CaliforniaCalifornia insurers must explain and limit use of consumer information
Starting July 1, 2028, insurers and their service providers must explain how they use personal information and give consumers ways to review and correct it.
What it does
Starting July 1, 2028, insurance businesses and their service providers must explain how they handle personal information and limit sharing to insurance needs or other permitted purposes.
Consumers may request copies of their insurance information, ask for errors to be fixed or information deleted, and get reasons for certain decisions about coverage.
Insurance businesses must set written rules for service providers that handle consumer information, including safeguards and limits on how providers may use it.
The Insurance Commissioner may impose fines for knowing privacy violations, with higher minimum fines for breaking an order to stop the conduct.
Argument forConsumers could spot or correct inaccurate insurance records and learn why an insurer made a decision that limits or denies coverage.
Argument againstConsumers may find the required notices hard to follow, and sharing outside insurance needs may continue when they do not opt out.
More detail
Insurance businesses and their service providers must limit how they handle consumers’ personal information and explain those practices. These rules cover insurers and other insurance licensees, surplus line insurers, reinsurers, and service providers handling California consumers’ information for personal, family, or household insurance. Some health care providers and other entities are excluded. Sharing for insurance transactions and certain legal purposes is allowed when reasonably necessary and proportionate. Other sharing generally requires prior consent or an opportunity to opt out, depending on its purpose; some sensitive information has added limits. The new standards become operative on July 1, 2028.
Consumers may ask to see, correct, amend, or delete their personal information, and may receive reasons and supporting information after certain insurance decisions. The rights apply to California consumers whose personal information is held by covered insurance businesses or their service providers. They also cover certain people whose information is held, with stated exclusions. Businesses generally must respond to access requests within 30 business days and correction or deletion requests within 30 business days. Some information tied to an active or anticipated claim, legal proceeding, or fraud investigation is excluded; a business may refuse a correction or deletion when legally barred or when it has good cause. Businesses generally have 30 business days to respond to access or correction and deletion requests. For certain coverage decisions, consumers must request supporting details within 90 business days after notice.
Covered insurance businesses must use written contracts to set limits and safeguards when service providers handle consumers’ information. This applies when an insurer, surplus line insurer, or reinsurer uses a service provider to handle personal information on its behalf. Contracts must describe the work and require safeguards, confidentiality, limits on further use, and prompt reporting of incidents. A temporary service requested for a consumer may use a provider without an ongoing relationship or written contract, with the consumer’s consent and only as needed for that service. The contract requirements apply to contracts executed, amended, or renewed after July 1, 2028.
The Insurance Commissioner may impose financial penalties for knowing violations and violations of cease-and-desist orders. Penalties may apply to covered insurance businesses and service providers. The misdemeanor applies to any person who knowingly and willfully obtains a consumer’s information from them under false pretenses. After a hearing, the commissioner may impose at least $5,000 per knowing violation, with no more than $1 million total for multiple violations. Violating a cease-and-desist order may bring a fine of at least $15,000 per violation, or at least $50,000 per violation if violations form a general business practice. Knowingly obtaining consumer information under false pretenses is a misdemeanor. These provisions are part of the article that becomes operative July 1, 2028.
Where do you stand?
Choose your position
Tell your reps
Take a position to see your representatives and ways to contact them.
Where it stands
- Introduced
- Passed Senate
- Passed Assembly
- To Governor
- Became Law
Looking ahead
No hearings or votes scheduled.
History
- 2026
- Sep 27Chaptered by Secretary of State. Chapter 481, Statutes of 2026.Latest
- Sep 27Approved by the Governor Gavin Newsom.Became Law
- Sep 4Enrolled and presented to the Governor at 2 p.m.To Governor
- Aug 28Assembly amendments concurred in. (Ayes 30. Noes 10. Page 6087.) Ordered to engrossing and enrolling.Major
- Vote recorded Unfinished Business SB354 Limón Concurrence. Result: pass.Upper
- Aug 28In Senate. Concurrence in Assembly amendments pending.
