Does the CCPA apply to insurance companies in California?

Insurance is one of the most heavily regulated industries in California, and that leads a lot of insurance companies to assume the CCPA simply does not reach them. The regulations say otherwise, and they say it with concrete examples.

There is no insurance exemption in the statute

Start with what is not there. Cal. Civ. Code Section 1798.145 lists the CCPA's exemptions, and reading it does not turn up a provision for insurance companies. The only insurance-adjacent language in that section is incidental. The actual rule sits in the California Privacy Protection Agency's own regulations, at 11 CCR Article 12, Sections 7270 and 7271.

What an insurance company is, for this purpose

Section 7270(a) defines the term for the regulations: insurance company means any person that is subject to the California Insurance Code and its regulations, including insurance institutions, agents, and insurance-support organizations as those terms are defined in Insurance Code Section 791.02. That is a reference to an existing regulatory category, not a new one invented for privacy purposes.

The rule: data-level, not entity-level

Section 7271(a) states the operative rule directly: insurance companies that meet the definition of business under the CCPA shall comply with the CCPA with regard to any personal information not subject to the Insurance Code and its regulations. The example the regulation gives is personal information collected for purposes not in connection with an insurance transaction, as that term is defined in Insurance Code Section 791.02.

That sentence does the same thing California's other sector exemptions do: it draws the line around the data, not the company. An insurance company is not categorically outside the CCPA. It is outside the CCPA only for the slice of personal information that the Insurance Code already governs.

Three examples straight from the regulation

Section 7271(b) gives three illustrative examples, and they map cleanly onto the kind of data most insurance companies actually hold outside their core underwriting and claims systems.

The first: an insurance company collects personal information from website visitors who have not applied for any insurance product or other financial product or service, and uses it to tailor advertisements across different websites. That company must comply with the CCPA for this data, including the right to opt out of sale or sharing, because the data was never connected to an insurance transaction.

The second: an insurance company collects personal information from its employees and job applicants for employment purposes. That company must comply with the CCPA for employee information, including providing a notice at collection at or before the time it is collected, because employment data is not subject to the Insurance Code.

The third, running the other direction: a policyholder submits personal information to her insurance company as part of a claim for losses from a fire at her home, and the company uses it to service the policy. That information is subject to the Insurance Code and its regulations, and it is not subject to the CCPA.

What this means in practice

An insurance company's claims files, underwriting records, and policy administration data sit under the Insurance Code and stay outside the CCPA. Everything else the company collects, marketing-site traffic, advertising identifiers, prospect lists, employee and applicant records, sits under the CCPA on the same terms as any other covered business. Running a data inventory that actually separates the two is the real compliance task here, not locating a single exemption that removes the company from the CCPA wholesale, because that exemption does not exist.

The financial-services parallel is worth knowing too: the CCPA's GLBA exemption works the same way, drawing the line around data subject to the Gramm-Leach-Bliley Act rather than around the company holding it.

Next step

If your insurance business collects any personal information outside an active policy or claim, the free 2-minute Obligation Scan checks whether the CCPA reaches that data and flags the notices, opt-out rights, and request-handling duties it carries, so the gap does not surface for the first time in regulatory scrutiny.