Does the CCPA Apply to Insurance Companies? Where California's AI Rules Stop

California’s privacy regulator has rules on automated decisionmaking technology, or ADMT, and an insurer with California business needs to know which AI systems in its AI governance program they reach. The rules sit in the California Consumer Privacy Act (CCPA) regulations of the California Privacy Protection Agency (CPPA), which since January 1, 2026 have included an article on insurers, Article 12.¹ Its key sentence says an insurance company meeting the CCPA’s definition of a business² must comply with the CCPA for personal information “not subject to the Insurance Code and its regulations.”³ That line sits alongside the statute’s exemptions for data covered by the federal Gramm-Leach-Bliley Act (GLBA) or HIPAA.⁴

The ADMT rules reach an insurer’s AI system only if it meets two tests. The data test asks whether its personal information is not subject to the Insurance Code; Article 12’s example is information collected for purposes unconnected with an “insurance transaction.”³ The decision test asks whether the system uses ADMT to make a “significant decision” about a consumer.⁵ On our reading, core insurance models, those for underwriting, pricing, and claims, fail the decision test. They also fail the data test for data gathered in an insurance transaction. HR systems that screen applicants or set pay can meet both.

Who counts, and the two tests

Article 12 first settles whether a company counts as an “insurance company.” It defines one as any person subject to the California Insurance Code and its regulations, including insurers, agents, and insurance-support organizations.⁶ The CPPA declined to narrow that to the entities named in the Insurance Code’s privacy statute, the Insurance Information and Privacy Protection Act (IIPPA).⁷ We read “any person” as taking in MGAs, which Article 12 does not name.

For the data test, section 791.02, the IIPPA’s definitions section, currently sets two conditions for an “insurance transaction.”⁸ It involves insurance “primarily for personal, family, or household needs rather than business or professional needs.” And it entails deciding an individual’s eligibility for coverage, a benefit, or a payment, or servicing an application, policy, contract, or certificate.⁸

For the decision test, ADMT is technology that processes personal information and uses computation to replace human decisionmaking or substantially replace it. Substantial replacement means deciding on the output without human involvement, which requires a reviewer who knows how to interpret and use the output, reviews it with other relevant information, and has authority to make or change the decision; each element is required.⁹

How far core insurance models stay outside

Article 12 decides the claim case with an example: information Sloane submits for fire losses at her home is used to service her policy, so it is subject to the Insurance Code and “is not subject to the CCPA.”¹⁰ The CPPA’s comment responses, outside the rule text, tie that result to the insurance-transaction definition and say the regulations apply only to personal information collected or processed for purposes outside such a transaction.¹¹ We extend the claim result to personal-lines underwriting and pricing data, gathered while an application is decided or a policy is serviced. Reuse of that data is less clear. The current definition does not say whether pooling policy and claims records to develop a pricing model or test an underwriting algorithm is part of an insurance transaction.⁸

On data outside the Insurance Code, a model is covered only if its decision is significant, meaning it results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. Insurance is not on the list.¹² The CPPA’s proposal of November 22, 2024, which never took effect, did cover decisions about “access to, or the provision or denial of” insurance.¹³ That proposal, however, kept data covered by the CCPA’s exemptions, such as GLBA or HIPAA data, out of every listed decision, so its insurance item would have reached only insurance decisions made on other personal information. Dropping insurance removed those decisions from the ADMT rules; decisions on GLBA or HIPAA data were outside under both texts.

The agency’s Final Statement of Reasons says it removed “insurance” and three other terms “to simplify implementation for businesses at this time,” and that it “may revisit this definition in future rulemaking packages.”¹⁴ It gives no reason specific to insurance, such as the Insurance Code already governing it, so the decision test’s answer for core models depends on a definition the agency may revisit.

Even if insurance returned to the list, pricing would meet a limit in the statute. The CCPA gave the Insurance Commissioner “jurisdiction over insurance rates and pricing” and told the agency to review the Insurance Code’s privacy provisions “except those relating to insurance rates or pricing.”¹⁵ On our reading, a pricing-model owner would still answer to the Commissioner for the model’s rates.

A core model can still owe a risk assessment, which Article 10 of the same regulations requires before processing that poses a significant privacy risk.¹⁶ Insurance Code data is outside that duty. Article 10’s ADMT trigger needs a significant decision, but its triggers for selling or sharing personal information and for processing sensitive data need none. On our reading, a model that also uses personal information from outside an insurance transaction can therefore need an assessment.

