Insurance Consumer Privacy Protection Act of 2025.

Senator Limón's Insurance Consumer Privacy Protection Act establishes comprehensive standards for how insurance companies and their vendors handle California consumers' personal information. The legislation requires insurers to obtain explicit consent before using customer data for purposes beyond basic insurance transactions, implement data minimization practices, and provide clear privacy notices detailing how information is collected and shared.

The bill grants consumers new rights to access, correct, and delete their personal information held by insurers. Insurance companies must respond to these requests within 30 business days and provide detailed explanations when denying coverage or making other adverse decisions. The legislation prohibits retaliation against consumers who exercise their privacy rights and bars the sale of customer data for any purpose.

Insurance licensees must develop written policies for data retention and deletion, with requirements to destroy unnecessary personal information within 90 days. Third-party service providers working with insurers face strict contractual obligations regarding data security, breach notification, and limitations on information use. The Insurance Commissioner gains authority to investigate violations, conduct hearings, and impose penalties ranging from $5,000 to $1 million per incident.

The measure aligns insurance industry practices with modern privacy standards while maintaining exemptions for fraud investigation, claims processing, and other essential business functions. Companies have five years to implement the new data retention requirements, though other provisions take effect immediately upon enactment.