> ## Content Index > Fetch the complete content index at: https://www.thedelatorrereview.com/llms.txt > Use this file to discover other available public pages before exploring further. # California’s Financial Information Privacy Act (CalFIPA): A Practical Guide - URL: https://www.thedelatorrereview.com/californias-financial-information-privacy-act-calfipa-a-practical-guide/ - Published: 2026-08-23T02:53:54.000Z - Updated: 2026-08-23T02:53:54.000Z - Description: California’s Financial Information Privacy Act (CalFIPA) regulates how financial institutions share consumers’ nonpublic personal information. This guide explains who and what CalFIPA covers, consumer rights, consent rules, exceptions, FCRA preemption, and enforcement. - Author: Lydia - Tags: California Financial Information Privacy Act (CalFIPA), California, Financial Privacy, Nonpublic Personal Information (NPI), Privacy, Privacy Rights, Opt-Out The **California Financial Information Privacy Act (CalFIPA)** was enacted in 2003 to provide California consumers with notice and meaningful choice regarding how financial institutions share their nonpublic personal information (NPI). CalFIPA generally provides greater protections against the sharing of financial information than its federal counterpart, the Gramm-Leach-Bliley Act (GLBA). At its core, **CalFIPA regulates when and how financial institutions may share consumers’ NPI with affiliates and nonaffiliated third parties.** Unlike the GLBA, CalFIPA does not include a separate Safeguards Rule governing the security of consumer information. See, [Cal. Fin. Code §§ 4050-4060](https://leginfo.legislature.ca.gov/faces/codes%5FdisplayText.xhtml?division=1.4.&lawCode=FIN&ref=thedelatorrereview.com) ### Effective Date and Subsequent Amendments CalFIPA became effective on **July 1, 2004**, at which time financial institutions were required to be in full compliance with the law. See [Cal. Fin. Code § 4060](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4060.&lawCode=FIN&ref=thedelatorrereview.com). The statute has subsequently been amended, including amendments to **§ 4057 in 2022** and **§ 4056 in 2024**. The 2024 amendment became effective on January 1, 2025\. The discussion below reflects the current version of CalFIPA. ### Relationship With Other Laws CalFIPA operates alongside several federal and state privacy laws: - **GLBA:** CalFIPA is not generally preempted by the GLBA and provides additional protections for California consumers. - **Fair Credit Reporting Act (FCRA):** Federal law preempts certain CalFIPA restrictions where the FCRA governs the sharing of consumer report information. The interaction between the two laws is discussed in greater detail below. - **Local financial privacy laws:** CalFIPA generally preempts local ordinances and regulations concerning the use and sharing of NPI by financial institutions. See [Cal. Fin. Code § 4058.5](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4058.5.&lawCode=FIN&ref=thedelatorrereview.com). ### Who Is Regulated by CalFIPA? Territorial Scope CalFIPA does not expressly define its territorial scope. It primarily applies to financial institutions doing business in California that provide financial products or services to California residents. See [Cal. Fin. Code § 4052(c)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4052.&lawCode=FIN&ref=thedelatorrereview.com). **1\. Financial Institution:** A **“financial institution” (FI)** under CalFIPA is an institution whose business is engaging in financial activities described in **12 U.S.C. § 1843(k)**. This generally tracks the definition of a financial institution under the GLBA. CalFIPA also states that an institution that is not significantly engaged in financial activities is not a financial institution and identifies certain entities that are, and are not, considered financial institutions for purposes of the law. See [Cal. Fin. Code § 4052(c)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4052.&lawCode=FIN&ref=thedelatorrereview.com). > **Practice Tip: Recipients of NPI.** CalFIPA's obligations are not limited to financial institutions. Entities that receive nonpublic personal information (NPI) from a financial institution may also be subject to restrictions on their subsequent use and disclosure of that information. These obligations are discussed further below. **2\. Doing Business in California**: CalFIPA does not define **“doing business” in California.** Accordingly, whether an entity is doing business in the state must be assessed based on the particular circumstances and applicable California law. **3\. California Resident**: For purposes of CalFIPA, an individual is considered a **California resident** if the individual’s **last known mailing address**, as shown in the financial institution’s records, is located in California. An Armed Forces Post Office or Fleet Post Office address is excluded from this determination. See [Cal. Fin. Code § 4052(f)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4052.