Sign in Subscribe
By Lydia in California Financial Information Privacy Act (CalFIPA) —

California’s Financial Information Privacy Act (CalFIPA): A Practical Guide

California’s Financial Information Privacy Act (CalFIPA) regulates how financial institutions share consumers’ nonpublic personal information. This guide explains who and what CalFIPA covers, consumer rights, consent rules, exceptions, FCRA preemption, and enforcement.

California’s Financial Information Privacy Act (CalFIPA): A Practical Guide
ChatGPT generated picture from: Templeton Reid, 2 1/2 Dollars, 1830 — Public Resource Org

The California Financial Information Privacy Act (CalFIPA) was enacted in 2003 to provide California consumers with notice and meaningful choice regarding how financial institutions share their nonpublic personal information (NPI). CalFIPA generally provides greater protections against the sharing of financial information than its federal counterpart, the Gramm-Leach-Bliley Act (GLBA).

At its core, CalFIPA regulates when and how financial institutions may share consumers’ NPI with affiliates and nonaffiliated third parties.

Unlike the GLBA, CalFIPA does not include a separate Safeguards Rule governing the security of consumer information.

See, Cal. Fin. Code §§ 4050-4060

Effective Date and Subsequent Amendments

CalFIPA became effective on July 1, 2004, at which time financial institutions were required to be in full compliance with the law. See Cal. Fin. Code § 4060.

The statute has subsequently been amended, including amendments to § 4057 in 2022 and § 4056 in 2024. The 2024 amendment became effective on January 1, 2025. The discussion below reflects the current version of CalFIPA.

Relationship With Other Laws

CalFIPA operates alongside several federal and state privacy laws:

  • GLBA: CalFIPA is not generally preempted by the GLBA and provides additional protections for California consumers.
  • Fair Credit Reporting Act (FCRA): Federal law preempts certain CalFIPA restrictions where the FCRA governs the sharing of consumer report information. The interaction between the two laws is discussed in greater detail below.
  • Local financial privacy laws: CalFIPA generally preempts local ordinances and regulations concerning the use and sharing of NPI by financial institutions. See Cal. Fin. Code § 4058.5.

Who Is Regulated by CalFIPA? Territorial Scope

CalFIPA does not expressly define its territorial scope. It primarily applies to financial institutions doing business in California that provide financial products or services to California residents. See Cal. Fin. Code § 4052(c).

1. Financial Institution: A “financial institution” (FI) under CalFIPA is an institution whose business is engaging in financial activities described in 12 U.S.C. § 1843(k). This generally tracks the definition of a financial institution under the GLBA.

CalFIPA also states that an institution that is not significantly engaged in financial activities is not a financial institution and identifies certain entities that are, and are not, considered financial institutions for purposes of the law. See Cal. Fin. Code § 4052(c).

Practice Tip: Recipients of NPI. CalFIPA's obligations are not limited to financial institutions. Entities that receive nonpublic personal information (NPI) from a financial institution may also be subject to restrictions on their subsequent use and disclosure of that information. These obligations are discussed further below.

2. Doing Business in California: CalFIPA does not define “doing business” in California. Accordingly, whether an entity is doing business in the state must be assessed based on the particular circumstances and applicable California law.

3. California Resident: For purposes of CalFIPA, an individual is considered a California resident if the individual’s last known mailing address, as shown in the financial institution’s records, is located in California. An Armed Forces Post Office or Fleet Post Office address is excluded from this determination.

See Cal. Fin. Code § 4052(f)

What Is Regulated by CalFIPA? Material Scope

CalFIPA regulates the sharing of consumers’ nonpublic personal information (NPI) by financial institutions.

1. Sharing of Nonpublic Personal Information

As a general rule, a financial institution may not sell, share, transfer, or otherwise disclose a consumer’s NPI to a nonaffiliated third party without the consumer’s explicit prior consent. See Cal. Fin. Code § 4052.5. 

CalFIPA, however, contains several important exceptions and alternative consent rules. In practice:

  • Opt-in consent generally applies to sharing NPI with nonaffiliated third parties unless an exception or a specific alternative sharing rule applies.
  • Opt-out rights apply to certain sharing with nonaffiliated financial institutions for joint offerings, certain sharing with nonfinancial “affinity partners,” and certain sharing with affiliates.
  • No consent is required when a statutory exception applies or for certain sharing within a group of affiliated financial institutions that satisfies CalFIPA’s requirements.

