r/CCPA • u/PutSad644 • May 16 '26

Secondary use of analytics data

Data is collected in Analytics and BI platforms.

The company also wants to run segmentation models on the data for ad targeting and content personalization. Consent is obviously required for the secondary use, but not for analytics / BI.

Does the data stored in those platforms have to keep the consent status from when it was collected or is it enough to exclude non-consenting users from models / segments that will be used for targeting and personalization?

In the latter, the company will need to process the data to determine which events are associated to which users in order to determine whether they have consented to the secondary purposes. Does this processing require consent?

One of the platforms in question states that their compliance to consent is entirely based on whether they are allowed to collect the data - but how do you handle different consent settings for different downstream purposes? Would it be ok to enforce consent for the secondary purpose only in the downstream targeting systems?

Thanks

2 Upvotes

100% Upvoted

1 comment sorted by

1

u/mrdontknowitatall Jun 09 '26

The short answer depends on what happens to the data between collection and when you use it for targeting.

If it just sits in your analytics store untouched, then filtering out non-consenting users at the segment stage is fine. But if anything happens to it in between, joining it with other data, building features, prepping it for targeting in any way, then you've already used it for the secondary purpose without consent. Filtering at the end doesn't undo that.

The processing you described, joining events to users to figure out who consented to what, doesn't need its own consent. That's compliance work, not a separate use of the data.

On the platform saying their compliance is only about collection, that's them protecting themselves. They're a processor, you're the controller, and you're on the hook for what happens after collection regardless of what they cover.

The easiest pattern most teams use is to store the consent status alongside each user or event record. Then you use it as a filter when building segments. Cleaner audit trail and you don't have to argue about what counted as processing in between.