Can You Use Existing Customer Data To Test A New Product?

When you're running a business, collecting customer information is often just part of the process. Whether it's contact details, purchase histories or account information, over time, your business can build up quite a collection of data.

Of course, there are privacy obligations to consider when collecting and handling this information. But once you've got it, you might start thinking about what else it could be useful for.

Perhaps you're developing a new product or service, and the customer data you've collected over the years could help you test your ideas, improve certain features or understand what your customers actually need.

After all, you've already collected the information, so why not put it to good use?

However, just because your business legally collected customer information doesn't necessarily mean you're free to use it for something entirely different.

Before using existing customer data for a new project, there are a few important privacy obligations worth understanding.

Can You Use Existing Customer Data For A Different Purpose?

Potentially, yes. However, the fact that your business already holds customer information doesn't necessarily mean you can use it however you like.

In the United States, there isn't one comprehensive federal privacy law governing how every business uses personal information. Instead, different federal and state laws may apply depending on your business, the information involved and where your customers are located.

One important example is the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

Under California's privacy regulations, covered businesses must generally ensure that their use of personal information is reasonably necessary and proportionate to the original purpose of collection or another compatible, disclosed purpose. Other uses generally require valid consent.

Say your business collects customer information to process online orders and arrange deliveries. A few years later, you decide to use those records to test a new product recommendation system.

Although you've already collected the information, testing that system may involve a different purpose from processing the original orders.

Whether this is permitted will depend on the applicable law, what customers were originally told and how the information will actually be used.

It's also important to understand which privacy laws apply to your business.

The CCPA has specific applicability thresholds, so it doesn't automatically cover every small business. However, businesses located outside California may still be subject to its requirements if they handle California residents' information and meet the relevant criteria.

Other states have their own privacy laws, and certain types of information may also be subject to federal legislation.

The key is establishing what your business is legally permitted to do with the information before using it for a new purpose.

Is Improving An Existing Product Different From Testing A New One?

There's a practical difference between improving a service customers already use and developing something entirely separate.

Imagine you operate an online booking platform.

You analyze customer activity to identify errors, improve existing features and understand where customers experience difficulties.

Now imagine you're developing an unrelated financial services product and want to use those same customer records to test how it works.

The connection to your original booking service is much less obvious.

Under California's CCPA regulations, businesses must consider whether a new purpose is compatible with the context in which the information was originally collected.

This includes looking at customers' reasonable expectations, the relationship between the original and proposed purposes, and the potential impact on individuals.

Using information to fix errors in an existing service may be easier to justify than using it to develop a completely unrelated product.

However, calling something a product improvement doesn't automatically make the use lawful. Similarly, testing a new product doesn't necessarily mean you always need customer consent.

What matters is the actual use of the information and whether it complies with the privacy requirements that apply to your business.

When Do You Need Customer Consent?

Not every use of existing customer information requires fresh consent.

However, under California's CCPA regulations, a covered business generally needs valid consent before using personal information for a purpose that falls outside the permitted original or compatible purposes.

For instance, if your business wants to analyze identifiable customer records to develop a product entirely unrelated to the service customers originally signed up for, you may need to obtain their consent before proceeding.

Under the CCPA, valid consent must meet specific requirements. It involves a freely given, specific, informed and unambiguous indication of the consumer's wishes.

Simply including broad language in a privacy policy or assuming customers agree because they continue using your service may not be enough.

Other states also have consent requirements, particularly for certain uses of sensitive personal information.

This can include information such as precise geolocation data, biometric information and certain health-related information, although the definitions and requirements differ between states.

Federal laws may impose additional restrictions in particular sectors, including certain health information regulated under HIPAA and financial information covered by the Gramm-Leach-Bliley Act.

It's important to remember that obtaining consent doesn't necessarily resolve every privacy obligation.

Your business may still need to comply with requirements relating to transparency, security, consumer rights and limits on how information is used.

Does Your Existing Privacy Policy Cover Product Testing?

Your business might already have a privacy policy explaining how customer information is collected, stored and used.

But does it actually reflect what you're now planning to do with that information?

Under applicable state privacy laws, businesses may need to tell customers what personal information they collect, why they collect it and how it will be used or shared.

For businesses covered by the CCPA, privacy notices and purpose limitations are particularly important.

If your existing policy explains that customer information is collected to provide a particular service, it doesn't necessarily mean customers would expect that information to be used to develop an unrelated product.

There may also be contractual restrictions to consider.

For instance, a SaaS business might have an agreement with a customer that limits how customer-uploaded information can be used. Even if the business has access to that information, its contract may restrict using it for independent product development.

This is particularly important for businesses handling customer datasets under confidentiality agreements or commercial service contracts.

There's also the Federal Trade Commission (FTC) to consider.

Under Section 5 of the FTC Act, businesses are prohibited from engaging in unfair or deceptive acts or practices.

