilities, and ConocoPhillips may not be able to fully satisfy its indemnification obligations. Each of these risks could negatively affect our business, results of operations and financial condition. 41 41 41 41 41 41

Increasing attention to global climate change has resulted in increased investor attention and an increased risk of public and private litigation, which could increase our costs or otherwise adversely affect our business. Additionally, cities, counties, and other governmental entities in several states in the United States began filing lawsuits against energy companies in 2017, including Phillips 66, seeking damages allegedly associated with climate change, and the plaintiffs are seeking unspecified damages and abatement under various tort theories. Similar lawsuits may be filed in other jurisdictions. While we believe these lawsuits are an inappropriate vehicle to address the challenges associated with climate change and will vigorously defend against them, the ultimate outcome and impact to us of any such litigation cannot be predicted with certainty, and we could incur substantial legal costs associated with defending these and similar lawsuits in the future. Additionally, governments and private parties are also increasingly filing lawsuits or initiating regulatory action based on allegations that certain public statements regarding climate change and other E&S-related matters and practices by 31 31 31 31 31 31 companies are false or misleading “greenwashing” that violate deceptive trade practices and consumer protection statutes. Such claims are included in lawsuits filed against energy companies, including Phillips 66. Such lawsuits present a high degree of uncertainty regarding the extent to which energy companies face an increased risk of liability stemming from climate change or E&S disclosures and practices. Efforts have also been made by governments and private parties to shut down energy assets by challenging operating permits, the validity of easements or the compliance with easement conditions. Lawsuits and/or regulatory proceedings or actions of this nature could result in interruptions to construction or operations of current or future projects, delays in completing those projects and/or increased project costs, all of which may have a material adverse effect on our business, financial condition, results of operation and cash flows. These risks may result in unexpected costs, negative sentiments about our company, disruptions in our operations, increases to our operating expenses and reduced demand for our products, which in turn could have an adverse effect on our business, financial condition and results of operations.

Increasing attention to global climate change has resulted in increased investor attention and an increased risk of public and private litigation, which could increase our costs or otherwise adversely affect our business. Additionally, cities, counties, and other governmental entities in several states in the U.S. began filing lawsuits against energy companies in 2017, including Phillips 66, seeking damages allegedly associated with climate change, and the plaintiffs are seeking unspecified damages and abatement under various tort theories. Similar lawsuits may be filed in other jurisdictions. While we believe these lawsuits are an inappropriate vehicle to address the challenges associated with climate change and will vigorously defend against them, the ultimate outcome and impact to us of any such litigation cannot be predicted with certainty, and we could incur substantial legal costs associated with defending these and similar lawsuits in the future. 36 36 36 36 36 36 Additionally, governments and private parties are also increasingly filing lawsuits or initiating regulatory action based on allegations that certain public statements regarding climate change and other ESG-related matters and practices by companies are false or misleading “greenwashing” that violate deceptive trade practices and consumer protection statutes. Such claims are included in lawsuits filed against energy companies, including Phillips 66. Such lawsuits present a high degree of uncertainty regarding the extent to which energy companies face an increased risk of liability stemming from climate change or ESG disclosures and practices. Efforts have also been made by governments and private parties to shut down energy assets by challenging operating permits, the validity of easements or the compliance with easement conditions. Lawsuits and/or regulatory proceedings or actions of this nature could result in interruptions to construction or operations of current or future projects, delays in completing those projects and/or increased project costs, all of which may have a material adverse effect on our business, financial condition, results of operation and cash flows. These risks may result in unexpected costs, negative sentiments about our company, disruptions in our operations, increases to our operating expenses and reduced demand for our products, which in turn could have an adverse effect on our business, financial condition and results of operations.