&lawCode=FIN&ref=thedelatorrereview.com) ### What Is Regulated by CalFIPA? Material Scope CalFIPA regulates the **sharing of consumers’ nonpublic personal information (NPI)** by financial institutions. #### 1\. Sharing of Nonpublic Personal Information As a general rule, a financial institution may not **sell, share, transfer, or otherwise disclose a consumer’s NPI to a nonaffiliated third party without the consumer’s explicit prior consent**. See [Cal. Fin. Code § 4052.5](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4052.5.&lawCode=FIN&ref=thedelatorrereview.com). CalFIPA, however, contains several important exceptions and alternative consent rules. In practice: - **Opt-in consent** generally applies to sharing NPI with nonaffiliated third parties unless an exception or a specific alternative sharing rule applies. - **Opt-out rights** apply to certain sharing with nonaffiliated financial institutions for joint offerings, certain sharing with nonfinancial **“affinity partners,”** and certain sharing with affiliates. - **No consent is required** when a statutory exception applies or for certain sharing within a group of affiliated financial institutions that satisfies CalFIPA’s requirements. These rules and exceptions are discussed in greater detail below under Consumer Rights: Right to Opt In / Opt Out of Certain Sharing. In addition, the Fair Credit Reporting Act (FCRA) preempts certain CalFIPA restrictions involving consumer report information and affiliate sharing. See Case Study: Gould & Lockyer. CalFIPA generally applies to **NPI regardless of its sensitivity**; unlike some other privacy laws, it does not establish a separate category of sensitive NPI subject to heightened sharing restrictions. #### 2\. Nonpublic Personal Information (NPI) CalFIPA defines **“nonpublic personal information” (NPI)** as personally identifiable financial information that is: - **provided by a consumer to a financial institution;** - **derived from a transaction** with the consumer or a service performed for the consumer; or - **otherwise obtained by the financial institution.** “Personally identifiable financial information,” in turn, generally means information that a consumer provides to a financial institution, that results from a transaction involving a financial product or service, or that the institution otherwise obtains **in connection with providing a financial product or service to the consumer**. See [Cal. Fin. Code § 4052(a)–(b)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4052.&lawCode=FIN&ref=thedelatorrereview.com). **Publicly available information is generally not NPI.** This includes information that the financial institution has a reasonable basis to believe is lawfully available to the general public from: - federal, state, or local government records; - widely distributed media; or - disclosures to the general public required by federal, state, or local law. However, a list, description, or other grouping of consumers that is **derived using NPI** may itself constitute NPI even when it also contains publicly available information. Examples of NPI include: - information provided on an application for a loan, credit card, or other financial product or service; - account balances, payment history, overdraft history, and credit or debit card purchase information; - the fact that an individual is or has been a consumer of a financial institution or has obtained a financial product or service from it; - information disclosed in a manner indicating that an individual is or has been a consumer of the financial institution; - a list or grouping of consumers derived using NPI, even if it also contains publicly available information; - information provided or obtained in connection with collecting or servicing a loan; - personally identifiable financial information collected through an Internet cookie or other information-collecting device from a web server; and - information from a consumer report. By contrast, a list, description, or other grouping of consumers that is **derived without using NPI** and contains only publicly available information is not NPI. See [Cal. Fin. Code § 4052(a)–(b)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4052.