Data Privacy & AI
Does a lawful collection notice cover later uses of the same records?
No, not automatically. A lawful collection settles one processing activity, not every later use of the same records. I analyze privacy compliance on a processing-activity basis: each new use of personal information gets its own look under the GDPR and the CCPA. When an AI feature, model or training run changes why you process the records, your obligations can change too, and so can your legal role. Here's the full framework.
What does it cost to assume your signup notice covers it?
You ship a feature that learns from customer data, because the privacy work was done at signup. Then an enterprise customer's AI addendum asks whether you train on their data. Now nobody on your team can say what the honest answer means for you.
The shortcut is common. Many founders assume that if they comply as a processor or service provider, they can also use that data to train models or improve products without more analysis. That assumption is incorrect. AI has widened what you can do with information you already hold, so checking compliance only at the point of collection no longer works.
A new activity can bring duties your notice never mentioned: more transparency, new contract terms, consumer rights, purpose limitation and data governance. I set out the whole analysis in Charlotte Corporate Counsel's startup guide to AI under the GDPR and CCPA.
Same records, new purpose: where your role can flip
Take an analytics startup that serves enterprise customers under a service provider agreement. It processes each customer's data for one reason: to generate that customer's reports, as the written contract says.
Months later, the team wants to train its own large language model on the same data, to improve products for future customers. Although the information being processed has not changed, the purpose for which it is processed has.
That training run serves the startup, not the customer. So for that one activity, the startup has to reassess whether it's still a service provider or processor, or whether new obligations arise under the CCPA or the GDPR. The reports keep running as before. The training run is its own question.
One caveat cuts the other way. If the training set is truly deidentified or anonymized, the analysis may differ a lot, because both statutes exclude information that can no longer identify a person.
Four checks before your next feature touches data you hold
Run these per feature, per model and per training run. Each one takes a whiteboard, not a law library.
- Write the activity in one line.Which records, what the system does with them, and who benefits. "Generate Customer A's monthly report" and "train our model for every customer" are two lines.
- Ask whose purpose it serves.If it serves your product rather than the customer who handed you the data, re-test your role for that activity under both statutes.
- Check what the data is now.Personal information, deidentified data and aggregate consumer information each lead to a different analysis.
- Compare what you have with what the new role needs.Put your privacy policy, notice and DPA next to the transparency, contract and consumer-rights duties the activity brings. Fix the gaps before the job ships.
So when your customer's addendum asks whether you train on their data, you'll already know: that's a separate activity, and you've run it through the checks.
Working on something like this?
A few lines is enough: what you're working on, and when you need it.
Tell Charlotte about itRead the full argument
Jurisdiction, the statutory roles and how AI changes each one are all in my essay, Analyzing AI privacy obligations one processing activity at a time, not once at collection.
