Who protects your insurance data: GLBA, state acts and your rights

No single law protects your auto insurance data. A federal law, the Gramm-Leach-Bliley Act (GLBA), requires insurers to give you a privacy notice, protect your records and let you opt out of some sharing. A separate federal credit-reporting law governs reports like CLUE. Beyond that, your rights to see and correct what an insurer holds depend on your state: some have an insurance information and privacy protection act, and some have a broader consumer privacy law that may or may not reach insurers.

This article sorts those layers, shows what each one gives you in practice, covers the special problem of telematics and connected-car data, and ends with steps to request your records and file a complaint. Everything here is general information as of November 2026; the statute in your state controls.

The layers at a glance

Think of five overlapping sets of rules. Each covers a different slice of the data, and none covers everything.

GLBA: notice, opt-out and safeguards

The Gramm-Leach-Bliley Act of 1999 treats insurers as financial institutions. In its opening provision, 15 U.S.C. 6801, Congress states that each financial institution has "an affirmative and continuing obligation" to respect customers' privacy and protect the security and confidentiality of their nonpublic personal information. It also directs regulators to set standards for administrative, technical and physical safeguards.

Three duties matter to a policyholder.

A privacy notice. Under 15 U.S.C. 6803, when a customer relationship starts and at least annually afterward, the institution must give a clear disclosure of its policies on sharing nonpublic personal information with affiliates and nonaffiliated third parties, the categories of information it collects, and how it protects that information. An exception lets an institution skip the annual notice if it shares information only in the ways the law permits without an opt-out and has not changed its practices since the last notice. Your insurer's notice is usually a page in the policy packet or a link on the website; read it once and look for the list of who receives your data.

An opt-out for some sharing. Section 6802 bars an institution from disclosing nonpublic personal information to a nonaffiliated third party unless it first discloses the practice and gives you a chance to direct that the information not be shared, with an explanation of how. The word "nonaffiliated" matters: the opt-out is about outside companies, not the insurer's own family of companies.

Broad exceptions. The same section lists situations where sharing is allowed without an opt-out. They include disclosures needed to process a transaction you requested, disclosures made with your consent or at your direction, protecting against fraud or claims-related liability, sharing with insurance rate advisory organizations and guaranty funds, and disclosure to a consumer reporting agency in accordance with the FCRA. That last exception explains why opting out of marketing sharing does not stop your insurer from reporting claims to the databases that feed CLUE. Opt-outs are real but narrow.

Enforcement against insurers is assigned by 15 U.S.C. 6805 to the state insurance authority of the state where the insurer is domiciled, not to the Federal Trade Commission. That is why the model rules for insurers come from the National Association of Insurance Commissioners (NAIC). The NAIC's own request form for revising its privacy models explains that its Model #672, the Privacy of Consumer Financial and Health Information Regulation, is the regulation adopted in response to GLBA.

What GLBA does not do, in the provisions covered here, is give you a general right to see your file. Notice, opt-out and safeguards are about how data moves, not about your access to it. That right comes from the other layers.

State insurance information and privacy acts

The NAIC wrote an Insurance Information and Privacy Protection Model Act (#670) that some states enacted before GLBA. The NAIC's Fall 2021 state page for the model lists statutes based on it, some from older versions, in states including Arizona, California, Georgia, Illinois, Massachusetts, New Jersey, North Carolina, Ohio, Oregon and Virginia, and shows no current activity for many other states. That page is dated, so confirm your state's current law with your state department of insurance.

Where one exists, the act gives specific rights. California's version, as published on California.Public.Law, is a good illustration of the structure:

• Access (section 791.08). After a written request and proper identification, an insurer, agent or insurance-support organization has 30 business days to tell you the nature and substance of the recorded personal information, let you see and copy it, disclose to whom it disclosed the information in the prior two years, and summarize how to request a correction.
• Correction (section 791.09). Within 30 business days of a written request, the entity must correct, amend or delete the disputed information, or tell you it refuses, why, and that you may file a statement of disagreement. A statement you file must travel with the disputed information in later disclosures.
• Reasons for an adverse decision (section 791.10). After an adverse underwriting decision, the insurer must give you the specific reasons in writing, or tell you that you can request them. If you ask in writing within 90 business days, it must provide the reasons, the specific items of information that support them and the names of the institutional sources within 21 business days, with some exceptions such as suspected fraud.