&lawCode=FIN&ref=thedelatorrereview.com). #### 3\. Consumer A **“consumer”** is a California resident—or the individual’s legal representative—who **obtains or has obtained a financial product or service from a financial institution primarily for personal, family, or household purposes**. An individual is not considered a consumer solely because the individual is: - a participant or beneficiary of an employee benefit plan that a financial institution administers or sponsors, or for which the financial institution acts as a trustee, insurer, or fiduciary; - covered under a group or blanket insurance policy or group annuity contract issued by the financial institution; - a beneficiary of a workers’ compensation plan; - a beneficiary of a trust for which the financial institution acts as trustee; or - a person who has designated the financial institution as trustee for a trust. These exclusions apply provided that the financial institution gives the required CalFIPA notices and rights to the applicable plan sponsor, group or blanket insurance policyholder, or group annuity contractholder. See [Cal. Fin. Code § 4052(f)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4052.&lawCode=FIN&ref=thedelatorrereview.com) ### Consumer Rights: Right to Be Informed, Right to Opt In or Opt Out of Certain Sharing, and Protection Against Discrimination CalFIPA provides consumers with three principal protections: - a **right to be informed** about a financial institution’s information-sharing practices; - a **right to opt in to or opt out of certain disclosures of NPI**, depending on the recipient and circumstances; and - a **right not to be discriminated against** for declining to provide consent or exercising an applicable opt-out right. ## Right To Be Informed (Privacy Notices) A financial institution must provide consumers with **clear and conspicuous notice of its information-sharing practices**and, where required by CalFIPA, an opportunity to opt in or opt out. The notice must satisfy certain requirements, including: - The form must use the title **“IMPORTANT PRIVACY CHOICES FOR CONSUMERS”** and, if applicable, the following headers: “Restrict Information Sharing With Companies We Own Or Control (Affiliates)” and “Restrict Information Sharing With Other Companies We Do Business With To Provide Financial Products And Services.” - The title and headers must be clearly and conspicuously displayed, and no text in the form may be smaller than **10-point type**. - The form must be a separate document, subject to certain exceptions; be designed to call attention to the nature and significance of the information it contains; present information in clear and concise sentences, paragraphs, and sections; use short explanatory sentences (averaging 15–20 words) or bullet lists whenever possible; avoid multiple negatives, legal terminology, and highly technical terminology whenever possible; avoid explanations that are imprecise or readily subject to different interpretations; provide wide margins and ample line spacing and use boldface or italics for key words; and be no more than one page. - The choices relating to **affinity partners** and nonaffiliated financial institutions jointly offering financial products or services must be stated separately, where applicable, and may be selected by checking a box. - The form must achieve a minimum **Flesch Reading Ease score of 50**. Where an opt-out right applies, the consumer must be provided a **reasonable opportunity, before disclosure of the NPI, to direct that the information not be disclosed**. A consumer may exercise this right at any time, and the financial institution must comply with the consumer’s direction within **45 days of receipt**. See [Cal. Fin. Code § 4053(d)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4053.&lawCode=FIN&ref=thedelatorrereview.com). A financial institution is not required to provide notice before disclosures permitted under **§ 4053(c) or § 4056**. See [Cal. Fin. Code § 4053(d)(3)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4053.&lawCode=FIN&ref=thedelatorrereview.com). If a financial institution does not have a continuing relationship with a consumer beyond the initial transaction, it is not required to provide an annual notice, provided that it gives the required notice at the time of the initial transaction. CalFIPA also permits financial institutions to provide **joint notices** in certain circumstances. See [Cal. Fin. Code § 4053(d)(5), (7)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4053.&lawCode=FIN&ref=thedelatorrereview.com). CalFIPA does not prohibit a financial institution from marketing its own products or services, or those of affiliates or nonaffiliated third parties, to its customers, provided that **NPI is not disclosed in connection with the delivery of the marketing materials except as permitted by § 4056** and the other applicable statutory requirements are satisfied. See [Cal. Fin. Code § 4053(e)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4053.&lawCode=FIN&ref=thedelatorrereview.com). The required notice may also be delivered **electronically**, provided that the requirements of § 4054(c) are satisfied. A consumer’s electronic response to an electronically delivered notice is effective. See [Cal. Fin. Code § 4054(c)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4054.