Do I need a new privacy policy to license data to AI?
The short answer
It depends on what your old notices said. California requires notice at or before collection. FTC staff said quiet, retroactive changes may be unfair, and the FTC sued Match and OkCupid on 30 Mar 2026. Ask counsel whether a new use needs fresh notice or consent.
A privacy policy is a promise about how data will be used. Most disputes start when the use changes. The promise stays the same.
What does California require?
Civil Code 1798.100(a)(1) says a business must tell consumers three things at or before the point of collection:
- the categories of personal information collected
- the purposes it is used for
- whether it is sold or shared
The same paragraph bars a business from using personal information for added purposes that clash with the disclosed purpose. Notice is the way around that. The sale rule's merger exception adds a limit. It does not authorize material, retroactive changes to a privacy policy.
What has the FTC said?
The FTC's technology blog speaks to a company that loosens its data practices. It says a quiet, retroactive amendment to its terms of service or privacy policy may be unfair or deceptive. That holds if it is the only way consumers hear of the change. I found no replacement for that post. I found no sign it was withdrawn.
What happened with Match Group and OkCupid?
The FTC's press release says OkCupid's privacy policy told users it did not share personal information except as the policy indicated. The agency says OkCupid shared nearly three million user photos with an unrelated third party. It also shared location and demographic data. That party's investors included OkCupid's founders.
The release describes a settlement. It permanently bars the companies from misrepresenting how they handle personal information. That covers how they collect, use, disclose and protect it. It lists no money.
What does that mean for an archive license?
Your notice history matters. Your old privacy policies, employee handbooks and customer terms show what people were told. They show it as of the day the data was collected. A checklist from the law firm Frankfurt Kurnit Klein and Selz says something similar. Most privacy policies and handbooks do not plan for licensing workplace messages for AI training.
The first step is to collect dated copies of every notice. Our managed readiness service does that. Then your lawyer decides if a new purpose needs notice or consent. The CCPA sale page covers the sale rules.
Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