Our information technology and infrastructure, including systems operated by third-party service providers (e.g., cloud-based service providers), may be vulnerable to attacks by malicious actors or breached due to human error, malfeasance or other disruptions, including ransomware and other malware, phishing and social engineering schemes, deepfakes, malicious software, data privacy incidents, insiders or others with authorized access, attempts to gain unauthorized access to our data and systems, and other cybersecurity incidents. Any such incidents could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Any such unauthorized access, disclosure or other loss of information could result in one or more of the following outcomes: (i) unauthorized access to or a loss or misuse of intellectual property, proprietary information, or employee, customer or vendor data; (ii) public disclosure of sensitive information; (iii) increased costs to prevent, respond to, or mitigate cybersecurity events, such as deploying additional personnel and protection technologies, training employees, and engaging third-party experts and consultants; (iv) systems interruption; (v) disruption of our business operations; (vi) remediation costs for repairs of system damage, or regulatory fines or penalties; (vii) reputational damage that adversely affects customer or investor confidence; (viii) exposure to legal liability; and (ix) damage to our competitiveness, stock price, and long-term shareholder value. Generative artificial intelligence has also contributed to an increase in the prevalence of such attacks and threats, expanding potential exposure to disruptions. Any of the foregoing could be exacerbated by a delay or failure to detect a cybersecurity incident or the full extent of such incident. We also have exposure to cybersecurity incidents and the negative impacts of such incidents related to our critical data and proprietary information housed on third-party IT systems, including cloud-based systems. Additionally, authorized third-party IT systems or software can be compromised and used to gain access or introduce malware to our IT systems that can materially impact our business. Although we devote significant resources to prevent cybersecurity incidents and protect our system and data, we have experienced actual and attempted cybersecurity incidents. While we do not believe that any of these incidents has had a material effect on our business, operations or financial condition, it is possible that a future incident may have such an effect. 32 32 32 32 32 32 A cybersecurity incident may also result in legal claims or proceedings against us by our shareholders, employees, customers, vendors, and governmental authorities (U.S. and non-U.S.). Our infrastructure protection technologies and disaster recovery plans may not be able to prevent a technology systems breach or systems failure, which could have a material adverse effect on our financial position or results of operations. Furthermore, the continuing and evolving threat of cyberattacks has resulted in increased regulatory focus on prevention, and, to the extent we face increased regulatory requirements, we may be required to expend significant additional resources to meet such requirements.

Our information technology and infrastructure, or information technology and infrastructure of our third-party service providers (e.g., cloud-based service providers), may be vulnerable to attacks by malicious actors or breached due to human error, malfeasance or other disruptions, including ransomware and other malware, phishing and social engineering schemes, deepfakes, malicious software, data privacy incidents, insiders or others with authorized access, attempts to gain unauthorized access to our data and systems, and other cybersecurity incidents. Any such incidents could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Any such unauthorized access, disclosure or other loss of information could result in one or more of the following outcomes: (i) unauthorized access to or a loss or misuse of intellectual property, proprietary information, or employee, customer or vendor data; (ii) public disclosure of sensitive information; (iii) increased costs to prevent, respond to, or mitigate cybersecurity events, such as deploying additional personnel and protection technologies, training employees, and engaging third-party experts and consultants; (iv) systems interruption; (v) disruption of our business operations; (vi) remediation costs for repairs of system damage, or regulatory fines or penalties; (vii) reputational damage that adversely affects customer or investor confidence; (viii) exposure to legal liability; and (ix) damage to our competitiveness, stock price, and long-term shareholder value. Generative artificial intelligence has contributed to an increase in the prevalence of such attacks and threats, expanding our potential exposure to disruptions. Any of the foregoing can be exacerbated by a delay or failure to detect a cybersecurity incident or the full extent of such incident. 37 37 37 37 37 37 Further, we have exposure to cybersecurity incidents and the negative impacts of such incidents related to our critical data and proprietary information housed on third-party IT systems, including cloud-based systems. Additionally, authorized third-party IT systems or software can be compromised and used to gain access or introduce malware to our IT systems that can materially impact our business. Although we devote significant resources to prevent cybersecurity incidents and protect our system and data, we have experienced actual and attempted cybersecurity incidents, and while we do not believe that any of these incidents has had a material effect on our business, operations or financial condition, it is possible that a future incident may have such an effect. A cybersecurity incident may also result in legal claims or proceedings against us by our shareholders, employees, customers, vendors, and governmental authorities (U.S. and non-U.S.). Our infrastructure protection technologies and disaster recovery plans may not be able to prevent a technology systems breach or systems failure, which could have a material adverse effect on our financial position or results of operations. Furthermore, the continuing and evolving threat of cyberattacks has resulted in increased regulatory focus on prevention. To the extent we face increased regulatory requirements, we may be required to expend significant additional resources to meet such requirements.

There have been efforts in recent years aimed at the investment community, including investment advisors, sovereign wealth funds, public pension funds, universities, and other groups, to promote the divestment of fossil fuel companies, as well as to pressure lenders, insurers, and other financial services companies to limit or curtail activities with fossil fuel companies. If these or similar efforts are continued, the market price of our securities, our ability to access capital markets or insure our operations, and our cost of capital may be negatively impacted. 33 33 33 33 33 33 Members of the investment community are also increasing their focus on E&S matters, including practices related to GHG emissions, climate change, business resilience, diversity and inclusion, environmental justice and other E&S matters. As a result, we may face increasing pressure regarding our E&S disclosures and practices. Additionally, members of the investment community may screen companies such as ours for E&S performance before investing in our stock or participating in our financing activities. If we are unable to meet the evolving E&S standards set by these investors, including in light of their varied and sometimes conflicting views regarding E&S matters, we may lose investors, our stock price may be negatively impacted, our access to capital markets and lenders may be curtailed, and our reputation may be negatively affected. Further, an increasing number of regulators and lawmakers have pursued contrary views, enforcement actions, or investigations, including those that aim to limit the consideration of E&S factors in investment decisions, which may expose us to additional legal, financial, or reputational risks. Our efforts to accurately report on E&S-related issues expose us to operational, reputational, financial, legal, and other risks. Standards for tracking and reporting on E&S-related matters, including climate-related matters, have not been harmonized and continue to evolve. Processes and controls for reporting on E&S matters are subject to evolving and disparate regulations and standards of identification, measurement, and reporting on such metrics, including any climate change and E&S-related public company disclosure requirements adopted by the SEC or government agencies of other jurisdictions, and such standards remain uncertain and may change over time, which exposes us to unpredictable reporting obligations or business requirements and could result in significant revisions to our current E&S practices and disclosures.