- Aug 27Read third time. Passed. (Ayes 59. Noes 16. Page 6729.) Ordered to the Senate.Passed Assembly
- Vote recorded SB 354 Limón Senate Third Reading By Bauer-Kahan. Result: pass.Lower
- Aug 21Ordered to third reading.Minor
- Aug 21Read third time and amended.Major
- Aug 21Assembly Rule 69(b)(1) suspended. (Ayes 55. Noes 17. Page 6296.)
- Aug 17Read second time. Ordered to third reading.Minor
- Aug 13Read second time and amended. Ordered to second reading.Major
- Vote recorded Do pass as amended. Result: pass.Lower
- Aug 13From committee: Do pass as amended. (Ayes 11. Noes 4.) (August 13).Major
- Aug 13Assembly Rule 63 suspended.
- Aug 5August 5 set for first hearing. Placed on suspense file.
- Jul 2From committee: Do pass and re-refer to Com. on APPR. (Ayes 11. Noes 4.) (July 1). Re-referred to Com. on APPR.Minor
- Jul 1
- Vote recorded Do pass and be re-referred to the Committee on [Appropriations]. Result: pass.Lower
- Jun 26From committee with author's amendments. Read second time and amended. Re-referred to Com. on P. & C.P.Major
- Jun 17From committee: Do pass and re-refer to Com. on P. & C.P. (Ayes 11. Noes 3.) (June 17). Re-referred to Com. on P. & C.P.Minor
- Vote recorded Do pass and be re-referred to the Committee on [Privacy and Consumer Protection]. Result: pass.Lower
- Jun 11From committee with author's amendments. Read second time and amended. Re-referred to Com. on INS.Major
- May 27From committee with author's amendments. Read second time and amended. Re-referred to Com. on INS.Major
- Apr 15From committee with author's amendments. Read second time and amended. Re-referred to Com. on INS.Major
- 2025
- Jun 16Referred to Coms. on INS. and P. & C.P.Minor
- Jun 5In Assembly. Read first time. Held at Desk.Minor
- Jun 4Read third time. Passed. (Ayes 28. Noes 10. Page 1502.) Ordered to the Assembly.Passed Senate
- Vote recorded 3rd Reading. Result: pass.Upper
- May 27Read second time. Ordered to third reading.Minor
- May 23Read second time and amended. Ordered to second reading.Major
- Vote recorded Do pass as amended. Result: pass.Upper
- May 23From committee: Do pass as amended. (Ayes 5. Noes 1. Page 1197.) (May 23).Major
- May 16Set for hearing May 23.
- May 12May 12 hearing: Placed on APPR. suspense file.
- Vote recorded Placed on suspense file. Result: pass.Upper
- May 6Set for hearing May 12.
- May 1Read second time and amended. Re-referred to Com. on APPR.Major
- Apr 30From committee: Do pass as amended and re-refer to Com. on APPR. (Ayes 11. Noes 2. Page 939.) (April 29).Major
- Apr 29
- Vote recorded Do pass as amended, but first amend, and re-refer to the Committee on [Appropriations]. Result: pass.Upper
- Apr 9Set for hearing April 29.
- Vote recorded Do pass, but first be re-referred to the Committee on [Judiciary]. Result: pass.Upper
- Apr 9From committee: Do pass and re-refer to Com. on JUD. (Ayes 5. Noes 2. Page 738.) (April 9). Re-referred to Com. on JUD.Minor
- Apr 3From committee with author's amendments. Read second time and amended. Re-referred to Com. on INS.Major
- Mar 28Set for hearing April 9.
- Mar 26Re-referred to Coms. on INS. and JUD.Minor
- Mar 18From committee with author's amendments. Read second time and amended. Re-referred to Com. on RLS.Major
- Feb 19Referred to Com. on RLS.Minor
- Feb 13From printer. May be acted upon on or after March 15.
- Feb 12Introduced. Read first time. To Com. on RLS. for assignment. To print.Introduced
Consumer ProtectionTechnologyGovernment & Ethics