A California-based wealth management firm trains its AI suitability model using five years of historical client transaction data, including account balances, investment preferences, and behavioral patterns. The firm did not obtain specific opt-out rights for this use of data beyond its standard account agreement executed prior to CCPA's effective date. Under the California Consumer Privacy Act (CCPA/CPRA), which requirement presents the most immediate compliance gap?
Select an answer to reveal the explanation.
Short Explanation and Infographic
CCPA doesn't require opt-in for most AI training uses — but it absolutely requires that you tell clients you're doing it and give them a way to say no. Using client data for a purpose not disclosed in your privacy notice is a CCPA violation right there. The GLBA exemption is real but narrower than most people think — it only covers financial product and service data used for those products, not repurposing data for AI model development that goes beyond that scope.
Full explanation below image
Full Explanation
The California Consumer Privacy Act (as amended by CPRA in 2023) establishes that businesses must disclose in their privacy notices all purposes for which personal information is collected and used. Using personal information to train an AI model is a distinct processing purpose that must be explicitly disclosed — it does not fall within the implicit scope of providing financial services under a standard account agreement.
The CCPA/CPRA does not generally require opt-in consent for business uses of personal data by the collecting business (opt-in consent is required specifically for sensitive personal information and for sharing with third parties for cross-context behavioral advertising). However, it does require: (1) notice of purpose in the privacy policy; (2) the right to opt-out of 'sale or sharing' of personal information (which can include model training data shared with AI vendors or used in ways that constitute sharing under CPRA's expanded definition); and (3) data minimization and purpose limitation compliance under CPRA's strengthened requirements.
Option A overstates the CCPA requirement — opt-in is not the general standard for first-party data processing. The correct standard is notice plus opt-out opportunity. Option C addresses the GLBA exemption, which is frequently misapplied. The GLBA exemption under CCPA applies to personal information collected and used in the course of providing financial products or services — not to all uses of financial customer data. Using client data to train an AI model that will be deployed across the client base (and potentially licensed to others) may extend beyond the scope of the exemption. Option D (mandatory deletion and retraining) is not an automatic CCPA remedy and would only be required in response to a valid deletion request from an individual consumer.
The firm's most defensible path forward is a three-step remediation: update the privacy notice to specifically disclose AI model training as a stated processing purpose, assess whether the training use constitutes 'sharing' requiring additional controls, and implement a mechanism to honor opt-out requests prospectively.