These rules and exceptions are discussed in greater detail below under Consumer Rights: Right to Opt In / Opt Out of Certain Sharing.

In addition, the Fair Credit Reporting Act (FCRA) preempts certain CalFIPA restrictions involving consumer report information and affiliate sharing. See Case Study: Gould & Lockyer.

CalFIPA generally applies to NPI regardless of its sensitivity; unlike some other privacy laws, it does not establish a separate category of sensitive NPI subject to heightened sharing restrictions.

2. Nonpublic Personal Information (NPI)

CalFIPA defines “nonpublic personal information” (NPI) as personally identifiable financial information that is:

  • provided by a consumer to a financial institution;
  • derived from a transaction with the consumer or a service performed for the consumer; or
  • otherwise obtained by the financial institution.

“Personally identifiable financial information,” in turn, generally means information that a consumer provides to a financial institution, that results from a transaction involving a financial product or service, or that the institution otherwise obtains in connection with providing a financial product or service to the consumer.

See Cal. Fin. Code § 4052(a)–(b). 

Publicly available information is generally not NPI. This includes information that the financial institution has a reasonable basis to believe is lawfully available to the general public from:

  • federal, state, or local government records;
  • widely distributed media; or
  • disclosures to the general public required by federal, state, or local law.

However, a list, description, or other grouping of consumers that is derived using NPI may itself constitute NPI even when it also contains publicly available information.

Examples of NPI include:

  • information provided on an application for a loan, credit card, or other financial product or service;
  • account balances, payment history, overdraft history, and credit or debit card purchase information;
  • the fact that an individual is or has been a consumer of a financial institution or has obtained a financial product or service from it;
  • information disclosed in a manner indicating that an individual is or has been a consumer of the financial institution;
  • a list or grouping of consumers derived using NPI, even if it also contains publicly available information;
  • information provided or obtained in connection with collecting or servicing a loan;
  • personally identifiable financial information collected through an Internet cookie or other information-collecting device from a web server; and
  • information from a consumer report.

By contrast, a list, description, or other grouping of consumers that is derived without using NPI and contains only publicly available information is not NPI.

See Cal. Fin. Code § 4052(a)–(b). 

3. Consumer

A “consumer” is a California resident—or the individual’s legal representative—who obtains or has obtained a financial product or service from a financial institution primarily for personal, family, or household purposes.

An individual is not considered a consumer solely because the individual is:

  • a participant or beneficiary of an employee benefit plan that a financial institution administers or sponsors, or for which the financial institution acts as a trustee, insurer, or fiduciary;
  • covered under a group or blanket insurance policy or group annuity contract issued by the financial institution;
  • a beneficiary of a workers’ compensation plan;
  • a beneficiary of a trust for which the financial institution acts as trustee; or
  • a person who has designated the financial institution as trustee for a trust.

These exclusions apply provided that the financial institution gives the required CalFIPA notices and rights to the applicable plan sponsor, group or blanket insurance policyholder, or group annuity contractholder.

See Cal. Fin. Code § 4052(f)

Consumer Rights: Right to Be Informed, Right to Opt In or Opt Out of Certain Sharing, and Protection Against Discrimination

CalFIPA provides consumers with three principal protections:

  • a right to be informed about a financial institution’s information-sharing practices;
  • a right to opt in to or opt out of certain disclosures of NPI, depending on the recipient and circumstances; and
  • a right not to be discriminated against for declining to provide consent or exercising an applicable opt-out right.

Right To Be Informed (Privacy Notices)

A financial institution must provide consumers with clear and conspicuous notice of its information-sharing practicesand, where required by CalFIPA, an opportunity to opt in or opt out. The notice must satisfy certain requirements, including:

  • The form must use the title “IMPORTANT PRIVACY CHOICES FOR CONSUMERS” and, if applicable, the following headers: “Restrict Information Sharing With Companies We Own Or Control (Affiliates)” and “Restrict Information Sharing With Other Companies We Do Business With To Provide Financial Products And Services.”
  • The title and headers must be clearly and conspicuously displayed, and no text in the form may be smaller than 10-point type.
  • The form must be a separate document, subject to certain exceptions; be designed to call attention to the nature and significance of the information it contains; present information in clear and concise sentences, paragraphs, and sections; use short explanatory sentences (averaging 15–20 words) or bullet lists whenever possible; avoid multiple negatives, legal terminology, and highly technical terminology whenever possible; avoid explanations that are imprecise or readily subject to different interpretations; provide wide margins and ample line spacing and use boldface or italics for key words; and be no more than one page.
  • The choices relating to affinity partners and nonaffiliated financial institutions jointly offering financial products or services must be stated separately, where applicable, and may be selected by checking a box.
  • The form must achieve a minimum Flesch Reading Ease score of 50.

