---
title: "List privacy fact gaps before a commercial AI product is deployed"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/run-a-privacy-impact-assessment-before-a-client-deploys-a-commercial-ai/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-B1-1-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# List privacy fact gaps before a commercial AI product is deployed

> From the deployment notes the lawyer supplies, list the categories of personal information, the purposes, whether sale or sharing is described, the retention stated, and any security measure the notes name.…

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/run-a-privacy-impact-assessment-before-a-client-deploys-a-commercial-ai/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the deployment notes the lawyer supplies, list the categories of personal information, the purposes, whether sale or sharing is described, the retention stated, and any security measure the notes name. Mark an item not stated when the notes are silent. Decide nothing about whether deployment is lawful. |
| What the lawyer must review | Civil Code section 1798.100(a) requires a business that controls collection to inform the consumer, at or before collection, of the categories, the purposes, whether the information is sold or shared, the sensitive-information categories where relevant, and the retention period or the criteria used to set it. The business must not collect additional categories, or use information for an incompatible purpose, without notice consistent with the section. Subsection (c) requires collection, use, retention, and sharing to be reasonably necessary and proportionate to the disclosed purpose or another disclosed compatible purpose. Subsection (e) requires reasonable security procedures and practices appropriate to the nature of the information, in accordance with section 1798.81.5, which was not opened. The gap list is not the notice and it is not a finding that deployment complies. Opinion 512 and Model Rule 1.6: the notes can be client and consumer information. |
| Written for | United States |
| Applies to | [Run a privacy impact assessment before a client deploys a commercial AI product](https://ailawframework.com/practice/privacy-data-protection-and-cyber/run-a-privacy-impact-assessment-before-a-client-deploys-a-commercial-ai.md) |

## Checking plan

- What the AI does: From the deployment notes the lawyer supplies, list the categories of personal information, the purposes, whether sale or sharing is described, the retention stated, and any security measure the notes name. Mark an item not stated when the notes are silent. Decide nothing about whether deployment is lawful.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- Only a business covered by the CCPA has these duties. Open section 1798.140 before you treat the client as one.
- Do not copy an Australian automated-decision date into this list. It is not in section 1798.100.

## Sources

- [California Civil Code section 1798.100 (duties of businesses that collect personal information)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100.) (checked 2026-10-22)
- [California Attorney General: California Consumer Privacy Act (CCPA)](https://oag.ca.gov/privacy/ccpa) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*