Section 1798.145 of the Civil Code lists what the California Consumer Privacy Act (enacted June 28, 2018, operative January 1, 2020, and amended by the California Privacy Rights Act from January 1, 2023) does not reach. For banks the decisive clause is subdivision (e): the Act does not apply to personal information collected, processed, sold or disclosed subject to the federal Gramm-Leach-Bliley Act and its implementing regulations, the California Financial Information Privacy Act, or the federal Farm Credit Act. The exemption follows the information, not the institution — a bank is inside the CCPA for everything GLBA does not cover, and since the CPRA ended the employee and business-contact exemptions on January 1, 2023, that includes all HR and applicant data.
OFFICIAL TEXT: leginfo.legislature.ca.gov ↗ · IN FORCE · STATE OF CALIFORNIA
| Document | Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data) — California Consumer Privacy Act — exemptions, including the data-level exemption for information subject to the Gramm-Leach-Bliley Act and the California Financial Information Privacy Act (Civil Code §1798.145) |
| Issued by | State of California — California Privacy Protection Agency (CCPA/CPRA automated decisionmaking, risk-assessment and cybersecurity-audit regulations), Attorney General and other public prosecutors (CCPA, SB 53, AB 1609 chatbot law), Civil Rights Council (FEHA automated-decision-system regulations), and Labor Commissioner (SB 947 'No Robo Bosses Act') |
| Type | Statute |
| Status | In force |
| Published | Jun 28, 2018 |
| Effective | Jan 1, 2020 |
| Applies to | Every business subject to the CCPA; the provision that determines how much of a bank's data — and therefore of its AI — the statute and the ADMT regulations reach |
| Official source | leginfo.legislature.ca.gov ↗ |
| Use cases | Data & privacy · Credit scoring & underwriting · AI governance (general) |
What are the key points of Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data)?
- Data-level, not entity-level: the same bank is outside the CCPA for GLBA-covered customer information and inside it for employee, applicant, prospect and marketing data
- The GLBA exemption does not extend to the CCPA's data-breach private right of action (§1798.150)
- Employee and applicant data lost its exemption on January 1, 2023 under the CPRA, bringing hiring and compensation — themselves 'significant decisions' — fully inside the statute and the ADMT regulations
- The CPPA relied on this subdivision when it declined, in the 2025 Final Statement of Reasons, to add a separate financial-institution exemption to the ADMT regulations
- Other subdivisions preserve compliance with federal, state and local law, legal process, and cooperation with law enforcement — the basis on which fraud and AML processing continues unaffected
What did Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data) change for banks?
Nothing in the text has changed since 2023; what changed is its load-bearing role. Once the ADMT regulations listed lending as a significant decision, §1798.145(e) became the provision that decides whether a bank's credit model is regulated by California at all.
Are banks exempt from the CCPA?
No. Only personal information subject to GLBA, the California Financial Information Privacy Act or the Farm Credit Act is exempt. A bank must comply for all other personal information it holds, including employee and applicant data.
Why does the GLBA exemption matter for AI?
Because the CPPA's ADMT regulations apply to 'significant decisions' including lending, and the only reason most bank credit models fall outside them is that the underlying data is GLBA-covered. Models using non-GLBA data are inside.
| Date | Document | Status |
|---|---|---|
| Sep 30, 2026 | SB 947 — Employment: Automated Decision Systems (No Robo Bosses Act) | Final |
| Sep 28, 2026 | AB 1609 — Customer Service Chatbots (Right to Human Customer Service Act) | Final |
| Sep 29, 2025 | California SB 53 (Transparency in Frontier AI Act) — Senate Bill 53: Artificial intelligence models: large developers (Transparency in Frontier Artificial Intelligence Act), Chapter 138, Statutes of 2025 | In force |
| Sep 22, 2025 | CPPA ADMT, risk-assessment and cybersecurity-audit regulations — CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Companies — approved regulation text (11 CCR Division 6) | In force |
| Jun 27, 2025 | Civil Rights Council ADS employment regulations — Modifications to Employment Regulations Regarding Automated-Decision Systems (Fair Employment and Housing Act regulations, 2 CCR) | In force |
| Jan 13, 2025 | California AG legal advisory on AI (Jan 2025) — Legal Advisory: Application of Existing California Laws to Artificial Intelligence | Final |
Follow every document these regulators publish
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning