Yahoo 2010 Annual Report Download - page 20

risk of liability, our costs of compliance with these regulations or to defend litigation may increase, or our ability
to operate certain lines of business may be limited. The Children’s Online Privacy Protection Act is intended to
impose restrictions on the ability of online services to collect some types of information from children under the
age of 13. In addition, Providing Resources, Officers, and Technology to Eradicate Cyber Threats to Our
Children Act of 2008 (“PROTECT Act”) requires online service providers to report evidence of violations of
federal child pornography laws under certain circumstances. Other federal and state laws and legislative efforts
designed to protect children on the Internet may impose additional requirements on us. U.S. export control laws
and regulations impose requirements and restrictions on exports to certain nations and persons and on our
business. The cost of compliance with these and any other laws or regulations may increase in the future as a
result of changes in the laws or regulations or the interpretation of them. Further, any failure on our part to
comply with any relevant laws or regulations may subject us to significant liabilities.
Changes in regulations or user concerns regarding privacy and protection of user data, or any failure to
comply with such laws, could adversely affect our business.
Federal, state and international laws and regulations govern the collection, use, retention, sharing and security of
data that we receive from and about our users. Our privacy policies and practices concerning the collection, use,
and disclosure of user data are posted on our and many of our Affiliates’ Websites. Any failure, or perceived
failure, by us to comply with our posted privacy policies or with any data-related consent orders, Federal Trade
Commission requirements or orders, or other federal, state, or international privacy or data-protection-related
laws, regulations or industry self-regulatory principles could result in proceedings or actions against us by
governmental entities or others, which could potentially have an adverse effect on our business.
Further, failure or perceived failure by us to comply with our policies, applicable requirements, or industry self-
regulatory principles related to the collection, use, sharing or security of personal information, or other privacy,
data-retention or data-protection matters could result in a loss of user confidence in us, damage to the Yahoo!
brands, and ultimately in a loss of users, advertising partners, or Affiliates which could adversely affect our
business.
In addition, various federal, state and foreign legislative or regulatory bodies may enact new or additional laws
and regulations concerning privacy, data-retention and data-protection issues which could adversely impact our
business. The interpretation and application of privacy, data protection and data retention laws and regulations
are currently unsettled in the U.S. and internationally. These laws may be interpreted and applied inconsistently
from country to country and inconsistently with our current policies and practices. Complying with these varying
international requirements could cause us to incur substantial costs or require us to change our business practices
in a manner adverse to our business.
If our security measures are breached, our products and services may be perceived as not being secure, users
and customers may curtail or stop using our products and services, and we may incur significant legal and
financial exposure.
Our products and services involve the storage and transmission of Yahoo!’s, users’ and customers’ proprietary
information, and security breaches could expose us to a risk of loss of this information, litigation, and potential
liability. Our security measures may be breached due to the actions of outside parties, employee error,
malfeasance, or otherwise, and, as a result, an unauthorized party may obtain access to our data or our users’ or
customers’ data. Additionally, outside parties may attempt to fraudulently induce employees, users, or customers
to disclose sensitive information in order to gain access to our data or our users’ or customers’ data. Any such
breach or unauthorized access could result in significant legal and financial exposure, increased costs to defend
litigation or damage to our reputation, and a loss of confidence in the security of our products and services that
could potentially have an adverse effect on our business. Because the techniques used to obtain unauthorized
access, disable or degrade service, or sabotage systems change frequently and often are not recognized until
launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative
measures. If an actual or perceived breach of our security occurs, the market perception of the effectiveness of
our security measures could be harmed and we could lose users and customers.
18