Does the CCPA GLBA exemption cover your whole firm?

Many RIAs, broker-dealers, insurance agencies and family offices file the California Consumer Privacy Act (CCPA) under "doesn't apply to us" because of the CCPA GLBA exemption for data covered by the Gramm-Leach-Bliley Act. The exemption is real, and it is narrower than that. It follows the data, so a firm that meets the CCPA's business definition still has California obligations for everything GLBA does not reach.

What does the CCPA's GLBA exemption actually cover?

It covers personal information, not firms. Civil Code section 1798.145(e) says the CCPA "shall not apply to personal information collected, processed, sold, or disclosed subject to the federal Gramm-Leach-Bliley Act" and its implementing regulations, or the California Financial Information Privacy Act.

For an SEC-registered adviser or a broker-dealer, the implementing regulation is usually Regulation S-P. Client account data, financial details and the records you keep to service an account are typically handled under GLBA, so the CCPA's consumer rights do not attach to them. Nothing in the subdivision exempts a company as a whole. The same section ends with a sentence that matters a great deal: "This subdivision shall not apply to Section 1798.150," the data breach lawsuit provision covered below.

Which data at a financial firm usually falls outside the exemption?

Anything your firm collects for a reason other than providing a financial product or service to a consumer. The common categories are:

• Employees and job applicants. The CCPA once had a separate exemption for workforce data in section 1798.145(m). By its own terms that subdivision "shall become inoperative on January 1, 2023." California employees and applicants now have CCPA rights in their personal information.
• Business contacts. The business-to-business exemption in section 1798.145(n) expired on the same date. Contact details for custodians, vendors, centers of influence and the staff of institutional clients are generally in scope.
• Website visitors. Analytics, cookies, form fills and chat logs from people who never become clients are generally not collected under GLBA.
• Prospects and marketing lists. Seminar sign-ups, newsletter subscribers and purchased lead lists usually sit outside the exemption until a person actually becomes a customer.
• Affiliates outside GLBA. A related entity that is not a GLBA financial institution cannot borrow the exemption from its affiliate.

Whether a specific data set is "subject to" GLBA is a legal question. Counsel should make that call for your firm, data set by data set.

Does the GLBA exemption block a CCPA private right of action?

No. Section 1798.150 gives a private right of action to "any consumer whose nonencrypted and nonredacted personal information" is stolen or disclosed because the business failed to maintain reasonable security. Because section 1798.145(e) carves out section 1798.150 expressly, that right reaches GLBA-covered client data too.

The CPPA's current adjusted amounts set statutory damages at "not less than $107 and not greater than $799 per consumer per incident," or actual damages if greater. For a firm with thousands of California clients, a single incident can carry a large exposure before any regulator gets involved. Encryption is the practical lever: the private right of action is tied to nonencrypted and nonredacted information.

Is your firm a "business" under the CCPA?

Only if it does business in California and meets at least one threshold in section 1798.140(d). The most common is annual gross revenue above $26,625,000, the CPPA's figure as adjusted on January 1, 2025. The others cover firms that buy, sell or share the personal information of 100,000 or more consumers, or that earn half or more of their revenue from selling or sharing it.

Revenue at advisory firms varies widely with AUM and fee schedules, so this question deserves a real answer from counsel before any other work starts. Firms under every threshold still have California's separate reasonable security duty for certain personal information under Civil Code section 1798.81.5.

What obligations apply to the data outside the exemption?

The full CCPA, for that data. In practice, a covered financial firm needs to handle the following for employees, applicants, business contacts, website visitors and prospects:

• Notices. A privacy policy and a notice at collection that describe the categories of personal information the firm collects and why.
• Consumer requests. A working process to receive, verify and answer requests to know, delete and correct, and to opt out of selling or sharing.
• Website tracking. A review of cookies, pixels and analytics tools, because sharing visitor data for cross-context advertising is treated as "sharing" under the CCPA.
• Automated decisions. Tools that make significant employment decisions fall under the CPPA's automated decisionmaking technology (ADMT) rules starting January 1, 2027. Our ADMT explainer covers that deadline.
• Risk assessments and audits. The CPPA's 2025 regulations took effect January 1, 2026. Businesses whose processing triggers a risk assessment must submit an attestation and summary by April 1, 2028. Businesses required to complete a cybersecurity audit certify it on a schedule tied to revenue: April 1, 2028 above $100 million, April 1, 2029 between $50 million and $100 million, and April 1, 2030 below $50 million.

What is the exposure if a firm gets this wrong?

Two kinds. The CPPA can impose administrative fines of up to $2,663 per violation and $7,988 per intentional violation, as adjusted January 1, 2025, and the Attorney General can bring civil enforcement actions. Separately, consumers can sue under section 1798.150 after a qualifying breach, including a breach of client data the firm thought was fully exempt.

There is also an exam-day cost. An SEC examiner reviewing your Reg S-P program and a California regulator reviewing your CCPA program are likely to start from the same place: a current map of what personal information you hold, where it lives and who can reach it. The same map feeds the annual review of your Reg S-P incident response program.

What should a firm do this quarter?

Start with a data map, since every other step depends on knowing which records fall on which side of the exemption.

• Confirm coverage. Ask counsel whether the firm meets a section 1798.140(d) threshold, and whether any affiliate does.
• Split the data. List each system and record set, then tag it as GLBA-covered client data or non-GLBA data. HR, recruiting, CRM prospect fields, marketing platforms and website analytics usually land on the non-GLBA side.
• Check encryption. Confirm client data is encrypted at rest and in transit, including backups, laptops and file shares. That control matters under Reg S-P and under section 1798.150.
• Review the website. Inventory cookies and tracking pixels and decide, with counsel, whether any of them count as selling or sharing.
• Update notices. Refresh the privacy policy and the employee and applicant notice at collection so they match what the firm actually collects.
• Test request handling. Send a test request through each channel the firm lists and time the response.
• Write it down. Keep a dated record of the coverage decision, the data map and who approved each.

This article describes what the CCPA and its regulations say. It is not legal advice, and whether a particular data set is exempt depends on facts your counsel should review.

How s90 helps

s90 is a compliance-focused managed IT provider for financial firms in Los Angeles and Orange County. We help firms build the system-by-system data map that both a CCPA review and a Reg S-P exam depend on, confirm encryption and access controls on the systems that hold client data, and keep the records counsel needs to make the exemption call. If you would like help separating your GLBA data from everything else, we are glad to start there.