Rosetta Stone 2013 Annual Report Download - page 20

Table of Contents
We are subject to U.S. and foreign government regulation of online services which could subject us to claims, judgments, and remedies, including
monetary liabilities and limitations on our business practices.
We are subject to regulations and laws directly applicable to providers of online services. The application of existing domestic and international laws and
regulations to us relating to issues such as user privacy and data protection, data security, defamation, promotions, billing, consumer protection,
accessibility, content regulation, quality of services, and intellectual property ownership and infringement in many instances is unclear or unsettled. Also, the
collection and protection of information from children under the age of 13 is subject to the provisions of the Childrens’ Online Privacy Protection
Act (COPPA), which is particularly relevant to our learning solutions focused on children. In addition, we will also be subject to any new laws and regulations
directly applicable to our domestic and international activities. Internationally, we may also be subject to laws regulating our activities in foreign countries and
to foreign laws and regulations that are inconsistent from country to country. We may incur substantial liabilities for expenses necessary to defend litigation in
connection with such regulations and laws or to comply with these laws and regulations, as well as potential substantial penalties for any failure to comply.
We may be subject to legal liability for cloud-based online services and for data security breaches which could compromise our information
technology network security, trade secrets and customer data.
Our services enable individuals to exchange information and engage in various online activities on a domestic and an international basis. The law relating
to the liability of providers of online services for activities of their users is currently unsettled both within the United States and internationally. Claims may be
brought against us for defamation, negligence, copyright or trademark infringement, unlawful activity, tort, including personal injury, fraud, or other theories
based on the nature and content of information that may be posted online or generated by our users. Defense of any such actions could be costly and involve
significant time and attention of our management and other resources and may require us to change our business in an adverse manner.
In addition, the amount of data we store for our users on our servers (including personal information) will increase as we increase our cloud based
offerings. Any systems failure or compromise of our security that results in the release of our users' data could seriously limit the adoption of our products and
services as well as harm our reputation and brand and, therefore, our business. We may also need to expend significant resources to protect against security
breaches. The risk that these types of events could seriously harm our business is likely to increase as we expand the number of web based products and
services we offer as well as increase the number of countries where we operate.
Further, failure or perceived failure by us to comply with our policies, applicable requirements, or industry self-regulatory principles related to the
collection, use, sharing or security of personal information, or other privacy, data-retention or data-protection matters could result in a loss of user confidence
in us, damage to our brands, and ultimately in a loss of users, advertising partners, or affiliates, which could adversely affect our business.
Hackers develop and deploy viruses, worms, and other malicious software programs that attack our commerce website, products and services and gain
access to our networks and data centers. Groups of hackers may also act in a coordinated manner to launch distributed denial of service attacks, or other
coordinated attacks. Sophisticated organizations or individuals may launch targeted attacks using novel methods to gain access to computers running our
software. These threats may result in breaches of our network or data security, disruptions of our internal systems and business applications, impairment of
our ability to complete sale transactions on our website or provide services to our customers, product development delays, harm to our competitive position
from the compromise of confidential business information, or other negative impacts on our business.
Our possession and use of personal information presents risks and expenses that could harm our business. Unauthorized disclosure or
manipulation of such data, whether through breach of our network security or otherwise, could expose us to costly litigation and damage our
reputation.
Maintaining our network security is of critical importance because our online e-commerce systems and our online administration tools for our Global
Enterprise & Education business store proprietary and confidential customer, employee and other sensitive data, such as names, addresses, other personal
information and credit card numbers. Our call centers also process confidential customer data, which is provided to employees in the call centers. We and our
vendors use commercially available encryption technology to transmit personal information when taking orders. We use security and business controls to limit
access and use of personal information. However, third parties may be able to circumvent these security and business measures by developing and deploying
viruses, worms and other malicious software programs that are designed to attack or attempt to infiltrate our systems and networks. In addition, employee
error, malfeasance or other errors in the storage, use or transmission of personal information could result in a breach of customer or employee privacy. We
employ contractors and temporary and part-time employees who may have access to the personal information of customers and employees. It is possible such
individuals could circumvent our controls, which could result in a breach of customer or employee privacy.
19