Insurance Information and Privacy Protection Act

The law gives insurance consumers clearer notice, more control over non-insurance uses of their data, and rights to see, correct, and in some cases delete it. It also expands the Insurance Commissioner’s oversight and penalties for privacy violations.

What the law does ​

• Limits insurers, producers, reinsurers, surplus line insurers, and covered service providers to collecting, using, retaining, and sharing data that is reasonably necessary and proportionate for disclosed insurance-related purposes.
• Requires stand-alone privacy notices within 21 days after first collecting, processing, or sharing data, plus annual notices for ongoing customer relationships and updated notices when practices materially change.
• Requires opt-in consent for most marketing, research, and other non-insurance uses, while allowing consumers to opt out of specified cross-marketing, joint-marketing, affiliate-sharing, and related activities.
• Bars the sale of consumers’ personal information and prohibits manipulative interface designs that interfere with privacy choices.
• Gives consumers rights to access their data and its sources and recipients, and to request correction, amendment, or deletion, subject to claim, fraud, legal-retention, and other specified exceptions.
• Requires written retention schedules, periodic data-retention reviews beginning in 2032, secure destruction or deidentification of unneeded data, safeguards, breach reporting to the Insurance Commissioner, and privacy controls in vendor contracts.
• Requires written explanations and supporting information for adverse underwriting decisions, subject to specified exceptions.
• Authorizes enforcement by the Insurance Commissioner, including cease-and-desist orders and penalties of at least $5,000 per violation, capped at $1 million in aggregate for multiple violations.

Who it affects ​

• California insurance applicants, policyholders, insureds, claimants, beneficiaries, and other consumers whose information is used in personal, family, or household insurance.
• Insurers, insurance producers, reinsurers, surplus line insurers, insurance-support organizations, and service providers handling insurance data.
• Vendors and subcontractors that process insurance information on behalf of covered insurance businesses.

Context ​

The law replaces California’s prior insurance-privacy framework and leaves the Insurance Commissioner with primary responsibility for insurance privacy regulation.