There have been efforts in recent years aimed at the investment community, including investment advisors, sovereign wealth funds, public pension funds, universities, and other groups, to promote the divestment of fossil fuel companies, as well as to pressure lenders, insurers, and other financial services companies to limit or curtail activities with fossil fuel companies. If these or similar efforts are continued, the market price of our securities, our ability to access capital markets or insure our operations, and our cost of capital may be negatively impacted. Members of the investment community are also increasing their focus on environmental and social (E&S) matters, including practices related to GHG emissions, climate change, business resilience, diversity and inclusion, environmental justice and other E&S matters. As a result, we may face increasing pressure regarding our E&S disclosures and practices. Additionally, members of the investment community may screen companies such as ours for E&S performance before investing in our stock or participating in our financing activities. If we are unable to meet the E&S standards set by these investors, we may lose investors, our stock price may be negatively impacted, our access to capital markets and lenders may be curtailed, and our reputation may be negatively affected. Our efforts to accurately report on E&S-related issues expose us to operational, reputational, financial, legal, and other risks. Standards for tracking and reporting on E&S-related matters, including climate-related matters, have not been harmonized and continue to evolve. Processes and controls for reporting on E&S matters are subject to evolving and disparate standards of identification, measurement, and reporting on such metrics, including any climate change and E&S-related public company disclosure requirements adopted by the SEC or government agencies of other jurisdictions, and such standards may change over time, which could result in significant revisions to our current E&S practices and disclosures. 39 39 39 39 39 39

Along with our own data and information collected in the normal course of our business, we and our suppliers and service providers collect and retain certain data that is subject to specific laws and regulations. The transfer and use of this data, both domestically and across international borders, is becoming increasingly complex. This data is subject to governmental regulation at the federal, state, international, national, provincial and local levels in many areas of our business, including data privacy and cybersecurity laws. The regulatory landscape governing cybersecurity continues to evolve, and federal, state and international authorities are increasing their oversight of cybersecurity practices, incident reporting and the protection of critical energy infrastructure. Requirements related to operational technology, supply chain security, data governance and timely disclosure of cyber incidents are becoming more prescriptive, and additional rulemaking may further expand our compliance obligations. As cyber threats targeting the energy sector grow in frequency and sophistication, we are required to devote additional resources to maintain and enhance our cybersecurity programs and controls. Failure to comply with applicable cybersecurity laws and regulations, or to effectively identify, prevent or respond to a cyber event, could result in operational disruptions, increased costs, regulatory enforcement actions or adverse effects on our business.

Along with our own data and information collected in the normal course of our business, we and our partners collect and retain certain data that is subject to specific laws and regulations. The transfer and use of this data both domestically and across international borders is becoming increasingly complex. This data is subject to governmental regulation at the federal, state, international, national, provincial and local levels in many areas of our business, including data privacy and security laws such as the European Union (EU) and United Kingdom (UK) versions of the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). The GDPR applies to the transfer and processing of personal data of those who live in the EU or UK, respectively. As interpretation and enforcement of the GDPR evolves, it creates a range of new compliance obligations, which could cause us to incur additional costs. Failure to comply could result in significant penalties that may materially adversely affect our business, reputation, results of operations and cash flows. The CCPA, which came into effect on January 1, 2020, gives California residents specific rights in relation to their personal information, requires that companies take certain actions, including notifications for security incidents and may apply to activities regarding personal information that is collected by us, directly or indirectly, from California residents. As interpretation and enforcement of the CCPA evolves, it creates a range of new compliance obligations, with the possibility for significant financial penalties for noncompliance that may materially adversely affect our business, reputation, results of operations and cash flows. Comprehensive privacy laws with some similarities to the CCPA have been proposed or passed at the U.S. federal and state levels, such as the Colorado Privacy Act. Additionally, the Federal Trade Commission and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination and security of data as well as requiring disclosures about these practices. Existing and potential future data privacy laws pose increasingly complex compliance challenges and potentially elevate our costs. Any failure by us to comply with these laws and regulations, including as a result of a security or privacy breach, could result in significant penalties and liabilities for us. Additionally, if we acquire a company that has violated or is not in compliance with applicable data protection laws, we may incur significant liabilities and penalties as a result. 38 38 38 38 38 38