---
title: "Check a proposed further use against the purpose limit and the sensitive-information limit"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/check-a-proposed-secondary-use-against-the-use-and-disclosure-rule/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A24-SF20261022-18-US"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Check a proposed further use against the purpose limit and the sensitive-information limit

> Set the proposed use next to the purposes in the collection notice. Mark whether the information is sensitive personal information, and whether the consumer has asked the business to limit that use.

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/check-a-proposed-secondary-use-against-the-use-and-disclosure-rule/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Set the proposed use next to the purposes in the collection notice. Mark whether the information is sensitive personal information, and whether the consumer has asked the business to limit that use. |
| What the lawyer must review | The California Privacy Protection Agency's FAQ says a covered business must limit collection, use, and retention of personal information to purposes a consumer would reasonably expect, purposes compatible with those expectations and disclosed to the consumer, or purposes the consumer agreed to, and that the collection, use, and retention must be reasonably necessary and proportionate. Consent obtained through dark patterns does not count. Sensitive personal information on that page includes a Social Security number, account-access information, precise geolocation, the contents of mail, email, and text messages, genetic data, biometric information used to identify a consumer, and information about health, sex life, sexual orientation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership. The consumer can direct the business to use sensitive personal information only for limited purposes, such as providing the services requested. The Attorney General's page describes the same limit right. |
| Written for | United States |
| Applies to | [Check a proposed secondary use against the use-and-disclosure rule](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/check-a-proposed-secondary-use-against-the-use-and-disclosure-rule.md) |

## Checking plan

- What the AI does: Set the proposed use next to the purposes in the collection notice. Mark whether the information is sensitive personal information, and whether the consumer has asked the business to limit that use.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- A sale or share for cross-context behavioural advertising is a separate opt-out right. The Agency FAQ says the business must wait before asking the consumer to opt back in; the Attorney General's page states a 12-month wait and a response within 15 business days.
- This is not a national use-and-disclosure principle.

## Sources

- [California Privacy Protection Agency: Frequently Asked Questions](https://cppa.ca.gov/faq.html) (checked 2026-10-22)
- [California Attorney General: California Consumer Privacy Act (CCPA)](https://oag.ca.gov/privacy/ccpa) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*