Section 1798.145 of the Civil Code lists what the California Consumer Privacy Act (enacted June 28, 2018, operative January 1, 2020, and amended by the California Privacy Rights Act from January 1, 2023) does not reach. For banks the decisive clause is subdivision (e): the Act does not apply to personal information collected, processed, sold or disclosed subject to the federal Gramm-Leach-Bliley Act and its implementing regulations, the California Financial Information Privacy Act, or the federal Farm Credit Act. The exemption follows the information, not the institution — a bank is inside the CCPA for everything GLBA does not cover, and since the CPRA ended the employee and business-contact exemptions on January 1, 2023, that includes all HR and applicant data.
| Document | Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data) — California Consumer Privacy Act — exemptions, including the data-level exemption for information subject to the Gramm-Leach-Bliley Act and the California Financial Information Privacy Act (Civil Code §1798.145) |
| Issued by | California — Privacy Protection Agency (CCPA/CPRA automated decisionmaking, risk-assessment and cybersecurity-audit regulations), Attorney General, and Civil Rights Council |
| Type | Statute |
| Status | In force |
| Published | Jun 28, 2018 |
| Effective | Jan 1, 2020 |
| Applies to | Every business subject to the CCPA; the provision that determines how much of a bank's data — and therefore of its AI — the statute and the ADMT regulations reach |
| Official source | leginfo.legislature.ca.gov ↗ |
| Use cases | Data & privacy · Credit scoring & underwriting · AI governance (general) |
What are the key points of Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data)?
- Data-level, not entity-level: the same bank is outside the CCPA for GLBA-covered customer information and inside it for employee, applicant, prospect and marketing data
- The GLBA exemption does not extend to the CCPA's data-breach private right of action (§1798.150)
- Employee and applicant data lost its exemption on January 1, 2023 under the CPRA, bringing hiring and compensation — themselves 'significant decisions' — fully inside the statute and the ADMT regulations
- The CPPA relied on this subdivision when it declined, in the 2025 Final Statement of Reasons, to add a separate financial-institution exemption to the ADMT regulations
- Other subdivisions preserve compliance with federal, state and local law, legal process, and cooperation with law enforcement — the basis on which fraud and AML processing continues unaffected
What did Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data) change for banks?
Nothing in the text has changed since 2023; what changed is its load-bearing role. Once the ADMT regulations listed lending as a significant decision, §1798.145(e) became the provision that decides whether a bank's credit model is regulated by California at all.
Are banks exempt from the CCPA?
No. Only personal information subject to GLBA, the California Financial Information Privacy Act or the Farm Credit Act is exempt. A bank must comply for all other personal information it holds, including employee and applicant data.
Why does the GLBA exemption matter for AI?
Because the CPPA's ADMT regulations apply to 'significant decisions' including lending, and the only reason most bank credit models fall outside them is that the underlying data is GLBA-covered. Models using non-GLBA data are inside.
| Date | Document | Status |
|---|---|---|
| Sep 22, 2025 | CPPA ADMT, risk-assessment and cybersecurity-audit regulations — CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Companies — approved regulation text (11 CCR Division 6) | In force |
| Jun 27, 2025 | Civil Rights Council ADS employment regulations — Modifications to Employment Regulations Regarding Automated-Decision Systems (Fair Employment and Housing Act regulations, 2 CCR) | In force |
| Jan 13, 2025 | California AG legal advisory on AI (Jan 2025) — Legal Advisory: Application of Existing California Laws to Artificial Intelligence | Final |
| Jun 10, 2026 | FSB AI sound practices consultation (June 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report | Proposed |
| Aug 1, 2025 | NCUA Credit Union AI Resource Center — Artificial Intelligence (AI) — Credit Union AI Resource Center and AI Resources page | In force |
| Jun 18, 2025 | Johnson RegHub Summit Remarks (Jun 2025) — Keynote Remarks of Commissioner Kristin N. Johnson at RegHub Summit London 2025: Enabling AI Tools To Enhance Compliance and Surveillance | Final |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →