Insurance Consumer Privacy Protection Act of 2025.

Senator Limón's Insurance Consumer Privacy Protection Act of 2025 establishes comprehensive privacy standards for insurance companies and their service providers handling California consumers' personal information. The legislation requires insurers to obtain explicit consumer consent before processing personal data for non-insurance purposes, maintain detailed records of data handling practices, and provide clear privacy notices explaining how information is collected and used.

The bill mandates that insurance licensees develop written data retention policies, regularly review stored personal information, and delete unnecessary data within 90 days. Companies must implement safeguards to protect sensitive information and promptly notify regulators of data breaches. Third-party service providers working with insurers face strict contractual requirements governing data processing and confidentiality.

Consumers gain expanded rights to access, correct, and delete their personal information held by insurers. The legislation prohibits companies from retaliating against individuals who exercise these privacy rights through adverse policy changes or increased premiums. When making adverse underwriting decisions, insurers must provide detailed explanations including specific reasons and information sources used.

The Insurance Commissioner receives broad authority to investigate violations, conduct hearings, and impose penalties ranging from $5,000 per violation up to $1 million in aggregate fines. Knowingly obtaining consumer information under false pretenses becomes a misdemeanor punishable by up to one year in jail and $50,000 in fines. While the act preempts conflicting state laws, it preserves existing federal and state health information privacy protections.