These are California's deadlines and exceptions, and other states differ on every number. If you live in a state with an act, its access and correction rights can reach an insurer's underwriting file. If you do not, you are relying on the layers below and on the insurer's voluntary policies. The NAIC's own working group has concluded that these models, adopted decades ago, need revision. Its page says the group is charged with drafting a new or revised privacy model to replace or update Models #670 and #672, and lists a "Revised Model 672" full draft dated July 24, 2026 as exposed for comment, with a session on the agenda for the NAIC's Fall National Meeting on November 16, 2026. A draft is not law; nothing changes for a policyholder until a state enacts it.

Credit-reporting law: CLUE and driving reports

Insurers rely on outside databases. The best known is the CLUE report, a record of prior insurance claims. The federal Fair Credit Reporting Act applies when an insurer buys such a report to decide on coverage or price. Two features are the most useful to a driver.

First, the definition of "adverse action" in 15 U.S.C. 1681a includes an increase in any charge for insurance, or a reduction or other adverse change in its terms, in connection with underwriting. Second, section 1681m requires the company that takes an adverse action based in whole or in part on information in a consumer report to tell you, give you the name, address and telephone number of the reporting agency, state that the agency did not make the decision, and tell you of your right to a free copy and to dispute errors. Under section 1681j, the agency must provide the disclosure without charge if you ask within 60 days of receiving that notice.

The Consumer Financial Protection Bureau's list of consumer reporting companies, current as of January 2025, includes a "personal property insurance" category. It names LexisNexis C.L.U.E. & Telematics OnDemand and the Insurance Information Exchange (iiX), and says some of these companies may also share driving behavior data from phones or vehicles with auto insurers. Our guides Your CLUE report and motor vehicle record explained and adverse action notices: what an insurer must tell you about a rate cover how to request and read these.

State comprehensive privacy laws and insurance data

Since California led in 2020, roughly 19 states had passed comprehensive consumer privacy laws by mid-2025, according to a July 2025 analysis by the law firm Orrick. These laws give residents rights to know, access, delete, correct and opt out of certain uses of personal data. For insurers the question is the exemption. Orrick explains that most of these laws have two GLBA carve-outs: an entity-level exemption for financial institutions, which removes insurers from most of the law, and a data-level exemption for nonpublic personal information as GLBA defines it.

Orrick also reports a shift. California's law has never had an entity-level GLBA exemption, only the data-level one. As of that July 2025 analysis, Connecticut and Montana were amending theirs to remove the entity-level exemption effective October 1, 2025, and Minnesota's law, effective July 31, 2025, has a data-level exemption. In those states an insurer may have to honor privacy requests for data that is not GLBA nonpublic personal information, such as website or marketing data not tied to providing the policy, while policy and claims data stay outside the law.

The practical result is a patchwork. Depending on where you live, a request to "delete my data" may reach the insurer's marketing files but not your underwriting file, or may not reach the insurer at all. Check the insurer's state privacy page and your state attorney general's site, and see how your state department treats the question.

Telematics and connected-car data: the weak spot

Driving data is where the layers fit worst. A telematics program you enroll in is a product you chose, with a consent screen and program terms, so the insurer's own collection falls under its privacy notice and your enrollment agreement. Our guide what driving apps collect and how insurers use it covers what apps and plug-in devices record, and which states restrict telematics surcharges or data use covers state restrictions on using the data in pricing.

The harder case is data you never agreed to give an insurer. Two cases show how that occurred.

Automaker data. In a final order announced January 14, 2026 and approved 2-0, the Federal Trade Commission bars General Motors from disclosing geolocation and driver behavior data to consumer reporting agencies for five years. It also requires affirmative express consent before collecting, using or sharing connected-vehicle data for 20 years, subject to exceptions such as emergency response, and requires a way for consumers to request a copy of their data and its deletion. The order binds General Motors; it does not set rules for other automakers or for insurers.