In 2021, the FTC took action against Everalbum, a photo application developer, over allegations that it misled consumers about its facial recognition practices and retention of customer photographs.

The resulting settlement required the deletion of certain information and models developed using improperly handled data.

This demonstrates why businesses need to be careful about making promises concerning customer information and then using it in ways that contradict those promises.

Importantly, updating your privacy policy doesn't automatically authorize a new use of customer information.

You still need to ensure the proposed testing complies with applicable privacy laws and any relevant contractual obligations.

Can You Use Anonymous Or De-Identified Customer Data Instead?

What if your new product doesn't actually need to know who your customers are?

In some cases, using de-identified or synthetic information may be a more appropriate option.

You might be able to test a feature using aggregated customer activity, simulated transactions or records that no longer identify particular individuals.

However, simply removing names and email addresses doesn't necessarily make information anonymous.

Purchase histories, location information and combinations of other details may still allow people to be identified.

Under the CCPA, information must meet specific requirements to qualify as de-identified data, including reasonable measures to prevent re-identification and other applicable safeguards.

Other state laws may impose their own requirements.

Businesses should also remember that converting identifiable customer information into de-identified data can itself involve regulated processing.

Before using your existing customer database, it's worth asking whether you genuinely need identifiable records to achieve your testing objectives.

Using less personal information can help reduce privacy risks without preventing your business from developing new products.

What If You're Using A Third-Party Testing Platform Or AI Tool?

Developing a new product often involves external software providers.

You might use an analytics platform to understand customer behavior, a testing environment to experiment with new features or an AI tool to evaluate how your product performs.

But what happens to your customer information once it's uploaded to these systems?

Some providers process information solely to deliver a service to your business. Others may retain the information, share it with additional providers or use it to develop their own products.

That distinction can have legal consequences.

For businesses covered by the CCPA, sharing personal information with service providers or contractors may require specific contractual protections governing how that information can be used, retained and disclosed.

Other state privacy laws also impose obligations concerning agreements with data processors.

For instance, an AI provider might seek to use uploaded customer information to train its own models. This could involve a different purpose from simply processing the information to test your product.

Before using an external platform, review whether your agreement addresses confidentiality, security, permitted uses of information, subcontractors and data retention.

It's also important to consider what happens to customer information after testing is complete.

Depending on the applicable law, your business may need to limit how long personal information is retained, securely delete information that is no longer required and ensure external providers follow agreed deletion or return procedures.

Businesses should also consider how they'll respond to customer requests to access, correct or delete their information, or opt out of certain processing, where those rights apply.

Having appropriate contractual protections can help manage these responsibilities, but an agreement with a service provider doesn't automatically make an otherwise unlawful use or disclosure permissible.

Do You Need A Privacy Risk Assessment?

Not every product test requires a formal privacy risk assessment.

However, some state privacy laws require businesses to assess processing activities that present significant risks to individuals.

California's updated CCPA regulations, which took effect on January 1, 2026, include risk assessment requirements for certain processing activities.

These may be relevant to particular uses of sensitive personal information, automated decision-making or other activities covered by the regulations.

Other states have their own assessment requirements, which may apply to certain types of profiling, targeted advertising or sensitive data processing.

Whether an assessment is mandatory depends on the applicable law and what the business intends to do with the information.

Even where a formal assessment isn't required, reviewing the potential privacy risks before testing begins can help identify problems and establish appropriate safeguards.

What Should You Check Before Using Customer Data For Product Testing?

Before using existing customer information for a new project, it's worth making sure the proposed testing complies with your legal obligations.

A few important questions include:

• What laws apply? Consider which state or federal privacy requirements cover your business and the information involved.
• Why was the information originally collected? Review the original purpose, customer notices and relevant contractual obligations.
• Is the proposed use permitted? Determine whether it falls within an authorised purpose or requires additional consent.
• Can you minimise the information used? Consider whether de-identified, aggregated or synthetic data could achieve the same result.
• Who else will have access? Review external providers, data security, retention arrangements and applicable customer rights.

It's also worth distinguishing product testing from marketing.

If you intend to contact existing customers to promote your new product, separate requirements may apply, including federal commercial email rules and state privacy laws governing certain advertising practices.

Addressing these matters early can help your business develop new products without creating unnecessary privacy issues.

Need Help With Your Business's Data Privacy Obligations?

Existing customer information can be valuable when developing new products, but it's important to understand what your business can legally do with it.

Whether you're reviewing your privacy documentation, assessing how customer information can be reused or preparing agreements with external technology providers, getting the legal side right early can help avoid complications later.

Sprintlaw can help your business access support with privacy policies, data processing agreements and state privacy law compliance.

Get in touch with our team on (888) 449-8437 or email team@sprintlaw.com to discuss your requirements.