Pandora 2016 Annual Report Download - page 37

Federal, state and industry regulations as well as self-regulation related to privacy and data security concerns pose the
threat of lawsuits and other liability, require us to expend significant resources, and may hinder our ability and our
advertisers’ ability to deliver relevant advertising.
€
We collect and utilize demographic and other information from and about our listeners and artists as they interact with
our service, including information which could fall under a definition of “personally identifiable information” under various
state and federal laws. For example, to register for a Pandora account, our listeners must provide the following information:
age, gender, zip code and e-mail address. Listeners must also provide their credit card or debit card numbers and other billing
information in connection with additional service offerings, such as Pandora One or Ticketfly. We also may collect information
from our listeners when they enter information on their profile page, post comments on other listeners’ pages, use other
community or social networking features that are part of our service, participate in polls or contests or sign up to receive e-mail
newsletters. Further, we and third parties use tracking technologies, including “cookies” and related technologies, to help us
manage and track our listeners’ interactions with our service and deliver relevant advertising. We also collect information from
and track artists’ activity on our Pandora Artist Marketing Platform. Third parties may, either without our knowledge or
consent, or in violation of contractual prohibitions, obtain, transmit or utilize our listeners’ or artists’ personally identifiable
information, or data associated with particular users, devices or artists.
€
Various federal and state laws and regulations, as well as the laws of foreign jurisdictions in which we may choose to
operate, govern the collection, use, retention, sharing and security of the data we receive from and about our listeners. Privacy
groups and government authorities have increasingly scrutinized the ways in which companies link personal identities and data
associated with particular users or devices with data collected through the internet, and we expect such scrutiny to continue to
increase. Alleged violations of laws and regulations relating to privacy and data security, and any relevant claims, may expose
us to potential liability and may require us to expend significant resources in responding to and defending such allegations and
claims. Claims or allegations that we have violated laws and regulations relating to privacy and data security have resulted and
could in the future result in negative publicity and a loss of confidence in us by our listeners and our advertisers.
€
Existing privacy-related laws and regulations are evolving and subject to potentially differing interpretations, and
various federal and state legislative and regulatory bodies, as well as foreign legislative and regulatory bodies, may expand
current or enact new laws regarding privacy and data security-related matters. We may find it necessary or desirable to join
self-regulatory bodies or other privacy-related organizations that require compliance with their rules€pertaining to privacy and
data security. We also may be bound by contractual obligations that limit our ability to collect, use, disclose and leverage
listener data and to derive economic value from it. New laws, amendments to or re-interpretations of existing laws, rules€of
self-regulatory bodies, industry standards and contractual obligations, as well as changes in our listeners’ expectations and
demands regarding privacy and data security, may limit our ability to collect, use and disclose, and to leverage and derive
economic value from listener data. We may also be required to expend significant resources to adapt to these changes and to
develop new ways to deliver relevant advertising or otherwise provide value to our advertisers. In particular, government
regulators have proposed “do not track” mechanisms, and requirements that users affirmatively “opt-in” to certain types of data
collection that, if enacted into law or adopted by self-regulatory bodies or as part of industry standards, could significantly
hinder our ability to collect and use data relating to listeners. Restrictions on our ability to collect, access and harness listener
data, or to use or disclose listener data or any profiles that we develop using such data, could in turn limit our ability to stream
personalized music content to our listeners and offer targeted advertising opportunities to our advertising customers, each of
which are critical to the success of our business.
€
We have incurred, and will continue to incur, expenses to comply with privacy and security standards and protocols
imposed by law, regulation, self-regulatory bodies, industry standards and contractual obligations. Increased regulation of data
utilization and distribution practices, including self-regulation and industry standards, could increase our cost of operation,
limit our ability to grow our operations or otherwise adversely affect our business.
Government regulation of the internet is evolving, and unfavorable developments could have an adverse effect on our
operating results.
€
We are subject to general business regulations and laws, as well as regulations and laws specific to the internet. Such
laws and regulations cover sales and other taxes and withholding of taxes, user privacy, data collection and protection,
copyrights, electronic contracts, sales procedures, automatic subscription renewals, credit card processing procedures,
consumer protections, broadband internet access and content restrictions. We cannot guarantee that we have been or will be
fully compliant in every jurisdiction, as it is not entirely clear how existing laws and regulations governing issues such as
privacy, taxation and consumer protection apply to the internet. Moreover, as internet commerce continues to evolve, increasing
regulation by federal, state and foreign agencies becomes more likely. The adoption of any laws or regulations that adversely
Table of Contents
26