&lawCode=FIN&ref=thedelatorrereview.com). ## Sharing NPI #### 1\. SHARING NPI: When is Consent Required? **Opt-in.** As a general rule, CalFIPA requires a financial institution to obtain a consumer’s **explicit prior consent before sharing NPI with a nonaffiliated third party**. Opt-in consent is not required, however, when: - NPI is shared with a **nonaffiliated financial institution for a qualifying joint offering** and the statutory opt-out requirements are satisfied; - permitted information is shared with a qualifying **nonfinancial “affinity partner”** and the statutory opt-out requirements are satisfied; or - a **statutory exception** applies. See [Cal. Fin. Code §§ 4052.5, 4053(a)–(b)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4053.&lawCode=FIN&ref=thedelatorrereview.com). **Opt-out.** Rather than requiring affirmative opt-in consent, CalFIPA generally gives consumers a **right to opt out** of: - certain sharing with nonaffiliated financial institutions for qualifying joint offerings; - certain sharing with nonaffiliated **affinity partners**; and - sharing with affiliates, subject to exceptions, including certain sharing within groups of financial institutions engaged in the same line of business. The principal rules are discussed below. **Joint offerings with nonaffiliated financial institutions.** A financial institution may disclose NPI to a nonaffiliated financial institution for purposes of jointly offering a financial product or service without obtaining opt-in consent if: - the parties have a written agreement requiring the recipient to maintain the confidentiality of the NPI and prohibiting its disclosure or use other than to carry out the joint offering or servicing; - the financial product or service is a product or service of, and is provided by, at least one of the financial institutions that is a party to the agreement; - the product or service is jointly offered, endorsed, or sponsored and clearly and conspicuously identifies the financial institutions that disclose and receive the NPI; and - the consumer receives the required opt-out opportunity and does not exercise it. If these requirements are not satisfied, the general opt-in rule applies unless another exception is available. See [Cal. Fin. Code § 4053(b)(2)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4053.&lawCode=FIN&ref=thedelatorrereview.com). **Affinity partners.** CalFIPA also permits a financial institution to disclose specified NPI to a nonfinancial organization or business with which it has an agreement to offer an affinity card or other affinity financial product or service, subject to several conditions. Among other requirements: - the financial institution and affinity partner must have a contractual agreement requiring the affinity partner to maintain the confidentiality of the NPI and limiting its use to verifying membership, verifying the consumer’s contact information, or offering the affinity partner’s own products or services; - the information may not be disclosed in a manner that reveals or permits extrapolation of additional NPI about a customer; - marketing sent to an email address obtained under this provision must identify the sender and provide a cost-free means to stop further email messages; and - the consumer must receive the required opt-out opportunity and must not have exercised that right. The affinity-partner provision does not apply to credit cards issued in the name of an entity primarily engaged in retail sales or a name proprietary to such an entity. See [Cal. Fin. Code § 4054.6(e)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4054.6.&lawCode=FIN&ref=thedelatorrereview.com). The NPI that may be disclosed under the affinity-partner rule depends on the product involved. For an affinity financial product or service other than a credit card, the permitted information is limited to the consumer’s name, address, telephone number, and email address. For an affinity credit card, the financial institution may also disclose a record of purchases made using the affinity card at a business establishment, including a website, bearing the affinity partner’s brand name. See [Cal. Fin. Code § 4054.6(a)–(c)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4054.6.&lawCode=FIN&ref=thedelatorrereview.com). **Affiliate sharing.** A financial institution generally may share NPI with an affiliate if it has provided the required notice and the consumer has not exercised the right to opt out. Certain intra-group sharing, however, is permitted without an opt-out when the requirements of § 4053(c) are satisfied, including requirements relating to common ownership, functional regulation, line of business, and branding. The FCRA may also preempt particular CalFIPA restrictions involving affiliate sharing of consumer report information, as discussed in the FCRA Preemption section below. See [Cal. Fin. Code § 4053(b)–(c)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4053.