California Financial Information Privacy Act

CalFIPA

Financial

California's stricter counterpart to the federal Gramm-Leach-Bliley Act. Financial institutions need a consumer's explicit opt-in consent before sharing nonpublic personal information with nonaffiliated third parties, and must give consumers a chance to opt out of certain affiliate and joint-marketing sharing.

Where: California
Citation: Cal. Fin. Code 4050-4060
Status: In force
In force since: 2004-07-01
Last amended: 2023-01-01
Enforced by: California Attorney General, Department of Financial Protection and Innovation, Department of Insurance
People can sue: No
Penalties: Civil penalty up to $2,500 per violation (negligent violations capped at $500,000 per incident), doubled if the violation leads to identity theft; recoverable only by the AG or functional regulator (4057).
Applies to: Financial institutions (as defined by GLBA) doing business in California, regarding California consumers' nonpublic personal information

What a privacy notice must say

Use the prescribed consent and opt-out forms and notices before sharing.Cal. Fin. Code 4053

Practices it requires

Do not sell, share, transfer, or disclose nonpublic personal information to nonaffiliated third parties without the consumer's explicit prior consent, except as listed.Cal. Fin. Code 4052.5
Give consumers the opportunity to opt out of sharing with affiliates and with financial institutions under joint marketing agreements, as specified.Cal. Fin. Code 4053

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: $500,000 per-incident cap for negligent violations is from background knowledge; the fetched 4057 text was truncated at that point. | Affiliate-sharing opt-out was partly held preempted by FCRA (American Bankers Ass'n v. Lockyer, 9th Cir. 2008); not re-verified. | 4053 text not read (page parse failed); subdivision cites omitted.

Research reference, not legal advice.