Mark I. Lee ⚡

(JDSUPRA) California is once again at the forefront of privacy regulation, this time with a sharp focus on the insurance sector. California’s proposed Senate Bill 354, styled as the Insurance Consumer Privacy Protection Act of 2025 (the “ICPP Act” or the “Act”), would, if enacted, introduce an augmented privacy regime for the insurance sector. Its advocates claim the ICPP Act goes beyond the protections found in California’s current consumer privacy laws, including the California Insurance Information and Privacy Protection Act (the “IIPPA”) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”). What You Need To Know 🔹 A proposed California law is poised to increase the state insurance market’s transparency and accountability. 🔹 The Insurance Consumer Privacy Protection Act would impact tech companies who provide services to insurers, because it applies to insurance licensees and their third-party service providers. 🔹 Tech companies in this space should consider reviewing policies for clear and conspicuous privacy notices, consumer consent, data minimization and retention, oversight of third-party service providers, prohibition on the sale of personal information, and consumer rights. Overview of Senate Bill 354 #California #ICPPAct #Bill354 #privatedata #Buckler https://lnkd.in/emKDABAM

1

Earlier this month, the California Senate unanimously passed Senate Bill 690 (SB 690) in a 35-0 vote, a strong show of support for reining in a flood of lawsuits that have taken many companies by surprise over the last few years. The bill now heads to the California Assembly, where it will face further scrutiny. If ultimately signed into law, SB 690 could reshape how privacy law is enforced in the digital space, offering much-needed clarity (and relief) for businesses across the country. To learn more, read Kathryn Rattigan's latest in our Data Privacy + Cybersecurity Insider. https://lnkd.in/eGKFU5KG #California #privacylaw #CIPA

2

📣 Big news from California. The CPPA has unanimously adopted its proposed privacy regulations. These updates will strengthen Californians' privacy rights. Learn what this means for businesses operating in the state. Read more https://lnkd.in/dYuPJmQj #CPPA

1

Get the breakdown from #BigID's Sarah Hospelhorn in IAPP on what the Tractor Supply Company's CCPA decision means for retailers. BigID helps teams honor GPC by default, fix opt-out paths, audit tags and SDKs, tie consent to downstream tools, and keep the receipts. #BigIDNext #CCPA #CPRA #PrivacyEnforcement #FromConsentToControl

6

The 23andMe saga is likely to accelerate an ongoing trend of smaller companies and startups proactively securing broader data permissions and explicitly delineating how consumer data will be treated in a sale or merger. “Traditionally … startups, they weren't putting as much money into privacy compliance,” said Tyler Thompson, a partner at Reed Smith. “We're starting to see folks realize … going through the diligence process to get an exit or to get additional funding, these data issues, privacy, security are starting to hold that up.” Events like the 23andMe bankruptcy, where a potential asset sale can be complicated by the lack of data privacy and monetization policies sough by the acquiring party, have served to catalyze the change, and placed a particular emphasis on how personal data will be treated in any sale process. While many asset sales do not rise to the level of public attention the 23andMe bankruptcy has attracted, companies and lawyers have seen more sales, investments and bankruptcy processes held up and prices impacted due to privacy policies and consents. While federal bankruptcy law and state-level privacy laws do address how data protections should be maintained in sale processes, the lack of clarity in these laws puts the onus on companies to craft and uphold polices on their own. Full story from Benjamin Joyner: https://lnkd.in/e_cxmPt6

4

The #FTC issued new guidance clarifying that responsibly implemented age verification tools – used solely to determine a user’s age and subject to strict data safeguards – will not automatically trigger #COPPA enforcement for general and mixed audience services. The policy provides clearer direction for businesses navigating children’s privacy requirements. Read this Privacy, Cyber & Data Strategy blog post for key takeaways and what it means for your organization. https://bit.ly/3NsG0rx

8