Do I need consent to license customer data for AI?
The short answer
Under California's CCPA, a sale needs notice and opt-out right. Opt-in applies only for under 16. What you promised at collection matters more. The FTC said quiet changes may be unfair. Ask a lawyer who has read your old notices.
California is the example here because its statute is the most detailed. Other states set their own rules, and some are stricter.
What does the CCPA require for a sale of customer data?
A "sale" is disclosing personal information to a third party for "monetary or other valuable consideration." Section 1798.120 gives a consumer the right to tell a business not to sell. It also requires the business to give notice of that right.
Opt-in is the rule for known minors. Say a business has actual knowledge that a consumer is under 16. It cannot sell that data unless the consumer affirmatively authorizes it. For a child under 13, a parent must authorize it.
Why do my old customer promises matter so much?
A sale that contradicts a notice is the pattern regulators go after. The FTC's staff post says a business that collects data under one set of privacy promises cannot simply go back on them. It cites cases going back to 2004.
The FTC also said that widening data use through a surreptitious, retroactive amendment may be unfair or deceptive.
On that reading, updating a notice after collection may not settle the question for data you already collected. Ask counsel how it applies to your old notices.
Does the GDPR work the same way?
No. The GDPR asks whether a new purpose is compatible with the original one. Article 6(4) lists the factors:
- any link between the purposes
- the context and the relationship with the person
- the nature of the data
- the possible consequences
- the safeguards
For data not collected from the person, Article 14(4) applies. The controller must give the person information on the new purpose before the further processing starts. The controller is the company that decides how the data is used. A lawyer in the EU or UK can say whether licensing for AI training clears that test.
What did regulators do when a company sold data at scale?
In the 23andMe sale, Missouri's attorney general announced on 2 Jul 2025 that a multistate effort won two things. Consumers got a right to delete their data. Resale also got limits. The buyer, TTAM Research Institute, is a nonprofit.
That was a bankruptcy sale of consumer data. It shows the pressure states apply. It does not describe a private sale.
California's attorney general settled with General Motors on 8 May 2026. The case was about driving data sold to buyers against what GM told drivers. See licensing customer data.
Talk to a privacy or commercial lawyer in your state before you sign. Our rights check asks what your customer contracts and terms allow and lists what to take to counsel.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
