Insurance Consumer Privacy Protection Act of 2025.

Senator Limón's Insurance Consumer Privacy Protection Act establishes comprehensive standards governing how insurance companies and their vendors collect and handle Californians' personal information, addressing gaps in the state's decades-old insurance privacy laws.

The legislation requires insurance licensees to obtain explicit consumer consent before using personal data for purposes beyond basic insurance transactions. Companies must provide clear privacy notices explaining what information they collect, how they use it, and who they share it with. Consumers gain new rights to access, correct, and delete their personal information, along with protections against retaliation for exercising these rights.

The bill mandates data minimization practices, requiring insurers to collect and retain only information necessary for insurance purposes. Companies must develop written data retention policies and promptly destroy unnecessary personal information. Third-party vendors processing consumer data must meet strict contractual requirements around confidentiality, security measures, and limited data use.

The Insurance Commissioner gains expanded oversight authority, including the power to investigate violations, conduct hearings, and issue cease-and-desist orders. Knowing violations can trigger penalties ranging from $5,000 to $1 million. The bill also creates a private right of action allowing consumers to seek damages for privacy violations, while establishing criminal penalties for obtaining consumer information under false pretenses.

Insurance licensees have five years to implement the data retention requirements, though most provisions take effect immediately. The legislation builds upon California's existing privacy framework while establishing insurance-specific protections suited to the industry's data-intensive nature and complex vendor relationships.