&lawCode=FIN&ref=thedelatorrereview.com). #### 2.SHARING NPI: When is Consent NOT Required? **2.1\. Sharing With Certain Intra-Group Sharing** CalFIPA does not require opt-in or opt-out consent when a statutory exception applies or, subject to specific requirements, when a financial institution shares NPI within certain groups of affiliated financial institutions. For this **intra-group sharing exception** to apply, the financial institutions disclosing and receiving the NPI must: - be regulated by the same functional regulator. Financial institutions regulated by the Office of the Comptroller of the Currency, Office of Thrift Supervision, National Credit Union Administration, or a state regulator of depository institutions are deemed to have the same functional regulator. Financial institutions regulated by the Securities and Exchange Commission, U.S. Department of Labor, or a state securities regulator are also deemed to have the same functional regulator. Insurers admitted in California to transact insurance and licensed to write insurance policies are deemed to satisfy this requirement; - be principally engaged in the same line of business, which must be insurance, banking, or securities; and - share a common brand, other than a brand consisting solely of a graphic element or symbol, that is used to identify the source of their products and services. The exception applies to sharing between a financial institution and its wholly owned financial institution subsidiaries; among financial institutions that are each wholly owned by the same financial institution; among financial institutions wholly owned by the same holding company; or among the insurance and management entities of certain single insurance holding company systems involving reciprocal insurance exchanges. The exception does not permit the disclosure of medical record information, as defined by the Insurance Code, except in accordance with CalFIPA’s otherwise applicable requirements. See [Cal. Fin. Code § 4053(c)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4053.&lawCode=FIN&ref=thedelatorrereview.com) **2.2\. Other Exceptions Permitting Disclosure Without Consent** CalFIPA additionally permits NPI to be disclosed without the consumer’s opt-in or opt-out consent when one of the statutory exceptions in [**Cal. Fin. Code § 4056**](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?lawCode=FIN§ionNum=4056.&ref=thedelatorrereview.com) applies. **a) Service Provider Exception**: A financial institution may disclose NPI to an affiliate or nonaffiliated third party to perform **business or professional services** on its behalf, such as printing, mailing, data processing or analysis, or customer surveys, provided that: - the services could lawfully be performed by the financial institution; - a written contract prohibits the recipient from disclosing or using the NPI other than to carry out the purpose for which the information was disclosed; - the NPI disclosed is limited to what is necessary to perform the contracted services; and - the financial institution does not receive payment from or through the recipient in connection with, or as a result of, the disclosure of the NPI. See [Cal. Fin. Code § 4056(b)(9)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4056.&lawCode=FIN&ref=thedelatorrereview.com). **b) Transaction Processing and Account Servicing Exception**" A financial institution may disclose NPI when the disclosure is: - necessary to effect, administer, or enforce a transaction requested or authorized by the consumer, or to service or process a financial product or service requested or authorized by the consumer; or - made in connection with maintaining or servicing the consumer’s account, including with another entity as part of a private-label credit card program or other extension of credit on behalf of that entity, or in connection with a proposed or actual securitization, secondary-market sale, sale of servicing rights, or similar transaction related to a transaction of the consumer. See [Cal. Fin. Code § 4056(b)(1)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4056.