If a business does not identify a specific use for information in a notice at collection, is it prohibited from using information in that manner?

Not necessarily.

The CCPA states that a business may not “use personal information” that is collected for one purpose for a different purpose without “providing the consumer with notice” of the new use.1 The regulations implementing the CCPA, however, expand upon the notice requirement.

According to the regulations, if a new use is “materially different” than former uses (about which a consumer was notified), a business must not only send notice to the consumer of the new use, but also “obtain explicit consent from the consumer to use [the personal information] for this new purpose.”2 At the same time, the California Attorney General has recognized that if a new use is not materially different than a former use, a business is neither required to notify consumers or to obtain their consent.3