Data Privacy & AI · Essay
A Lawful Collection Does Not Make the Next Use Lawful
Published
Before your team trains a model or ships a feature on customer records you already have, here’s the check that tells you whether your privacy role just changed.
Your team wants to train a model on the customer data your product already processes, and someone says it’s covered: the privacy policy is live, the DPA is signed, and the data came in lawfully. A lawful collection doesn’t make the next use of that data lawful. By the end of this essay, you’ll have a five-step check to run before any feature, model, or training run touches held data.
Here’s what’s at stake. A new purpose can change your legal role for that one activity. You can go from working for your customer, as a service provider or processor, to deciding for yourself, as a business or controller. That role brings its own duties: more transparency, new contract terms, consumer rights, purpose limits, and data governance work.
None of that was in scope when you wrote the notice. It tends to surface at the worst time, like when an enterprise customer sends an AI addendum with a deal and asks what you do with their data.
A clean notice and a signed DPA settle the collection, not the next use
Most startup privacy advice centers on the moment data comes in. Write a clear notice. Get consent where the law requires it. Sign a template data processing agreement with your vendors, and keep a records inventory. You need all of that.
It breaks the day your existing product starts pointing a model at records you already have. Nothing new got collected, so nothing on the collection checklist fires. Even the advice to “reassess when your use changes materially” leaves you guessing what to reassess, and what counts as material.
In my startup guide to analyzing AI under the GDPR and CCPA, I take on the assumption head on. Many founders believe that if they already comply as a processor or service provider, they can use the same information to train models without more analysis. “That assumption is incorrect.”
The data didn’t change. The purpose did, and your role can change with it.
I analyze privacy on a processing-activity basis. Each new use of personal information gets its own analysis. You don’t assume that compliance for one use carries over to the next.
AI is what makes this urgent. The records you collected through sign-ups, contact forms, and browsing now sit next to prompts, uploaded documents, and chat histories. Your features use them to generate inferences, profile users, and predict behavior. Each of those is a processing activity of its own.
In my words
“Founders should analyze privacy compliance on a processing-activity basis, evaluating each new use of personal information rather than assuming compliance for one processing activity automatically extends to the other.”Charlotte Lynn Luu, From Customer Data to AI Processing: A Start Up’s Guide to Analyzing the Privacy Implications of AI Under the GDPR and CCPA
Watch what happens when an analytics startup trains its own model
Here’s the example I use. A startup sells AI-powered analytics to enterprise customers under a service provider agreement. At first, it processes each customer’s data only to generate reports for that customer, under a written contract.
Months later, it decides to train its own large language model on the same customer data, to improve products for future customers. Not one record has changed.
“Although the information being processed has not changed, the purpose for which it is processed has.”Charlotte Lynn Luu, From Customer Data to AI Processing
That training run is a new processing activity. The startup has to ask again whether it’s still a service provider or processor for it, and whether new obligations come with the answer. Same company, same records, two activities, possibly two roles.
| Same records | Activity 1: reports for the customer | Activity 2: training its own model |
|---|---|---|
| Purpose | Reports for that customer | A better model for future customers |
| Who decided it | The customer, through a written contract | The startup, months later |
| Role to test | Service provider (CCPA) or processor (GDPR) | Still one, or now a business or controller for this use |
Source: From Customer Data to AI Processing, Charlotte Corporate Counsel.
One fact can flip the result: whether the data still counts as personal information. If the startup trains on properly anonymized or deidentified data instead, the analysis may come out very differently. If your roadmap has a run like this on it and you can’t say which role you’d be in, tell me a little about what you’re working on.
“We’re too small for this to matter.” Under the GDPR, size doesn’t decide it.
Each law sets your role its own way, and only one of them looks at size.
GDPR
No size threshold
You’re a controller if you decide the purposes and means of processing, whatever your size. It can reach a U.S. startup with no EU office, when you offer goods or services to people in the EU or monitor their behavior there.
CCPA
A “business” meets one of three tests
- More than $25 million in annual gross revenue (as adjusted)
- Buys, sells, or shares the personal information of 100,000 or more consumers or households
- Earns half its revenue or more from selling or sharing it
Below those lines, you can still be regulated as a service provider, contractor, or third party. So a small startup isn’t off the hook. Your role decides which obligations apply, which is why it’s worth testing for each activity.
Run this check before the next feature touches held data
You don’t need a fresh privacy program for every release. The framework stays the same from feature to feature. What your AI work changes is the facts you answer it with, so the re-run is short.
Write the new purpose in one sentence
Put it next to the purpose in your notice and your customer contract. If they don’t match, you’re looking at a new processing activity.
Ask whether it’s still personal information
Both laws reach anything that can directly or indirectly identify a person. Properly deidentified or anonymous data is excluded, so check what this activity actually uses.
Check which law reaches it
The GDPR, through an EU establishment or by targeting or monitoring people in the EU. The CCPA, for California residents’ data handled in connection with business in California.
Name your role for this activity
Business, service provider, contractor, or third party under the CCPA. Controller or processor under the GDPR. Ask who decided the purpose: your customer, or you.
List what that role adds
More transparency, contract terms, consumer rights, purpose limits, or data governance work. Close those gaps before the feature ships, not after a customer asks.
Back to that training run. Your data came in lawfully, and that’s still true. Run the check, and you’ll know whether the new use is lawful too, before the AI addendum lands.
Working on something like this? Tell Charlotte about it.A few lines is enough: what you’re working on, and when you need it.
Does a lawful collection notice cover later uses of the same records?
No. A lawful collection notice covers the purpose it was written for, and it doesn’t automatically cover a later use of the same records. I’m Charlotte Lynn Luu, and I tell founders to analyze privacy one processing activity at a time. When a new feature, model, or training run puts held records to a new purpose, the data is the same but the activity is new. That new purpose can change your role under the CCPA or the GDPR, from service provider or processor to business or controller, with obligations the original notice never addressed.
What founders ask next
These come up once a team starts pointing AI features at customer data it already has.
Is one privacy assessment at collection enough for a product adding new features?
No. An assessment at collection covers the activities it looked at. Each AI feature, model or training run that uses personal information for a new purpose is its own processing activity, and it gets its own look.
Should a startup re-run its privacy analysis every time it points a new feature at held data?
Yes, whenever the feature uses that data for a new purpose. The framework is the same each time, so the re-run is about the facts: what the data is, which law reaches it, which role you play, and what that role adds.
Who carries the privacy obligations when a vendor starts processing held records for its own purposes?
Test the vendor's role again for that activity. A vendor that starts using your records for its own purposes, like training its own model, may no longer be only a service provider or processor for that use, and may carry business or controller obligations for it.
Does deidentified data change the analysis?
It can. Both the GDPR and the CCPA exclude information that no longer identifies a person and can't reasonably be used to. If a training run uses properly deidentified data, the analysis may come out very differently.