What can fall inside: HR systems and premium installments

Article 12’s employee example covers the insurer’s own workforce: information collected from employees and job applicants for employment purposes is not subject to the Insurance Code, so the CCPA applies, beginning with a Notice at Collection.¹⁷

If a recruiter who understands a tool’s ranking of job applicants weighs it with the rest of the application and can overrule it, the tool does not make the decision; if its ranking decides who goes forward with no such review, it is ADMT. The regulations count these employment decisions as significant: hiring, allocation of work, compensation, promotion, and demotion, suspension, or termination.¹⁸ The employee example names only the Notice at Collection; the ADMT duties follow from reading it with that list.

Those duties apply from January 1, 2027 to systems already making significant decisions, and from first use to later ones.¹⁹ The insurer gives what the regulations call a Pre-use Notice: the specific purpose, the opt-out and access rights, how the ADMT works, and what happens on opt-out; it may sit inside the Notice at Collection.²⁰ On request, the insurer explains the purpose, the ADMT’s logic, and how the output was used.²¹

Applicants and employees may opt out unless an exception applies.²² The appeal exception applies where the insurer offers an appeal to a human reviewer who knows how to interpret and use the output and has authority to overturn the decision. The hiring exception needs ADMT used solely to assess the applicant’s ability to perform at work, and the work-and-pay exception needs ADMT used solely to allocate work or set pay; both also require that the ADMT work for its purpose without unlawful discrimination.

An HR system can need a risk assessment even without a significant decision, because automated inferences about an applicant’s or employee’s performance, health, behavior, or similar traits drawn from systematic observation are their own trigger.¹⁶ Processing that began before the regulations took effect and continues must be assessed by December 31, 2027.²³ Information on assessments conducted in 2026 and 2027 goes to the CPPA by April 1, 2028.²³

Outside HR, the “financial or lending services” category names “installment payment plans.”²⁴ The rulemaking record does not address whether an insurer’s ADMT decision on who may pay a premium in installments, or who qualifies for premium financing, is such a service.

Marketing and website data

Article 12’s website example has an insurer using data from visitors “who have not applied for any insurance product or other financial product or service” to tailor ads on other sites; it must comply with the CCPA, including opt-out of sale or sharing and opt-out preference signals.²⁵ The example reaches only non-applicants; the record does not settle marketing on applicants’ or policyholders’ data under current law. Selling or sharing the visitors’ CCPA data also triggers an Article 10 risk assessment.¹⁶ The use carries no ADMT duties, because a significant decision “does not include advertising to a consumer.”²⁶

Commercial lines, telematics, and health data

Data from a commercial policy does not come from an insurance transaction, which the IIPPA currently limits to personal, family, or household insurance.⁸ The CCPA’s partial exemption for business-to-business data stopped operating on January 1, 2023.²⁷ Whether other Insurance Code provisions or Department of Insurance regulations reach individuals’ data on commercial policies is untested; no CPPA rulemaking document addresses commercial insurance as such.²⁸ On our reading, such data sits under the CCPA unless another exemption applies. The Notice at Collection and some risk-assessment triggers need no significant decision and can apply; ADMT duties need one, and insurance is not. Whether telematics and wearable data are subject to the CCPA is open and fact-specific.²⁹

The CCPA does not apply to medical information governed by California’s Confidentiality of Medical Information Act, or to protected health information (PHI) a HIPAA covered entity or business associate collects.³⁰ A health insurer that is a covered entity therefore owes no CCPA duty for decisions on its PHI or such medical information. Its other data falls outside that exemption, and a broader exemption for the entity itself applies only to the extent it maintains patient information in the same manner as PHI.³⁰

Where the line moves in July 2028

California’s SB 354, approved September 27, 2026 as Chapter 481, replaces the current IIPPA with a rewritten act operative from July 1, 2028.³¹ From that date, the rewritten act counts actuarial studies related to pricing model development, underwriting algorithm testing, and customer lifetime value modeling as part of an insurance transaction, among other activities. The new definition expressly leaves out processing or sharing related to marketing or research.³² The rewritten act keeps the personal, family, or household limit,³³ so commercial-lines data stays outside it after 2028.

Article 12 does not say which version of section 791.02 it cites.³⁴ Nor does the rewritten act say how its preemption clause, which preempts state consumer-privacy laws “that are inconsistent with this article,” bears on Article 12.³⁵ The act also asks the Insurance Commissioner to avoid conflicts with CPPA regulations “to the extent reasonably possible,” but only for regulations on the same subject matter adopted under substantially similar authorizing statutes.