&lawCode=FIN&ref=thedelatorrereview.com). **c) Other Permitted Disclosures**: CalFIPA also permits a financial institution to disclose NPI without otherwise obtaining consent when the information is: - disclosed **with the consent of or at the direction of the consumer**; - disclosed to **protect the confidentiality or security** of the financial institution’s records relating to the consumer, product or service, or transaction; - disclosed to protect against or prevent actual or potential **fraud, identity theft, unauthorized transactions, claims, or other liability**; - disclosed for required institutional **risk control** or to resolve **customer disputes or inquiries**; - disclosed to persons **holding a legal or beneficial interest** relating to the consumer, including for debt-collection purposes; - disclosed to persons acting in a **fiduciary or representative capacity** on behalf of the consumer; - disclosed to **insurance rate advisory organizations, guaranty funds or agencies, applicable rating agencies, persons assessing compliance with industry standards, or the financial institution’s attorneys, accountants, and auditors**; - disclosed as specifically required or permitted by law, in accordance with the **Right to Financial Privacy Act of 1978**, to specified governmental or regulatory authorities, including law enforcement agencies, federal functional regulators, the Secretary of the Treasury, the California Department of Insurance or other state insurance regulators, the State Bar of California, the Federal Trade Commission, or self-regulatory organizations, or for an investigation relating to public safety; - disclosed in connection with a **proposed or actual sale, merger, transfer, or exchange** of all or part of a business or operating unit, provided the disclosure concerns solely consumers of that business or unit; - disclosed to **comply with federal, state, or local law or other legal requirements**, a properly authorized civil, criminal, administrative, or regulatory investigation, subpoena or summons, judicial process, or an authorized request from a governmental regulatory authority; - disclosed to report known or suspected **elder or dependent adult financial abuse** or to cooperate with a local adult protective services agency investigation of such abuse; - disclosed to **identify or locate** missing or abducted children, witnesses, criminals and fugitives, parties to lawsuits, parents delinquent in child-support payments, organ and bone marrow donors, pension fund beneficiaries, or missing heirs; - disclosed to a state-licensed or certified **real estate appraiser** for submission to a central data repository, provided the information is compiled strictly to complete other real estate appraisals and is not used for another purpose; - disclosed as required by the **USA PATRIOT Act**; - disclosed to a **consumer reporting agency pursuant to the Fair Credit Reporting Act**, or obtained from a consumer report reported by a consumer reporting agency; or - disclosed pursuant to a **written agreement between a consumer and a registered broker-dealer or investment adviser** for the sole purpose of providing investment management, portfolio advisory, or financial-planning products and services covered by that agreement. See [Cal. Fin. Code § 4056(b)(2)–(8), (10)–(14)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4056.&lawCode=FIN&ref=thedelatorrereview.com). ### 3\. Prohibition Against Discrimination A financial institution may not **discriminate against or deny an otherwise qualified consumer a financial product or service** because the consumer: has declined to provide consent for the disclosure of NPI to a nonaffiliated third party; or - has exercised the right to opt out of certain sharing of NPI with affiliates or nonaffiliated financial institutions. However, CalFIPA does not prohibit a financial institution from **offering incentives or discounts to encourage a consumer to provide a specific response to the applicable notice**. In addition, a financial institution is not required to offer or provide a product or service if it **cannot provide that product or service without the disclosure of NPI** and the consumer has declined to consent to, or has opted out of, the disclosure. See [Cal. Fin. Code § 4053(a), (b)(4)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4053.&lawCode=FIN&ref=thedelatorrereview.com) ## FCRA Preemption The **Fair Credit Reporting Act (FCRA)** preempts certain CalFIPA restrictions on the sharing of consumer information among affiliates. As a result, financial institutions may engage in certain affiliate sharing permitted by the FCRA even where CalFIPA would otherwise impose more restrictive requirements. In **American Bankers Association v. Gould**, the Ninth Circuit held that the FCRA preempts CalFIPA **only to the extent that CalFIPA regulates information covered by the FCRA’s preemption provision**. Accordingly, the interaction between the two statutes depends on the type of information being shared. - **Transaction and experience information.