California's New Insurance Privacy Law Treats AI Systems as a Place Personal Information Lives

California’s rewritten insurance privacy statute lists artificial intelligence among the places personal information can sit. Senate Bill No. 354 (Limón) repeals and re-adds Article 6.6 of the Insurance Code, the Insurance Information and Privacy Protection Act. In the new article, Section 791.02(ah)(3) says personal information “can exist in various formats,” and its third category reads: “Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.” The Governor approved the bill on September 27, 2026, and it was filed with the Secretary of State the same day as Chapter 481. None of the new article is operative yet. Section 791.41 makes the new article operative on July 1, 2028, and Section 791.30 makes the current article inoperative on that date and repealed as of January 1, 2029.

That clause is the only place the chaptered text uses the words “artificial intelligence,” and the article gives the term no definition. Related language sits in the definition of processing at Section 791.02(ak), which covers operations performed “by manual or automated means” on a consumer’s personal information, including its collection, use, storage, analysis, deletion, retention, or modification.

Models come in through the purpose rules. Section 791.13(c)(1) says a licensee’s processing or sharing of personal information “shall be reasonably necessary and proportionate” to the purposes for which it was collected or processed, to another disclosed purpose, “or for one of the following purposes.” Subparagraph (D) is one of them: activities conducted “in accordance with Proposition 103, approved by the electors on November 8, 1988, actuarially sound principles, and laws prohibiting unfair discrimination, as applicable.” It names six: pricing model development, customer lifetime value modeling, underwriting algorithm testing, product development, research activities, and the collection or development of a consumer profile by or on behalf of a licensee. The provision is written as a list of purposes that processing may serve, with those conditions attached. It does not forbid any model or method.

Four of those activities also appear in the definition of an insurance transaction. Section 791.02(z)(1)(D) includes “An actuarial study related to” a list that begins with rating or risk management and modeling based on claims data, and ends with pricing model development, customer lifetime value modeling, underwriting algorithm testing, and product development. Subparagraph (L) of paragraph (1) separately covers disclosure to an insurance support organization or third-party service provider “for the purposes of actuarial experience studies, industry benchmarking, loss modeling, market research, or other insurance industry research,” if four listed conditions, including aggregation and deidentification, are met. Paragraph (2) of the same subdivision excludes “processing or sharing related to marketing or research activities,” while Section 791.13(a)(2)(B) requires prior, opt-in consent before sharing in connection with a specific research activity.

For the profile item, Section 791.02(ah)(1)(K) counts as personal information “Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer,” a profile reflecting traits that run from preferences and habits to predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. Under the text, an inference assembled into a consumer profile is itself personal information.

The rest of the act is a general privacy regime for licensees, surplus line insurers, reinsurers, and their third-party service providers, limited by Section 791.01(g) to insurance for personal, family, or household purposes. The new article sets out a stand-alone privacy notice, opt-in consent for specified uses, written records retention schedules, reasons for adverse underwriting decisions, and, under Section 791.09, a consumer’s right to ask that personal information be corrected, amended, or deleted. The Legislative Counsel’s Digest describes a penalty of at least $5,000, not to exceed $1,000,000 in the aggregate for multiple violations.

Where the AI clause meets those rights, the text stops short. Section 791.02(r) defines delete as “permanently erasing the personal information on existing systems so that it is not maintained in human or machine-readable form and cannot be retrieved or utilized in that form,” and contains nothing specific to models. The article does not say how that definition applies to an artificial intelligence system capable of outputting personal information. Section 791.40 hands the details to the Insurance Commissioner, who “may issue rules, regulations, and orders” to carry out the article and must adopt regulations providing model policies, forms, and contracts.