Where an opt-out right applies, the consumer must be provided a reasonable opportunity, before disclosure of the NPI, to direct that the information not be disclosed. A consumer may exercise this right at any time, and the financial institution must comply with the consumer’s direction within 45 days of receipt.

See Cal. Fin. Code § 4053(d).

A financial institution is not required to provide notice before disclosures permitted under § 4053(c) or § 4056. See Cal. Fin. Code § 4053(d)(3). 

If a financial institution does not have a continuing relationship with a consumer beyond the initial transaction, it is not required to provide an annual notice, provided that it gives the required notice at the time of the initial transaction. CalFIPA also permits financial institutions to provide joint notices in certain circumstances. See Cal. Fin. Code § 4053(d)(5), (7).

CalFIPA does not prohibit a financial institution from marketing its own products or services, or those of affiliates or nonaffiliated third parties, to its customers, provided that NPI is not disclosed in connection with the delivery of the marketing materials except as permitted by § 4056 and the other applicable statutory requirements are satisfied. See Cal. Fin. Code § 4053(e). 

The required notice may also be delivered electronically, provided that the requirements of § 4054(c) are satisfied. A consumer’s electronic response to an electronically delivered notice is effective. See Cal. Fin. Code § 4054(c). 

Sharing NPI

Opt-in. As a general rule, CalFIPA requires a financial institution to obtain a consumer’s explicit prior consent before sharing NPI with a nonaffiliated third party. Opt-in consent is not required, however, when:

  • NPI is shared with a nonaffiliated financial institution for a qualifying joint offering and the statutory opt-out requirements are satisfied;
  • permitted information is shared with a qualifying nonfinancial “affinity partner” and the statutory opt-out requirements are satisfied; or
  • a statutory exception applies.

See Cal. Fin. Code §§ 4052.5, 4053(a)–(b). 

Opt-out. Rather than requiring affirmative opt-in consent, CalFIPA generally gives consumers a right to opt out of:

  • certain sharing with nonaffiliated financial institutions for qualifying joint offerings;
  • certain sharing with nonaffiliated affinity partners; and
  • sharing with affiliates, subject to exceptions, including certain sharing within groups of financial institutions engaged in the same line of business.

The principal rules are discussed below.

Joint offerings with nonaffiliated financial institutions. A financial institution may disclose NPI to a nonaffiliated financial institution for purposes of jointly offering a financial product or service without obtaining opt-in consent if:

  • the parties have a written agreement requiring the recipient to maintain the confidentiality of the NPI and prohibiting its disclosure or use other than to carry out the joint offering or servicing;
  • the financial product or service is a product or service of, and is provided by, at least one of the financial institutions that is a party to the agreement;
  • the product or service is jointly offered, endorsed, or sponsored and clearly and conspicuously identifies the financial institutions that disclose and receive the NPI; and
  • the consumer receives the required opt-out opportunity and does not exercise it.

If these requirements are not satisfied, the general opt-in rule applies unless another exception is available.

See Cal. Fin. Code § 4053(b)(2). 

Affinity partners. CalFIPA also permits a financial institution to disclose specified NPI to a nonfinancial organization or business with which it has an agreement to offer an affinity card or other affinity financial product or service, subject to several conditions. Among other requirements:

  • the financial institution and affinity partner must have a contractual agreement requiring the affinity partner to maintain the confidentiality of the NPI and limiting its use to verifying membership, verifying the consumer’s contact information, or offering the affinity partner’s own products or services;
  • the information may not be disclosed in a manner that reveals or permits extrapolation of additional NPI about a customer;
  • marketing sent to an email address obtained under this provision must identify the sender and provide a cost-free means to stop further email messages; and
  • the consumer must receive the required opt-out opportunity and must not have exercised that right.

The affinity-partner provision does not apply to credit cards issued in the name of an entity primarily engaged in retail sales or a name proprietary to such an entity. See Cal. Fin. Code § 4054.6(e). 

The NPI that may be disclosed under the affinity-partner rule depends on the product involved. For an affinity financial product or service other than a credit card, the permitted information is limited to the consumer’s name, address, telephone number, and email address. For an affinity credit card, the financial institution may also disclose a record of purchases made using the affinity card at a business establishment, including a website, bearing the affinity partner’s brand name.

