Not necessarily.
The CCPA states that a business may not “use personal information” that is collected for one purpose for a different purpose without “providing the consumer with notice” of the new use.1 The regulations implementing the CCPA, however, expand upon the notice requirement.
According to the regulations, if a new use is “materially different” than former uses (about which a consumer was notified), a business must not only send notice to the consumer of the new use, but also “obtain explicit consent from the consumer to use [the personal information] for this new purpose.”2 At the same time, the California Attorney General has recognized that if a new use is not materially different than a former use, a business is neither required to notify consumers or to obtain their consent.3
For more information and resources about the CCPA visit http://www.CCPA-info.com.
This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes. You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.
1. CCPA Section 1798.100(b).
2. CCPA Reg. Section 999.305(a)(5).
3. FSOR at 9.
[View source.]