An insurer can record both test results: whether a system’s data is subject to the Insurance Code, and whether the system uses ADMT to make a significant decision without qualifying human review. For an HR system inside the rules, notice, opt-out, and access duties start January 1, 2027,¹⁹ with risk-assessment deadlines on December 31, 2027 and April 1, 2028.²³ The data-test result needs revisiting before July 1, 2028.³¹ On our reading, if Article 12 is read against the rewritten definition, actuarial studies related to pricing-model development and underwriting-algorithm testing would sit with the Insurance Code and marketing with the CCPA.

Footnotes

1. California Privacy Protection Agency (CPPA), rulemaking page for the CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations: adopted by the Board July 24, 2025; approved by the Office of Administrative Law September 22, 2025; effective January 1, 2026. Article 12 is Cal. Code Regs., tit. 11, §§7270 and 7271. https://cppa.ca.gov/regulations/ccpa_updates.html ↩

2. Civ. Code §1798.140(d)(1): a for-profit entity doing business in California that had annual gross revenues above $25,000,000 in the preceding calendar year (as adjusted under §1798.199.95), or alone or in combination buys, sells, or shares the personal information of 100,000 or more consumers or households, or derives 50 percent or more of annual revenue from selling or sharing it. CPPA statute compilation (AB 3286 update, effective July 15, 2024), pp. 19 to 20. https://cppa.ca.gov/regulations/pdf/cppa_act.pdf The CPPA’s adjusted revenue threshold is $26,625,000, in effect from January 1, 2025: CPPA announcement of December 17, 2024. https://cppa.ca.gov/announcements/2024/20241217.html ↩

3. CPPA, approved regulation text, §7271(a), p. 124. https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf ↩ ↩²

4. Civ. Code §1798.145(c)(1)(A) (medical information governed by the Confidentiality of Medical Information Act, and HIPAA protected health information) and §1798.145(e) (personal information subject to the Gramm-Leach-Bliley Act or the California Financial Information Privacy Act; this exemption does not apply to the data-breach private right of action in §1798.150). Statute compilation, pp. 33 to 34. Answering comment 25, the CPPA separately pointed to the §1798.145(e) exemption: Final Statement of Reasons, Appendix B (responses to 15-day comments), pp. 134 to 135. https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_fsor_appen_b.pdf ↩

5. CPPA, approved regulation text, §7200(a), p. 112. Both elements are required: ADMT as defined, and a significant decision. ↩

6. CPPA, approved regulation text, §7270(a), p. 124. The named entities are “insurance institutions, agents, and insurance-support organizations, as those terms are defined in Insurance Code, section 791.02.” ↩

7. CPPA, Final Statement of Reasons, Appendix A (responses to 45-day comments), comment 703, p. 303. https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_fsor_appen_a.pdf ↩

8. Ins. Code §791.02(m), as in force until the rewritten article becomes operative. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=INS&sectionNum=791.02 ↩ ↩² ↩³ ↩⁴

9. CPPA, approved regulation text, §7001(e) and (e)(1)(A) to (C), pp. 1 to 2. Under §7001(e)(2), ADMT also includes profiling that replaces or substantially replaces human decisionmaking. Whether a particular reviewer meets the three elements depends on the facts of the workflow. ↩

10. CPPA, approved regulation text, §7271(b)(3), p. 125. The Final Statement of Reasons, p. 53, calls the regulation’s three examples fact-specific examples of compliance, not requirements for every circumstance. https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_fsor_and_uid.pdf ↩

11. CPPA, Final Statement of Reasons, Appendix B, comment 49, pp. 135 to 136; Appendix A, comment 375, p. 301. ↩

12. CPPA, approved regulation text, §7001(ddd), pp. 10 to 11. ↩

13. CPPA, text of proposed regulations dated November 22, 2024, §7200(a)(1), p. 120 (same wording in §7150(b)(3)(A), pp. 103 to 104). The proposed list also included criminal justice and essential goods or services, and it excluded information subject to the exceptions in Civ. Code §1798.145(c) to (g) or §1798.146(a)(1), (4), and (5). https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_ins_text.pdf ↩

14. CPPA, Final Statement of Reasons, p. 13. The other terms removed were “access to,” “criminal justice,” and “essential goods and services.” Answering comments 327 to 329, which worried that insurers would escape risk assessments, the agency gave the same reason, again “at this time”: Appendix A, p. 125. ↩

15. Civ. Code §1798.185(a)(20), statute compilation, p. 54. The same paragraph directs the agency to apply only the CCPA’s more protective provisions to insurance companies. ↩

16. CPPA, approved regulation text, §7150(b)(1) to (4), pp. 100 to 101; “systematic observation,” §7001(eee), p. 11. Processing of employees’ sensitive personal information solely for payroll, work authorization, benefits, legally required accommodation, or wage reporting is carved out of the sensitive-data trigger, §7150(b)(2)(A). ↩ ↩² ↩³