See Cal. Fin. Code § 4054.6(a)–(c). 

Affiliate sharing. A financial institution generally may share NPI with an affiliate if it has provided the required notice and the consumer has not exercised the right to opt out. Certain intra-group sharing, however, is permitted without an opt-out when the requirements of § 4053(c) are satisfied, including requirements relating to common ownership, functional regulation, line of business, and branding.

The FCRA may also preempt particular CalFIPA restrictions involving affiliate sharing of consumer report information, as discussed in the FCRA Preemption section below.

See Cal. Fin. Code § 4053(b)–(c). 

2.1. Sharing With Certain Intra-Group Sharing

CalFIPA does not require opt-in or opt-out consent when a statutory exception applies or, subject to specific requirements, when a financial institution shares NPI within certain groups of affiliated financial institutions.

For this intra-group sharing exception to apply, the financial institutions disclosing and receiving the NPI must:

  • be regulated by the same functional regulator. Financial institutions regulated by the Office of the Comptroller of the Currency, Office of Thrift Supervision, National Credit Union Administration, or a state regulator of depository institutions are deemed to have the same functional regulator. Financial institutions regulated by the Securities and Exchange Commission, U.S. Department of Labor, or a state securities regulator are also deemed to have the same functional regulator. Insurers admitted in California to transact insurance and licensed to write insurance policies are deemed to satisfy this requirement;
  • be principally engaged in the same line of business, which must be insurance, banking, or securities; and
  • share a common brand, other than a brand consisting solely of a graphic element or symbol, that is used to identify the source of their products and services.

The exception applies to sharing between a financial institution and its wholly owned financial institution subsidiaries; among financial institutions that are each wholly owned by the same financial institution; among financial institutions wholly owned by the same holding company; or among the insurance and management entities of certain single insurance holding company systems involving reciprocal insurance exchanges.

The exception does not permit the disclosure of medical record information, as defined by the Insurance Code, except in accordance with CalFIPA’s otherwise applicable requirements.

See Cal. Fin. Code § 4053(c)

2.2. Other Exceptions Permitting Disclosure Without Consent

CalFIPA additionally permits NPI to be disclosed without the consumer’s opt-in or opt-out consent when one of the statutory exceptions in Cal. Fin. Code § 4056 applies.

a) Service Provider Exception: A financial institution may disclose NPI to an affiliate or nonaffiliated third party to perform business or professional services on its behalf, such as printing, mailing, data processing or analysis, or customer surveys, provided that:

  • the services could lawfully be performed by the financial institution;
  • a written contract prohibits the recipient from disclosing or using the NPI other than to carry out the purpose for which the information was disclosed;
  • the NPI disclosed is limited to what is necessary to perform the contracted services; and
  • the financial institution does not receive payment from or through the recipient in connection with, or as a result of, the disclosure of the NPI.

See Cal. Fin. Code § 4056(b)(9). 

b) Transaction Processing and Account Servicing Exception" A financial institution may disclose NPI when the disclosure is:

  • necessary to effect, administer, or enforce a transaction requested or authorized by the consumer, or to service or process a financial product or service requested or authorized by the consumer; or
  • made in connection with maintaining or servicing the consumer’s account, including with another entity as part of a private-label credit card program or other extension of credit on behalf of that entity, or in connection with a proposed or actual securitization, secondary-market sale, sale of servicing rights, or similar transaction related to a transaction of the consumer.

See Cal. Fin. Code § 4056(b)(1). 

c) Other Permitted Disclosures: CalFIPA also permits a financial institution to disclose NPI without otherwise obtaining consent when the information is:

