New landmark bill seeks to enhance consumer privacy protections with greater transparency & accountability in California insurance market

News: 2025 Press Release

SACRAMENTO, Calif. — Senator Monique Limón today unveiled Senate Bill (SB) 354, the Insurance Consumer Privacy Protection Act (ICPPA) of 2025, which aims to increase transparency and accountability in California’s insurance market by bolstering consumer privacy protections and establishing a modern privacy rights framework for insurance licensees and their third-party service providers. With insurance companies collecting more personal information than ever before, the bill aims to give consumers greater control over their personal data. Authored by Senator Limón and sponsored by Insurance Commissioner Ricardo Lara, SB 354 provides reasonable privacy protections that address the demands of an information-intensive insurance business climate.

"Privacy is about safeguarding every individual. The last time insurance privacy laws were updated, social media was just beginning to emerge, and most people did not own a cell phone," stated Insurance Commissioner Ricardo Lara. "SB 354 gives consumers the power to decide how their personal information is used and shared. This bill will enhance regulations governing the amount of data insurance licensees can collect, the purposes for which it can be used, who it can be shared with, and the duration for which it can be retained," Commissioner Lara emphasized.

“SB 354 strengthens consumer protections by establishing data privacy standards that preserve sensitive personal information such as social security numbers, IP addresses, passport information and more,” said Senator Monique Limón, author of SB 354. “At a time when data is freely being collected, oftentimes without consumer knowledge, it has never been more important that we put the power back into consumers hands by providing them with the ability to take control of the personal information that is collected.”

SB 354 exceeds protections under California’s nation-leading consumer privacy laws, including the Consumer Privacy Rights Act, including but not limited to expanded scope of protection, insurers’ use of third-party service providers, enhanced notices & disclosures, data sharing and minimization/retention policies, data breach reporting and information security, and enforcement tools.

Consumers’ personal information covered by SB 354 include identifiers like real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, social security number, driver’s license number, passport number, etc.; Biometric information; Internet or other electronic network activity information; Geolocation data; no publicly available education information; Inferences drawn from consumer preferences, characteristics, character, habits, etc; or other sensitive personal information.

SB 354 would apply to more than 400,000 California insurance licensees (e.g. insurers, producers, etc.) and their third-party service providers that process consumers’ personal information in connection with insurance transactions; engage in insurance transactions with consumers; or engage in activities not related to insurance transactions involving consumers’ personal information – any personal information processed in the business of insurance, but which isn't directly related to an insurance transaction requested by the consumer.

Additionally, SB 354 would enhance protections in existing insurance privacy laws by providing consumers with access to how their personal information was used in the event a consumer’s policy or coverage is cancelled, non-renewed, or rescinded as part of an adverse underwriting decision. Under SB 354, a licensee would be required to provide the consumer with the reasons that led to that decision.  

Other key provisions in SB 354 include the consumer’s:

• Right to CONSENT by OPTING-IN to the sharing of consumers’ personal information by licensees for purposes unrelated to insurance transactions;
• Right to AMEND, CORRECT, or DELETE inaccurate personal information that licensees have about consumers (with some exceptions);
• Right to KNOW or ACCESS the categories of personal information that are processed; the categories of sources from which consumers’ personal information is collected, and to identify recipients when such information is shared; the reasons for adverse underwriting decisions; and
• RIGHT to EXERCISE their consumer privacy rights free from retaliation to ensure that consumers have reasonable access to their privacy rights

The California Insurance Commissioner would have enforcement authority under SB 354, imposing escalating penalties against licensees and third-party providers found in violation of the Act.

 What Supporters Are Saying

A coalition of consumer advocates express widespread support for what would be the nation’s most robust insurance consumer privacy protection measure to date:

“The California Privacy Rights Act of 2020 (which expanded the California Consumer Privacy Act) were intended as a baseline for the fundamental consumer privacy rights Californians should expect,” underscored Tracy Rosenbeg, Advocacy Director for Oakland Privacy. “As data collection practices become more sophisticated and risk-based industries like the insurance industry seek to manage their costs, it has become clear that more protections are necessary for sectors that manage large quantities of very sensitive information. As Senator Limón and Insurance Commissioner Lara have recognized, the insurance sector is ripe for enhanced privacy protections. The ICPPA will strengthen and modernize insurance industry practices and ensure Californians have clear opt-in consent, protection against data sales and breaches, and the ability to change and dispute incorrect information about themselves when they insure themselves, their homes and their properties.”

# # #

Media Notes:

• Text of Senate Bill 354 (Limón)
• SB 354 FAQs
• SB 354 Key Consumer Provisions