CCPA GLBA exemption: does the CCPA apply to financial institutions?

Financial-services teams often read one line about a GLBA carve-out and conclude the CCPA does not apply to them. That conclusion is usually wrong, and the way it is wrong is expensive. California wrote its exemption around data, not around companies, and it deliberately left the breach lawsuit provision outside the carve-out.

What Section 1798.145(e) actually says

The subdivision is two sentences long. Quoted in full:

(e) This title shall not apply to personal information collected, processed, sold, or disclosed subject to the federal Gramm-Leach-Bliley Act (Public Law 106-102), and implementing regulations, or the California Financial Information Privacy Act (Division 1.4 (commencing with Section 4050) of the Financial Code), or the federal Farm Credit Act of 1971 (as amended in 12 U.S.C. 2001-2279cc and implementing regulations, 12 C.F.R. 600, et seq.). This subdivision shall not apply to Section 1798.150.

Read the subject of that first sentence. It is "personal information", not "a financial institution". Nothing in Section 1798.145(e) exempts an entity. The moment a data set falls outside GLBA's reach, the CCPA applies to it in full.

The preposition that narrows it further

There is a drafting detail here that most summaries skip, and it cuts against the reader.

Subdivision (e) exempts personal information "collected, processed, sold, or disclosed subject to" the named statutes. Compare subdivision (f), the Driver's Privacy Protection Act exemption, which exempts information collected, processed, sold or disclosed "pursuant to" that Act.

"Pursuant to" points at data handled under the authority of a statute. "Subject to" points at data that falls within a statute's regulatory reach. The two are close, but "subject to" ties the exemption to whether GLBA actually governs the particular data in your hands, which is a question about that data set rather than about your licence or your industry. It is one more reason the analysis has to run data set by data set.

The entity-level comparison that makes this obvious

Other states wrote the same idea differently, and the contrast is the clearest way to see what California did. Nebraska exempts, at Neb. Rev. Stat. Section 87-1103(2)(b), any "financial institution, affiliate of a financial institution, or data subject to Title V of the Gramm-Leach-Bliley Act". Indiana does the same at IC 24-15-1-1(b)(2), and Iowa at Iowa Code Section 715D.2(2). Those statutes name the institution first and the data second, so a covered bank is out of scope in those states entirely.

California names only the data. A bank operating in both California and Iowa can be wholly outside the Iowa act and squarely inside the CCPA for the same corporate entity.

Which of your data is not GLBA data

In practice the gap is larger than teams expect. GLBA reaches nonpublic personal information about consumers obtained in connection with providing a financial product or service. It does not obviously reach:

• Visitors to your marketing site who never applied for anything, including advertising and analytics identifiers.
• Prospects and leads bought from a list who never became customers.
• Job applicants and contractors, which California brought fully into the CCPA.
• Business contacts at commercial counterparties, to the extent they act in an individual capacity.

Each of those categories carries the full set of CCPA rights: know, delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information.

The breach lawsuit is expressly not exempt

The final sentence of Section 1798.145(e) is the one that matters most for risk. By excluding Section 1798.150 from the exemption, California kept GLBA-regulated data inside the private right of action. If unencrypted and unredacted personal information is exfiltrated because reasonable security was missing, a consumer can sue, and the statutory damages range is set by the California Privacy Protection Agency's inflation adjustment at $107 to $799 per consumer per incident, or actual damages if higher. For a breach touching a large customer file, that arithmetic gets serious quickly, and the GLBA exemption does not touch it.

Where this leaves you

Treat the GLBA exemption as a filter you apply data set by data set, not a status you claim once. Start by confirming the CCPA applies to your business at all under California's thresholds, then map the boundary, then run the remaining data through the ordinary CCPA exemption analysis.

Section 1798.145(e) in the statute's own words

The whole exemption is one subdivision, and reading it in full is the fastest way to see how narrow it is:

"(e) This title shall not apply to personal information collected, processed, sold, or disclosed subject to the federal Gramm-Leach-Bliley Act (Public Law 106-102), and implementing regulations, or the California Financial Information Privacy Act (Division 1.4 (commencing with Section 4050) of the Financial Code), or the federal Farm Credit Act of 1971 (as amended in 12 U.S.C. 2001-2279cc and implementing regulations, 12 C.F.R. 600, et seq.). This subdivision shall not apply to Section 1798.150."

Four observations follow directly from the text. The subject of the sentence is "personal information", not a business, an institution or a licensee, which is what makes the exemption data-level. The operative phrase is "subject to", so the test is whether the specific information is regulated by one of the three named regimes, not whether the holder is generally supervised under them. Three regimes are named, and the California Financial Information Privacy Act and the Farm Credit Act are easy to overlook next to GLBA. And the final sentence carves the private right of action back out.

The provenance line printed at the end of the section on the official California legislative site confirms which version this is:

"(Amended by Stats. 2023, Ch. 567, Sec. 2. (AB 1194) Effective January 1, 2024. Subdivisions (m) and (n) inoperative January 1, 2023, by their own provisions.)"

Two points worth taking from that line. The current text of Section 1798.145 dates from AB 1194 and has been operative since 1 January 2024. And the same line records that the business-to-business and employee exemptions at subdivisions (n) and (m) lapsed on 1 January 2023, which is a useful contrast: those were temporary provisions with expiry dates written into them, while subdivision (e) carries no sunset at all.

Next step

If you hold a mix of GLBA-regulated and ordinary personal information, the free 2-minute Obligation Scan works out whether the CCPA reaches your business and which data sets the exemption does not cover, so the gap does not surface for the first time in a breach claim. The US state privacy laws hub shows how California's data-level approach compares with the entity-level exemptions elsewhere.