Do California's new risk assessment rules apply to licensing data for AI?

What do the CCPA risk assessment regulations require?#

The CCPA risk assessment regulations require a covered business to assess processing that presents significant risk to consumers' privacy before the processing begins, and to weigh whether the risks outweigh the benefits. The California Privacy Protection Agency adopted them under the CCPA as amended by the CPRA, alongside rules on automated decision-making technology and cybersecurity audits.

An assessment generally documents the purpose of the processing, the categories of personal information involved, how the processing works, the expected benefits, the negative impacts on consumers and the safeguards that address them. Named people review and approve it, and the business keeps it and provides certain information about it to the agency.

The rules apply only to businesses covered by the CCPA, and they reach California residents' personal information, including that of employees and business contacts.

Which triggers can a licensing deal hit?#

A licensing deal can hit the triggers for selling or sharing personal information and for processing sensitive personal information, and some deals touch the triggers tied to training certain technologies. Use the checklist below with counsel before any package containing personal information is approved.

Note which party each trigger usually falls on. The supplier's assessment covers its decision to license; the buyer's own training and deployment choices can require separate assessments on its side.

Does licensing count as selling personal information?#

Licensing records that contain personal information for a fee or other valuable consideration generally fits the CCPA's broad definition of selling, which covers making personal information available to a third party, not only transferring ownership. That the data is licensed rather than sold outright does not usually change the analysis.

A sale brings duties beyond the risk assessment, including notice at collection and the right to opt out. For historical records collected before any licensing plan existed, the question is whether consumers received notice covering this use, which older privacy notices may not have given.

Sharing has its own meaning in the CCPA, tied to cross-context behavioral advertising, and rarely describes a licensing deal. For AI licensing, the sale question is usually the one that matters.

Where de-identified data fits#

De-identified data fits outside the CCPA when it meets the statute's de-identification standard, which generally calls for reasonable technical measures against re-identification, a public commitment not to re-identify, and contract terms binding recipients to the same. Data that meets the standard is not personal information, so licensing it is not a sale and does not on its own trigger a risk assessment.

Pseudonymized data is different. Replacing names with tokens while keeping a key, or keeping consistent identifiers that link records to individuals, generally leaves the data personal. Operational records need careful work to reach the standard, because free text in tickets, emails and notes carries names and details that structured fields do not.

Free text is where most preparation effort goes. Automated detection tools handle structured patterns such as email addresses and phone numbers well, but names in signatures, addresses in notes and details people type about themselves need human review before a privacy lead can sign off. The open-source Presidio project says as much in its own documentation: because it uses automated detection, there is no guarantee it will find all sensitive information, so additional protections are needed.

How do the compliance phases work?#

The compliance phases for the risk assessment rules separate new processing, existing processing and submissions to the agency, and the exact dates are set in the final regulations. Confirm the current schedule with counsel, because compliance dates can be adjusted and the automated decision-making and cybersecurity audit rules follow their own timelines.

For a licensing program the practical reading is simple: if a package with personal information is planned, assume the assessment comes first, and build it into the deal plan rather than treating it as a filing task after signing.

• 1New processing: an assessment is required before processing that starts after the rules take effect.
• 2Existing processing: activities already under way receive a later deadline to be assessed and documented.
• 3Submissions: attestations and summary information go to the California Privacy Protection Agency on a later schedule.
• 4Updates: assessments are reviewed periodically and whenever the processing changes materially.
• 5Retention: completed assessments are kept while the processing continues and for a period afterward.

Illustrative: a software company chooses de-identification#

Illustrative: a fictional B2B software company with California customers plans to license support tickets from Zendesk and related Slack threads for training customer support models. The tickets contain end users' names, email addresses, phone numbers and occasional account credentials typed into messages.

Its privacy lead runs the trigger checklist. Licensing the raw tickets would likely be a sale involving sensitive personal information, triggering an assessment and raising notice questions about older records. The company instead commits to de-identification: automated detection plus human review removes identifiers and credentials, no re-identification key is kept, and the license binds the buyer not to re-identify.

Counsel concludes that the prepared package does not require a risk assessment for the licensing itself. The privacy lead still writes a short memo recording the de-identification method and reviewers, in case the agency or a customer asks.

How SourceX supports the privacy record#

SourceX handles de-identification in the Preparation step of the SourceX five-step transaction, after the Rights step has identified which record families contain personal or sensitive information. The privacy record in the SourceX Evidence Packet documents the categories removed, the methods used, the human review and the recipient's commitments, which is the material a risk assessment or a de-identification memo needs.

SourceX does not decide whether a supplier must conduct a risk assessment. The supplier's privacy lead and counsel make that call using the documented facts.