  • disclosed with the consent of or at the direction of the consumer;
  • disclosed to protect the confidentiality or security of the financial institution’s records relating to the consumer, product or service, or transaction;
  • disclosed to protect against or prevent actual or potential fraud, identity theft, unauthorized transactions, claims, or other liability;
  • disclosed for required institutional risk control or to resolve customer disputes or inquiries;
  • disclosed to persons holding a legal or beneficial interest relating to the consumer, including for debt-collection purposes;
  • disclosed to persons acting in a fiduciary or representative capacity on behalf of the consumer;
  • disclosed to insurance rate advisory organizations, guaranty funds or agencies, applicable rating agencies, persons assessing compliance with industry standards, or the financial institution’s attorneys, accountants, and auditors;
  • disclosed as specifically required or permitted by law, in accordance with the Right to Financial Privacy Act of 1978, to specified governmental or regulatory authorities, including law enforcement agencies, federal functional regulators, the Secretary of the Treasury, the California Department of Insurance or other state insurance regulators, the State Bar of California, the Federal Trade Commission, or self-regulatory organizations, or for an investigation relating to public safety;
  • disclosed in connection with a proposed or actual sale, merger, transfer, or exchange of all or part of a business or operating unit, provided the disclosure concerns solely consumers of that business or unit;
  • disclosed to comply with federal, state, or local law or other legal requirements, a properly authorized civil, criminal, administrative, or regulatory investigation, subpoena or summons, judicial process, or an authorized request from a governmental regulatory authority;
  • disclosed to report known or suspected elder or dependent adult financial abuse or to cooperate with a local adult protective services agency investigation of such abuse;
  • disclosed to identify or locate missing or abducted children, witnesses, criminals and fugitives, parties to lawsuits, parents delinquent in child-support payments, organ and bone marrow donors, pension fund beneficiaries, or missing heirs;
  • disclosed to a state-licensed or certified real estate appraiser for submission to a central data repository, provided the information is compiled strictly to complete other real estate appraisals and is not used for another purpose;
  • disclosed as required by the USA PATRIOT Act;
  • disclosed to a consumer reporting agency pursuant to the Fair Credit Reporting Act, or obtained from a consumer report reported by a consumer reporting agency; or
  • disclosed pursuant to a written agreement between a consumer and a registered broker-dealer or investment adviser for the sole purpose of providing investment management, portfolio advisory, or financial-planning products and services covered by that agreement.

See Cal. Fin. Code § 4056(b)(2)–(8), (10)–(14). 

3. Prohibition Against Discrimination

A financial institution may not discriminate against or deny an otherwise qualified consumer a financial product or service because the consumer:

has declined to provide consent for the disclosure of NPI to a nonaffiliated third party; or

  • has exercised the right to opt out of certain sharing of NPI with affiliates or nonaffiliated financial institutions.

However, CalFIPA does not prohibit a financial institution from offering incentives or discounts to encourage a consumer to provide a specific response to the applicable notice.

In addition, a financial institution is not required to offer or provide a product or service if it cannot provide that product or service without the disclosure of NPI and the consumer has declined to consent to, or has opted out of, the disclosure.

See Cal. Fin. Code § 4053(a), (b)(4)

FCRA Preemption

The Fair Credit Reporting Act (FCRA) preempts certain CalFIPA restrictions on the sharing of consumer information among affiliates. As a result, financial institutions may engage in certain affiliate sharing permitted by the FCRA even where CalFIPA would otherwise impose more restrictive requirements.

In American Bankers Association v. Gould, the Ninth Circuit held that the FCRA preempts CalFIPA only to the extent that CalFIPA regulates information covered by the FCRA’s preemption provision. Accordingly, the interaction between the two statutes depends on the type of information being shared.

  • Transaction and experience information. Information concerning a consumer’s transactions or experiences with the person making the communication may generally be shared with affiliates without triggering the FCRA’s consumer-report requirements. CalFIPA cannot impose additional restrictions on affiliate sharing of information falling within this federally protected category. See FCRA § 603(d)(2)(A)(i)–(ii), 15 U.S.C. § 1681a(d)(2)(A)(i)–(ii).
  • Other consumer information, including creditworthiness information. The FCRA permits certain other information to be shared among affiliates if the consumer is clearly and conspicuously notified that the information may be communicated and given an opportunity to opt out. CalFIPA cannot impose more restrictive affiliate-sharing requirements on information falling within this provision. See FCRA § 603(d)(2)(A)(iii), 15 U.S.C. § 1681a(d)(2)(A)(iii).

The Ninth Circuit therefore rejected the argument that the FCRA preempts CalFIPA’s affiliate-sharing provisions in their entirety. Instead, CalFIPA remains applicable to the extent its restrictions concern information or conduct that falls outside the scope of the FCRA’s preemption.

See American Bankers Ass’n v. Gould, 412 F.3d 1081, 1086–87 (9th Cir. 2005).

Insurance

CalFIPA establishes special rules for certain insurance producers, brokers, insurers, and related entities. Among other things, these provisions address when CalFIPA applies to licensed insurance producers and investment advisers, the use and disclosure of NPI in obtaining insurance quotes, and the sharing of NPI between insurers and certain exclusive agents.