App data. In January 2025, the Texas attorney general sued Allstate and its data analytics subsidiary Arity under the Texas Data Privacy and Security Act, alleging that Arity paid mobile apps to install its software, collected driving data from more than 45 million people, and that the data was used to justify premium increases, according to Insurance Business. Allstate denied the allegations and said Arity helps consumers get more accurate pricing through a transparent process that complies with the law. These are allegations, not findings. The case matters here because it shows a state using a comprehensive privacy law against a data pipeline that insurance-specific rules had not clearly reached. The legal fights are tracked in driving data privacy lawsuits, and the data flows in connected-car data, data brokers and your premium.

How to use your rights

1. Read the privacy notice. Find the section on sharing with nonaffiliated companies and the instructions for opting out, which may be a phone number, web form or mail-in slip.
2. Opt out where it is offered. Do it in writing and keep a copy. Remember the exceptions: reporting to the claims databases and processing your policy will continue.
3. Request your file. Send a written request to the insurer, identifying yourself and describing what you want: underwriting file, claims file, telematics records. In a state with an insurance information act, cite it. In other states, ask anyway.
4. Request your consumer reports. Order your CLUE and driving-data reports from the reporting companies the CFPB lists. Request them free after an adverse action notice, within 60 days.
5. Dispute errors in writing. Identify the item, explain why it is wrong, attach proof, and ask for a corrected copy to be sent to anyone who received the wrong version.
6. Delete telematics data when you leave a program. Ask what is kept and for how long; see leaving a telematics program: what happens to your data and discount.

A script for the request letter:

• "Under [state act, if any] and the insurer's own policies, please provide the recorded personal information you hold about me, the sources of that information and the identities of those to whom you have disclosed it in the last two years."
• "I dispute the following item as inaccurate. Here is the evidence. Please correct it and notify anyone who received it."
• "Please tell me in writing the specific reasons for the premium increase or non-renewal, and whether any consumer report was used."

Filing a complaint

Start with the insurer's privacy office, then escalate. Complaints about an insurer's handling of your data can go to your state state department of insurance; ask whether it handles the complaint directly or refers it to the regulator in the insurer's home state, since GLBA enforcement against insurers rests with the state authority where the company is domiciled. The NAIC's page on how to file and research complaints explains that complaint data is gathered from state departments, and our guide how to file a complaint against a car insurance company lists the steps. Problems with a reporting company's accuracy can go to the CFPB or the Federal Trade Commission, and your state attorney general may take privacy complaints where a state privacy law applies. For a data breach, see after an insurer data breach: what drivers should do. For the NAIC's Insurance Data Security Model Law, the NAIC's October 2026 brief says 28 jurisdictions had implemented it; it requires insurers to keep an information security program and notify the commissioner of certain cybersecurity events.

Common questions

Can my insurer sell my data?

Not freely. GLBA requires notice and, for most disclosures to nonaffiliated third parties, a chance to opt out, but exceptions are broad, and sharing with credit-reporting agencies and service providers is allowed. Whether your state adds limits depends on its laws.

Do I have a right to see what my insurer knows about me?

In a state with an insurance information act, yes, within the act's terms. In others it depends on the insurer's policies and state privacy law. The FCRA gives you access to consumer reports the insurer buys.

Does opting out stop my CLUE report?

No. Claims reporting to a consumer reporting agency is among the exceptions to GLBA's opt-out. You can correct errors in a CLUE report through the FCRA dispute process.

Is telematics data treated like other insurance data?

It depends on how it was collected. Data from a program you joined falls under the insurer's notice and your agreement. Data gathered by an app or automaker may fall under other laws, as the FTC and Texas actions show.

Who do I call about a privacy problem?

Start with the insurer, then your state insurance department. For consumer report errors, use the reporting company and the CFPB. A licensed attorney can advise on a private claim.

Key takeaways

• GLBA gives you a privacy notice, an opt-out for some sharing with outside companies and security standards, enforced for insurers by the state insurance authority, but it has broad exceptions and no general access right.
• Rights to see and correct your file come from the FCRA for consumer reports and, in some states, an insurance information and privacy act.
• State comprehensive privacy laws often exempt GLBA-covered insurers or data, though a few states have narrowed the exemptions.
• Telematics and connected-car data can reach insurers through paths that insurance-specific rules did not anticipate, as the FTC order and the Texas lawsuit show.
• Request your records in writing, keep copies, and complain to the state insurance department when the insurer does not respond.