Yahoo 2013 Annual Report Download - page 23

materials that give rise to copyright infringement. Portions of the Communications Decency Act (“CDA”) are
intended to provide statutory protections to online service providers who distribute third-party content. We rely
on the protections provided by both the DMCA and the CDA in conducting our business, and may be adversely
impacted by future legislation and future judicial decisions altering these safe harbors or if international
jurisdictions refuse to apply similar protections.
The Children’s Online Privacy Protection Act and rule, as amended in December 2012 (“COPPA”), impose
restrictions on the ability of online services to collect some types of information from children under the age of
13. In addition, Providing Resources, Officers, and Technology to Eradicate Cyber Threats to Our Children Act
of 2008 (“PROTECT”) requires online service providers to report evidence of violations of federal child
pornography laws under certain circumstances. COPPA and PROTECT currently impose restrictions and
requirements on our business, and other federal, state or international laws and legislative efforts designed to
protect children on the Internet may impose additional requirements on us.
Changes in regulations or user concerns regarding privacy and protection of user data, or any failure to
comply with such laws, could adversely affect our business.
Federal, state, and international laws and regulations govern the collection, use, retention, disclosure, sharing and
security of data that we receive from and about our users. The use of consumer data by online service providers
and advertising networks is a topic of active interest among federal, state, and international regulatory bodies,
and the regulatory environment is unsettled. Many states have passed laws requiring notification to users where
there is a security breach for personal data, such as California’s Information Practices Act. We face similar risks
in international markets where our products and services are offered. Any failure, or perceived failure, by us to
comply with or make effective modifications to our policies, or to comply with any federal, state, or international
privacy, data-retention or data-protection-related laws, regulations, orders or industry self-regulatory principles
could result in proceedings or actions against us by governmental entities or others, a loss of user confidence,
damage to the Yahoo brands, and a loss of users, advertising partners, or Affiliates, any of which could
potentially have an adverse effect on our business.
In addition, various federal, state and foreign legislative or regulatory bodies may enact new or additional laws
and regulations concerning privacy, data-retention and data-protection issues, including laws or regulations
mandating disclosure to domestic or international law enforcement bodies, which could adversely impact our
business, our brand or our reputation with users. For example, some countries are considering laws mandating
that user data regarding users in their country be maintained in their country. Having to maintain local data
centers in individual countries could increase our operating costs significantly. The interpretation and application
of privacy, data protection and data retention laws and regulations are often uncertain and in flux in the U.S. and
internationally. These laws may be interpreted and applied inconsistently from country to country and
inconsistently with our current policies and practices, complicating long-range business planning decisions. If
privacy, data protection or data retention laws are interpreted and applied in a manner that is inconsistent with
our current policies and practices we may be fined or ordered to change our business practices in a manner that
adversely impacts our operating results. Complying with these varying international requirements could cause us
to incur substantial costs or require us to change our business practices in a manner adverse to our business and
operating results.
If our security measures are breached, our products and services may be perceived as not being secure, users
and customers may curtail or stop using our products and services, and we may incur significant legal and
financial exposure.
Our products and services involve the storage and transmission of Yahoo’s users’ and customers’ personal and
proprietary information in our facilities and on our equipment, networks and corporate systems. Security
breaches expose us to a risk of loss of this information, litigation, remediation costs, increased costs for security
measures, loss of revenue, damage to our reputation, and potential liability. Security breaches or unauthorized
21