** Information concerning a consumer’s transactions or experiences with the person making the communication may generally be shared with affiliates without triggering the FCRA’s consumer-report requirements. CalFIPA cannot impose additional restrictions on affiliate sharing of information falling within this federally protected category. See FCRA § 603(d)(2)(A)(i)–(ii), 15 U.S.C. § 1681a(d)(2)(A)(i)–(ii). - **Other consumer information, including creditworthiness information.** The FCRA permits certain other information to be shared among affiliates if the consumer is **clearly and conspicuously notified that the information may be communicated and given an opportunity to opt out**. CalFIPA cannot impose more restrictive affiliate-sharing requirements on information falling within this provision. See FCRA § 603(d)(2)(A)(iii), 15 U.S.C. § 1681a(d)(2)(A)(iii). The Ninth Circuit therefore rejected the argument that the FCRA preempts CalFIPA’s affiliate-sharing provisions **in their entirety**. Instead, CalFIPA remains applicable to the extent its restrictions concern information or conduct that falls outside the scope of the FCRA’s preemption. See *American Bankers Ass’n v. Gould*, 412 F.3d 1081, 1086–87 (9th Cir. 2005). ## Insurance CalFIPA establishes **special rules for certain insurance producers, brokers, insurers, and related entities**. Among other things, these provisions address when CalFIPA applies to licensed insurance producers and investment advisers, the use and disclosure of NPI in obtaining insurance quotes, and the sharing of NPI between insurers and certain exclusive agents. Importantly, the exclusions provided by this section are limited. For example, even when a person or entity otherwise qualifies for an exclusion under § 4056.5, **CalFIPA applies when NPI is or will be shared with an affiliate or nonaffiliated third party**. See [Cal. Fin. Code § 4056.5](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4056.5.&lawCode=FIN&ref=thedelatorrereview.com) ## Obligations: Vendor Management and Downstream Use of NPI Financial institutions must enter into specified **contractual arrangements** when relying on certain CalFIPA provisions to share NPI. Depending on the applicable provision, these contracts generally restrict the recipient’s ability to **use or further disclose the NPI** beyond the purposes for which it was provided. See the discussion of joint offerings, affinity partners, and statutory exceptions above. CalFIPA also directly restricts entities that receive NPI from a financial institution. An entity that receives NPI under CalFIPA generally may not further disclose the information to another entity unless the disclosure would be lawful if made directly by the financial institution. In addition, when an entity receives NPI pursuant to an exception under § 4056, it may not use or disclose the information except in the ordinary course of business to carry out the activity covered by the exception under which the information was received. See [Cal. Fin. Code § 4053.5](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4053.5.&lawCode=FIN&ref=thedelatorrereview.com) ## Enforcement ### Private Cause of Action CalFIPA does **not provide a private right of action**. Civil penalties under CalFIPA are exclusively assessed and recovered in a civil action brought in the name of the People of the State of California by the Attorney General or the applicable functional regulator. This does not necessarily preclude a consumer from pursuing remedies that may be independently available under other applicable laws. ### Agency Enforcement CalFIPA may be enforced by the **California Attorney General** or the functional regulator with jurisdiction over the financial institution. The applicable enforcement authority depends on the type of institution: - For **banks, savings associations, credit unions, commercial lending companies, and bank holding companies**, enforcement authority rests with the **California Department of Financial Protection and Innovation (DFPI), Division of Financial Institutions**, or the appropriate federal authority. - For persons engaged in the **business of insurance**, enforcement authority rests with the **California Department of Insurance**. - For **investment brokers or dealers, investment companies, investment advisers, residential mortgage lenders, and finance lenders**, enforcement authority rests with the **DFPI, Division of Corporations**. - For a financial institution not subject to the jurisdiction of one of the functional regulators identified above, enforcement authority rests with the **California Attorney General**. See [Cal. Fin. Code § 4057(e)](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4057.