17. CPPA, approved regulation text, §7271(b)(2), pp. 124 to 125. ↩

18. CPPA, approved regulation text, §7001(ddd)(4), p. 11. Compensation covers salary, hourly or per-assignment pay, incentive compensation such as a bonus, and other benefits. Final Statement of Reasons, pp. 13 to 14: allocation or assignment of work applies only to employees. ↩

19. CPPA, approved regulation text, §7200(b), p. 112; Final Statement of Reasons, p. 44. ↩ ↩²

20. CPPA, approved regulation text, §7220(a) to (d), pp. 112 to 115. ↩

21. CPPA, approved regulation text, §7222(a) to (c), (e), and (j), pp. 119 to 122. ↩

22. CPPA, approved regulation text, §7221(a) and (b)(1) to (3), pp. 115 to 117; no verification, §7221(f); fraud denial, §7221(g); 15 business days, §7221(n), pp. 117 to 118. ↩

23. CPPA, approved regulation text, §7155(a) and (b), pp. 107 to 108; §7157(a)(1), pp. 109 to 110. ↩ ↩² ↩³

24. CPPA, approved regulation text, §7001(ddd)(1), p. 10. The definition also covers the extension of credit or a loan, transmitting or exchanging funds, deposit or checking accounts, and check cashing. ↩

25. CPPA, approved regulation text, §7271(b)(1), p. 124. ↩

26. CPPA, approved regulation text, §7001(ddd)(6), p. 11. The 2024 proposal’s separate trigger for profiling consumers for behavioral advertising was deleted from the final text: proposed text of November 22, 2024, §7200(a)(2)(C), p. 121; Final Statement of Reasons, pp. 11 and 30. ↩

27. Civ. Code §1798.145(n)(3), statute compilation, p. 39. The partial exemption for employee and applicant data, §1798.145(m)(4), p. 38, stopped operating on the same date. ↩

28. The approved and proposed texts, the Initial and Final Statements of Reasons, and Appendices A and B do not discuss commercial or business-lines insurance. The nearest passage is the CPPA’s answer that a requested workers’ compensation example was not necessary at this time: Final Statement of Reasons, Appendix A, comment 705, pp. 303 to 304. ↩

29. CPPA, Final Statement of Reasons, Appendix A, comment 698, p. 304, calling the question “a fact-specific analysis” and declining to add an example for telematics and wearable data. ↩

30. Civ. Code §1798.145(c)(1)(A) and (B), statute compilation, p. 33. “Healthcare services,” a significant-decision category, is defined by services related to “the diagnosis, prevention, or treatment of human disease or impairment, or the assessment or care of an individual’s health” (approved regulation text, §7001(ddd)(5), p. 11); no rulemaking document says whether a health plan’s coverage decision on other data is such a decision. ↩ ↩²

31. SB 354 (Limón), Chapter 481, Statutes of 2026, approved by the Governor and filed with the Secretary of State September 27, 2026. It repeals and re-adds the IIPPA: new Ins. Code §791.41 (operative July 1, 2028) and added §791.30 (current article inoperative July 1, 2028, repealed January 1, 2029). New §791.01(k) gives the Insurance Commissioner until January 1, 2029 to adopt regulations for producers. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB354 ↩ ↩²

32. SB 354, new Ins. Code §791.02(z)(1)(A) to (L) and (z)(2). The listed activities also include analytic services. Subparagraph (K) covers short-term, transient collection through a licensee’s website or app only where the data is processed for analytics on its functionality. Subparagraph (L) covers disclosures for actuarial studies, benchmarking, loss modeling, market research, or other industry research only when four conditions on aggregation, deidentification, and non-retention are met. ↩

33. SB 354, new Ins. Code §791.01(g), which also bars using business or professional lines information in personal lines, except for permitted cross-marketing. ↩

34. CPPA, approved regulation text, §7271(a), p. 124. During the rulemaking, before SB 354 was enacted, the CPPA declined to defer Article 12 until SB 354 was resolved and rejected language deferring to successor legislation as not meeting the clarity standards of California’s Administrative Procedure Act: Final Statement of Reasons, Appendix B, comments 26, 50, 51, and 199, p. 136; Appendix A, comment 706, p. 304. As of October 20, 2026, neither the CPPA nor the Department of Insurance had addressed which version of §791.02 Article 12 cites or how §791.39(a) bears on Article 12. ↩

35. SB 354, new Ins. Code §791.39(a) and §791.40(b). Section 791.39(c) also states that the Insurance Commissioner retains primary responsibility for regulating insurance privacy practices. ↩