Importantly, the exclusions provided by this section are limited. For example, even when a person or entity otherwise qualifies for an exclusion under § 4056.5, CalFIPA applies when NPI is or will be shared with an affiliate or nonaffiliated third party.

See Cal. Fin. Code § 4056.5

Obligations: Vendor Management and Downstream Use of NPI

Financial institutions must enter into specified contractual arrangements when relying on certain CalFIPA provisions to share NPI. Depending on the applicable provision, these contracts generally restrict the recipient’s ability to use or further disclose the NPI beyond the purposes for which it was provided. See the discussion of joint offerings, affinity partners, and statutory exceptions above.

CalFIPA also directly restricts entities that receive NPI from a financial institution. An entity that receives NPI under CalFIPA generally may not further disclose the information to another entity unless the disclosure would be lawful if made directly by the financial institution.

In addition, when an entity receives NPI pursuant to an exception under § 4056, it may not use or disclose the information except in the ordinary course of business to carry out the activity covered by the exception under which the information was received.

See Cal. Fin. Code § 4053.5

Enforcement

Private Cause of Action

CalFIPA does not provide a private right of action. Civil penalties under CalFIPA are exclusively assessed and recovered in a civil action brought in the name of the People of the State of California by the Attorney General or the applicable functional regulator.

This does not necessarily preclude a consumer from pursuing remedies that may be independently available under other applicable laws.

Agency Enforcement

CalFIPA may be enforced by the California Attorney General or the functional regulator with jurisdiction over the financial institution. The applicable enforcement authority depends on the type of institution:

  • For banks, savings associations, credit unions, commercial lending companies, and bank holding companies, enforcement authority rests with the California Department of Financial Protection and Innovation (DFPI), Division of Financial Institutions, or the appropriate federal authority.
  • For persons engaged in the business of insurance, enforcement authority rests with the California Department of Insurance.
  • For investment brokers or dealers, investment companies, investment advisers, residential mortgage lenders, and finance lenders, enforcement authority rests with the DFPI, Division of Corporations.
  • For a financial institution not subject to the jurisdiction of one of the functional regulators identified above, enforcement authority rests with the California Attorney General.

See Cal. Fin. Code § 4057(e). 

Civil Penalties

The applicable civil penalties depend on whether the violation was negligent or knowing and willful:

  • A negligent disclosure or sharing of NPI in violation of CalFIPA may result in a civil penalty of up to $2,500 per violation, regardless of the amount of damages suffered by the consumer. If the disclosure or sharing results in the release of NPI of more than one individual, the total civil penalty under this provision may not exceed $500,000.
  • A knowing and willful obtaining, disclosure, sharing, or use of NPI in violation of CalFIPA may result in a civil penalty of up to $2,500 per individual violation, regardless of the amount of damages suffered by the consumer.

If a violation of CalFIPA results in the identity theft of a consumer, as defined by California Penal Code § 530.5, the applicable civil penalties are doubled.

In determining the amount of a penalty, the court must consider:

  • the total assets and net worth of the violating entity;
  • the nature and seriousness of the violation;
  • the persistence of the violation, including attempts to correct the situation leading to the violation;
  • the length of time over which the violation occurred;
  • the number of times the entity has violated CalFIPA;
  • the harm caused to consumers;
  • the proceeds derived from the violation; and
  • the impact of possible penalties on the overall fiscal solvency of the violating entity.

See Cal. Fin. Code § 4057

Further Resources

Recent Amendments

  • SB 1498 (2022), Stats. 2022, ch. 452, § 105 — Amended Cal. Fin. Code § 4057, including provisions concerning enforcement of CalFIPA. The amendment became effective January 1, 2023. 
  • AB 3279 (2024), Stats. 2024, ch. 227, § 29 — Amended Cal. Fin. Code § 4056. The amendment became effective January 1, 2025. 

Government Agencies

Cases

  • American Bankers Ass’n v. Gould, 412 F.3d 1081 (9th Cir. 2005) — Leading decision addressing the interaction between CalFIPA and the FCRA and the extent to which federal law preempts CalFIPA’s restrictions on affiliate sharing.
  • Case Study: Gould & Lockyer — Discussion of the Gould litigation and FCRA preemption of particular CalFIPA affiliate-sharing restrictions.

Background and Commentary

Subscribe to The de la Torre Review

Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe