# Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data): California Consumer Privacy Act — exemptions, including the data-level exemption for information subject to the Gramm-Leach-Bliley Act and the California Financial Information Privacy Act (Civil Code §1798.145)

Source: https://www.bankingnewsai.com/ai-regulation/documents/ca-civil-code-1798-145
Last updated: Sep 1, 2026

Section 1798.145 of the Civil Code lists what the California Consumer Privacy Act (enacted June 28, 2018, operative January 1, 2020, and amended by the California Privacy Rights Act from January 1, 2023) does not reach. For banks the decisive clause is subdivision (e): the Act does not apply to personal information collected, processed, sold or disclosed subject to the federal Gramm-Leach-Bliley Act and its implementing regulations, the California Financial Information Privacy Act, or the federal Farm Credit Act. The exemption follows the information, not the institution — a bank is inside the CCPA for everything GLBA does not cover, and since the CPRA ended the employee and business-contact exemptions on January 1, 2023, that includes all HR and applicant data.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [State of California](https://www.bankingnewsai.com/ai-regulation/california) |
| Type | Statute |
| Status | In force |
| Published | Jun 28, 2018 |
| Effective | Jan 1, 2020 |
| Applies to | Every business subject to the CCPA; the provision that determines how much of a bank's data — and therefore of its AI — the statute and the ADMT regulations reach |
| Official text | https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.145.&lawCode=CIV |

## Key points

- Data-level, not entity-level: the same bank is outside the CCPA for GLBA-covered customer information and inside it for employee, applicant, prospect and marketing data
- The GLBA exemption does not extend to the CCPA's data-breach private right of action (§1798.150)
- Employee and applicant data lost its exemption on January 1, 2023 under the CPRA, bringing hiring and compensation — themselves 'significant decisions' — fully inside the statute and the ADMT regulations
- The CPPA relied on this subdivision when it declined, in the 2025 Final Statement of Reasons, to add a separate financial-institution exemption to the ADMT regulations
- Other subdivisions preserve compliance with federal, state and local law, legal process, and cooperation with law enforcement — the basis on which fraud and AML processing continues unaffected

## What changed for banks

Nothing in the text has changed since 2023; what changed is its load-bearing role. Once the ADMT regulations listed lending as a significant decision, §1798.145(e) became the provision that decides whether a bank's credit model is regulated by California at all.

## Use cases it governs

- [Data & privacy](https://www.bankingnewsai.com/ai-regulation/by-use-case#data-privacy)
- [Credit scoring & underwriting](https://www.bankingnewsai.com/ai-regulation/by-use-case#credit-underwriting)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)

## FAQ

### Are banks exempt from the CCPA?

No. Only personal information subject to GLBA, the California Financial Information Privacy Act or the Farm Credit Act is exempt. A bank must comply for all other personal information it holds, including employee and applicant data.

### Why does the GLBA exemption matter for AI?

Because the CPPA's ADMT regulations apply to 'significant decisions' including lending, and the only reason most bank credit models fall outside them is that the underlying data is GLBA-covered. Models using non-GLBA data are inside.

## Related documents

- [SB 947](https://www.bankingnewsai.com/ai-regulation/documents/ca-sb-947-2026) — Employment: Automated Decision Systems (No Robo Bosses Act) (Sep 30, 2026)
- [AB 1609](https://www.bankingnewsai.com/ai-regulation/documents/ca-ab-1609-2026) — Customer Service Chatbots (Right to Human Customer Service Act) (Sep 28, 2026)
- [California SB 53 (Transparency in Frontier AI Act)](https://www.bankingnewsai.com/ai-regulation/documents/ca-sb-53-2025) — Senate Bill 53: Artificial intelligence models: large developers (Transparency in Frontier Artificial Intelligence Act), Chapter 138, Statutes of 2025 (Sep 29, 2025)
- [CPPA ADMT, risk-assessment and cybersecurity-audit regulations](https://www.bankingnewsai.com/ai-regulation/documents/ca-cppa-admt-risk-cyber-regulations-2025) — CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Companies — approved regulation text (11 CCR Division 6) (Sep 22, 2025)
- [Civil Rights Council ADS employment regulations](https://www.bankingnewsai.com/ai-regulation/documents/ca-crc-ads-employment-regulations-2025) — Modifications to Employment Regulations Regarding Automated-Decision Systems (Fair Employment and Housing Act regulations, 2 CCR) (Jun 27, 2025)
- [California AG legal advisory on AI (Jan 2025)](https://www.bankingnewsai.com/ai-regulation/documents/ca-ag-legal-advisory-ai-2025) — Legal Advisory: Application of Existing California Laws to Artificial Intelligence (Jan 13, 2025)
- [FSB AI sound practices (final report, Oct 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-ai-sound-practices-2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report (Oct 15, 2026)
- [PDPC Advisory Guidelines on Personal Data in Generative AI](https://www.bankingnewsai.com/ai-regulation/documents/pdpc-advisory-guidelines-generative-ai-2026) — Advisory Guidelines on Use of Personal Data in Generative AI (Jul 20, 2026)

Last reviewed Sep 1, 2026. Cite the official text (https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.145.&lawCode=CIV) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/ca-civil-code-1798-145
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (45 authorities, 260 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.