A California-based wealth management firm trains its AI suitability model using five years of historical client transaction data, including account balances, investment preferences, and behavioral patterns. The firm did not obtain specific opt-out rights for this use of data beyond its standard account agreement executed prior to CCPA's effective date. Under the California Consumer Privacy Act (CCPA/CPRA), which requirement presents the most immediate compliance gap?

Under the California Consumer Privacy Act, as amended by the CPRA, businesses must disclose in their privacy notices all purposes for which personal information is collected and used. Using personal information to train an AI model is a distinct processing purpose that must be explicitly disclosed; it does not fall within the implicit scope of providing financial services under a standard account agreement. A standard account agreement executed before the CCPA took effect does not automatically cover this later, distinct processing purpose.

The requirement that presents the most immediate compliance gap is therefore the privacy-notice-and-opt-out requirement: the firm must update its privacy notice to disclose AI model training as a business purpose for personal information use, and honor any consumer opt-out requests for sale or sharing of personal information for this purpose.

The CCPA/CPRA does not generally require opt-in consent for business uses of personal data by the collecting business. Opt-in consent is required specifically for sensitive personal information and for sharing with third parties for cross-context behavioral advertising. However, the law does require notice of purpose in the privacy policy; the right to opt out of sale or sharing of personal information, which can include model training data shared with AI vendors or used in ways that constitute sharing under CPRA's expanded definition; and data minimization and purpose limitation compliance under CPRA's strengthened requirements.

The affirmative opt-in consent requirement overstates the CCPA requirement because opt-in is not the general standard for first-party data processing. The correct standard is notice plus an opt-out opportunity. The GLBA exemption claim addresses a frequently misapplied exemption. The GLBA exemption under CCPA applies to personal information collected and used in the course of providing financial products or services, not to all uses of financial customer data. Using client data to train an AI model that will be deployed across the client base, and potentially licensed to others, may extend beyond the scope of the exemption. The mandatory deletion and retraining requirement is not an automatic CCPA remedy and would only be required in response to a valid deletion request from an individual consumer.

The firm's most defensible path forward is a three-step remediation: update the privacy notice to specifically disclose AI model training as a stated processing purpose, assess whether the training use constitutes sharing requiring additional controls, and implement a mechanism to honor opt-out requests prospectively.