&lawCode=FIN&ref=thedelatorrereview.com). ### Civil Penalties The applicable civil penalties depend on whether the violation was negligent or knowing and willful: - A **negligent disclosure or sharing** of NPI in violation of CalFIPA may result in a civil penalty of up to **$2,500 per violation**, regardless of the amount of damages suffered by the consumer. If the disclosure or sharing results in the release of NPI of more than one individual, the total civil penalty under this provision may not exceed **$500,000**. - A **knowing and willful obtaining, disclosure, sharing, or use** of NPI in violation of CalFIPA may result in a civil penalty of up to **$2,500 per individual violation**, regardless of the amount of damages suffered by the consumer. If a violation of CalFIPA results in the **identity theft of a consumer**, as defined by California Penal Code § 530.5, the applicable civil penalties are **doubled**. In determining the amount of a penalty, the court must consider: - the total assets and net worth of the violating entity; - the nature and seriousness of the violation; - the persistence of the violation, including attempts to correct the situation leading to the violation; - the length of time over which the violation occurred; - the number of times the entity has violated CalFIPA; - the harm caused to consumers; - the proceeds derived from the violation; and - the impact of possible penalties on the overall fiscal solvency of the violating entity. See [Cal. Fin. Code § 4057](https://leginfo.legislature.ca.gov/faces/codes%5FdisplaySection.xhtml?sectionNum=4057.&lawCode=FIN&ref=thedelatorrereview.com) ## Further Resources ### Legal Authorities - [California Financial Information Privacy Act (CalFIPA), Cal. Fin. Code §§ 4050–4060](https://leginfo.legislature.ca.gov/faces/codes%5FdisplayText.xhtml?lawCode=FIN&division=1.4.&title=&part=&chapter=&article=&ref=thedelatorrereview.com) — Current statutory text of CalFIPA. Recent Amendments - **SB 1498 (2022), Stats. 2022, ch. 452, § 105** — Amended Cal. Fin. Code § 4057, including provisions concerning enforcement of CalFIPA. The amendment became effective January 1, 2023\. - **AB 3279 (2024), Stats. 2024, ch. 227, § 29** — Amended Cal. Fin. Code § 4056\. The amendment became effective January 1, 2025\. ### Government Agencies - [California Department of Financial Protection and Innovation (DFPI)](https://dfpi.ca.gov/?ref=thedelatorrereview.com) — California regulator responsible for administering and enforcing financial-services laws with respect to institutions within its jurisdiction. - [California Department of Insurance](https://www.insurance.ca.gov/?ref=thedelatorrereview.com) — California regulator with authority over insurers and other persons engaged in the business of insurance. - [California Attorney General](https://oag.ca.gov/?ref=thedelatorrereview.com) — Authorized to enforce CalFIPA with respect to financial institutions and other entities within the Attorney General’s statutory enforcement authority. ### Cases - ***American Bankers Ass’n v. Gould*, 412 F.3d 1081 (9th Cir. 2005)** — Leading decision addressing the interaction between CalFIPA and the FCRA and the extent to which federal law preempts CalFIPA’s restrictions on affiliate sharing. - Case Study: Gould & Lockyer — Discussion of the *Gould* litigation and FCRA preemption of particular CalFIPA affiliate-sharing restrictions. ### Background and Commentary - [**California: A Privacy Statute Meets GLBA (and) FCRA**](https://scholarship.law.unc.edu/cgi/viewcontent.cgi?article=1185&context=ncbi&ref=thedelatorrereview.com), Jason Shroff, 9 N.C. Banking Inst. 223 (2005) — Detailed examination of CalFIPA and its relationship with the GLBA and FCRA. - [**Comparison of California’s Financial Information Privacy Act of 2003 with Federal Privacy Provisions**](https://www.everycrsreport.com/files/20040106%5FRS21614%5F3c50be5f7288952a0d86bfd32046185892751a47.pdf?ref=thedelatorrereview.com), M. Maureen Murphy, Congressional Research Service, Report RS21614 (updated Jan. 6, 2004) — Contemporary comparison of CalFIPA with federal financial privacy requirements. - [**California Consumer Privacy Act: The Challenge Ahead—The Interplay Between the CCPA and Financial Institutions**](https://www.hldataprotection.com/2018/12/articles/consumer-privacy/california-consumer-privacy-act-the-challenge-ahead-the-interplay-between-the-ccpa-and-financial-institutions/?ref=thedelatorrereview.com), Timothy Tobin & Roshni Patel, Hogan Lovells (Dec. 7, 2018) — Discussion of the relationship between California’s broader consumer privacy regime and financial institutions subject to financial privacy laws. - [**As California Goes So Goes the Nation?**](https://www.infolawgroup.com/blog/2010/11/articles/regulations/as-california-goes-so-goes-the-nation-part-one?ref=thedelatorrereview.com), InfoLawGroup — Commentary on California financial privacy regulation and its broader implications. ![](https://storage.ghost.io/c/54/ef/54efeb65-4f2f-479e-b4bb-a9ee526feeaa/content/images/2026/08/Screenshot-2026-07-04-at-4.45.19---PM-18.jpeg)