Gen Digital Inc. Common Stock

Data and privacy · Data protection and privacy laws

We collect, use, disclose, store or otherwise process personal information and other sensitive data, which is subject to stringent and changing state and federal laws and regulations. In the operation of our business, particularly in relation to our identity and information protection service and financial wellness offerings, we collect, use, process, store, transmit or disclose an increasingly large amount of confidential information, including personal information from employees and customers in multiple jurisdictions.

Data and privacy · Cross border data transfer regulations

We process personal data relating to individuals in the European Economic Area or the United Kingdom and are subject to the EU General Data Protection Regulation (GDPR) and the UK GDPR, which impose significant compliance obligations, restrict cross-border data transfers and authorize substantial administrative fines for noncompliance.

Data and privacy · Consumer privacy and consent

At the state level, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CCPA), and similar comprehensive privacy laws enacted in multiple other U.S. states, provide consumers with rights to access, correct, delete and restrict the use, sale or sharing of their personal information and impose disclosure, governance and data protection obligations on covered businesses.

Data and privacy · Regulatory investigations and penalties

Any failure or perceived failure by us to comply with such obligations has previously and may in the future result in governmental enforcement actions, fines, litigation (including class actions) or public statements against us by consumer advocacy groups or others and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

Legal and litigation · Employment and labor law compliance

We maintain a compliance program designed to enable us to comply with all applicable anti-money laundering, anti-terrorism financing and economic sanctions laws and regulations, including the Bank Secrecy Act (BSA), as amended by the USA PATRIOT Act of 2001, and its implementing regulations.

Legal and litigation · Product liability and warranty claims

If AI-enabled features in our products produce incorrect, incomplete or biased outputs, we could face claims of misrepresentation, negligence, product liability or other legal theories, as well as customer dissatisfaction, reputational harm and loss of business.

Geopolitical and trade · Trade policies tariffs and sanctions

Requirements of foreign laws and other governmental controls, including tariffs, trade barriers and labor restrictions, and related laws that reduce the flexibility of our business operations. Changes in trade relations arising from policy initiatives or other political factors. Macroeconomic factors, such as fluctuating tariffs, trade wars, high inflation, high interest rates, and volatility in foreign currency exchange rates and capital markets could negatively influence our future acquisition opportunities.

Geopolitical and trade · Political instability and government changes

Political, social or economic unrest, war, terrorism, regional natural disasters, or export controls and trade restrictions, particularly in areas in which we have facilities and in areas where our engineering and technical development teams are based. It is not possible to predict the broader consequences of existing geopolitical conflicts and other conflicts that may arise in the future, which could include geopolitical instability and uncertainty.

Geopolitical and trade · International conflicts and tensions

In addition, we face the risk of cyberattacks by nation-states and state-sponsored actors, which may increase due to geopolitical tensions. These attacks may target us, our partners, suppliers, vendors or customers. It is not possible to predict the broader consequences of existing geopolitical conflicts and other conflicts that may arise in the future, which could include geopolitical instability and uncertainty; adverse impacts on global and regional economic conditions and financial markets.

Natural and catastrophic events · Pandemic and public health crises

These facilities are vulnerable to damage, interference, interruption or performance problems from earthquakes, hurricanes, floods, fires, power loss, telecommunications failures, pandemics and similar events. A disruption or failure of these systems or operations because of a disaster, cyberattack or other business continuity event, such as a pandemic, could cause data to be lost or otherwise delay our ability to complete sales.

Natural and catastrophic events · Natural disasters and extreme weather

The occurrence of a natural disaster, an act of terrorism, state-sponsored attacks, a pandemic, geopolitical tensions or armed conflicts, and similar events could result in facility closures or other unanticipated problems without adequate notice, which in turn, could result in lengthy interruptions in the delivery of our products and services and negatively impact our sales and operating results.

Digital transformation and innovation · Artificial intelligence and automation

The development and integration of new technologies — including generative AI ('Gen AI') and machine learning — is complex, time-consuming, and subject to significant risks. New technologies may contain errors, vulnerabilities, or unintended outputs, including incorrect or biased results, that are not easily detectable, which could lead to customer dissatisfaction, reputational harm, litigation, or increased regulatory scrutiny.

Cybersecurity and data protection · Insider threats and access controls

When a data breach occurs, our information technology systems and infrastructure can be subject to damage, compromise, disruption, and shutdown due to attacks or breaches by hackers or other circumstances, such as error or malfeasance by employees or third-party service providers, phishing, social engineering, account takeovers, vulnerability exploitation, misconfigurations, ransomware, or technology malfunction.

Cybersecurity and data protection · Third party data security and vendors

Malicious hackers, state-sponsored actors, insiders and third-party service providers have attempted to penetrate, and in some cases succeeded in penetrating, our networks or those of our vendors. Such attempts are increasing in number and in technical sophistication, including through the use of AI, and have in the past and could in the future expose us and the affected parties, to risk of loss or misuse of proprietary, personal or confidential information or disruptions of our business operations.

Digital transformation and innovation · Technology implementation and upgrades

Our evolving IT environment, including embracing new ways of sharing data and communicating and increasing our internal use of Gen AI, may introduce new attack vectors, and our policies and controls may not keep pace with emerging threats or regulatory requirements.

Information management · Data quality and integrity

The software upon which we rely may contain undetected technical errors or bugs, which may only be discovered after the code has been released for external or internal use. Technical errors or other design defects within the software upon which we rely may result in a negative experience for customers, clients or third-party partners and issues in our provision of our products and services or their functionality.

Technology infrastructure · Legacy systems and technical debt

We and our third-party service providers have experienced and may continue to experience such incidents, particularly as we integrate legacy IT infrastructure and systems. Threat actors have previously and could in the future exploit a new vulnerability before we complete our remediation work or identify a vulnerability that we did not effectively remediate.

Market position and competition · Competitive pressure and market share loss

We operate in intensely competitive and dynamic markets characterized by rapid technological developments, evolving industry and regulatory standards and market trends, changing customer requirements and preferences, and frequent new product introductions and improvements. We have experienced, and expect to continue to experience, significant competitive pressures. If we are unable to anticipate or respond effectively to these continually evolving conditions, we could lose market share, experience pricing pressure, and incur reduced revenues.

Market position and competition · Disruptive competitors and new market entrants

In addition, operating system and platform providers increasingly incorporate native security, privacy, and financial features into their products, often at no additional cost, which may reduce demand for our offerings or diminish their differentiation. Industry consolidation, vertical integration, and the introduction of new or alternative technologies may further intensify competition.

Corporate governance · Internal controls and risk management

Any weaknesses in our compliance management system may also subject us to penalties or enforcement action by the CFPB or state regulators. We have in the past, and may again in the future, enter into settlements, consent decrees and similar arrangements with the FTC, the CFPB, state attorneys generals and other state regulators.