No state agency shall disclose personal information concerning a user to any person, firm, partnership, corporation, limited liability company or other entity, including internal staff who do not need the information in the performance of their official duties, unless such user has consented to the disclosure of such personal information. For the purposes of this section, the voluntary disclosure of personal information to a state agency by a user through a state agency website, whether solicited or unsolicited, shall constitute consent to the disclosure of the information by the state agency for the specific purposes for which the user disclosed it to the state agency.