Do new state privacy laws apply to GLBA-covered firms?

Does the GLBA exemption keep your firm out of state privacy laws?

It depends on the state. Some state privacy laws apply the GLBA exemption to a covered financial institution as a whole. Others exempt only the data that is handled under GLBA, which leaves the firm's other personal data in scope. The second approach is spreading, so "we're covered by GLBA" is no longer a complete answer for an adviser, broker-dealer or insurance agency.

The distinction matters because GLBA protects a defined slice of information. Under 15 U.S.C. 6809, nonpublic personal information is personally identifiable financial information about consumers, and a consumer is an individual who obtains financial products or services from a financial institution primarily for personal, family or household purposes. A great deal of the personal data a firm holds does not fit that definition.

Which state privacy laws take effect in January 2027?

Two new comprehensive laws take effect January 1, 2027, and both take the entity-level approach for financial institutions.

• Oklahoma's Senate Bill 546 applies to businesses that control or process personal data of at least 100,000 Oklahoma consumers, or at least 25,000 while deriving more than half of gross revenue from selling personal data. It exempts financial institutions subject to Title V of GLBA as well as data subject to GLBA. The Attorney General enforces it, with a 30-day right to cure.
• Louisiana's Senate Bill 386, the Louisiana Data Privacy Act, was signed May 29, 2026. It applies to businesses with annual gross revenue above $25 million, or that process personal data of 75,000 or more consumers, households or devices, or that derive 50% or more of revenue from selling personal data. It exempts financial institutions and their affiliates governed by GLBA.

For most small and mid-sized financial firms, neither law will change much. Few hold data on 75,000 or 100,000 residents of either state, and the entity-level exemption applies on top of that. The bigger story is in the states that went the other way.

Where has the GLBA entity exemption already ended?

In California, which never had one, and in Oregon for firms that are not banks or insurers. Connecticut narrowed its exemption on July 1, 2026, but kept it for SEC- and state-regulated advisers and broker-dealers.

California never had an entity exemption. Civil Code section 1798.145(e) exempts personal information collected, processed, sold or disclosed subject to GLBA. It exempts data, not companies, and it does not apply to the private right of action for data breaches in section 1798.150. A financial firm that meets the CCPA's definition of a business, which turns largely on a revenue threshold the California Privacy Protection Agency adjusts for inflation, owes CCPA obligations for its non-GLBA data. Our earlier article on the CCPA GLBA exemption walks through that analysis for California firms.

Oregon's law exempts financial institutions as defined in Oregon banking law, plus certain insurers, insurance producers and insurance consultants. For everyone else, GLBA is a data-level exclusion. The Oregon Department of Justice FAQ says the law "does not apply to certain types of personal data maintained in compliance with specific federal privacy laws," and lists GLBA among them. An investment adviser or broker-dealer is not a bank, so only its GLBA data sits outside the Oregon law. Oregon also excludes employee and job applicant data.

Connecticut changed its law effective July 1, 2026. According to the Office of Legislative Research summary of Public Act 25-113, the act removes financial institutions subject to GLBA from the list of exempt entities. It keeps entity-level exemptions for certain banks and credit unions, insurers, insurance agents and producers, and broker-dealers, investment advisers and their agents regulated by the Connecticut Department of Banking or the SEC. Other GLBA-covered businesses, such as tax preparers and non-bank lenders, lost the blanket exemption. The same act lowered the main applicability threshold to 35,000 consumers and added a trigger with no consumer count for any business that controls or processes consumers' sensitive data.

What personal data falls outside GLBA?

Anything that is not nonpublic personal information about a consumer. For a typical advisory firm, broker-dealer or insurance agency, that includes:

• Employee and job applicant data.
• Business contacts at institutional clients, custodians, vendors and referral partners.
• Website visitor data collected through analytics, cookies and tracking pixels, before or without any financial relationship.
• Newsletter subscribers, event registrants and webinar attendees who never obtained a financial product or service.
• Marketing lists and enrichment data bought from third parties.

These are the records a data-level state law can reach, and most firms never mapped them because the privacy program was built around client accounts. California's law covers all of them, including employee and business contact data. Other states, such as Oregon, exclude employee and job applicant data, so check each law's definition of consumer.

Why does this matter if your firm is in California?

Because California already applies the data-level model, and your clients and staff may live elsewhere. A Los Angeles or Orange County firm that meets the CCPA business definition has to handle employee, applicant, website and business contact data under the CCPA today. Our guide to the CCPA employee privacy notice covers the HR side. As more states adopt data-level exemptions, the same data map serves each of them.

Applicability is set state by state, usually by counting residents of that state. A firm with clients or website visitors in Oregon or Connecticut should check each law's thresholds, exemption type and definition of consumer rather than assume one answer covers all states. This article describes what the laws say. Whether a specific law applies to your firm is a question for counsel.

What should you do this quarter?

• List the states where your clients, employees and website visitors live, using CRM, payroll and analytics data.
• For each state with a comprehensive privacy law, record whether the GLBA exemption is entity-level or data-level, and the applicability thresholds.
• Map your non-GLBA personal data: HR systems, marketing platforms, website tools, event and webinar platforms, and purchased lists.
• Review your website's privacy notice, cookie banner and handling of opt-out preference signals against the California rules first.
• Check vendor contracts for marketing and HR platforms, which often hold the non-GLBA data.
• Put a date on the calendar to revisit the list. Connecticut's 2025 amendments show these exemptions can change after a law takes effect.

How can s90 help?

s90 helps financial firms find where personal data lives across Microsoft 365, CRM, HR and marketing systems, and keeps that inventory current as part of managed IT. That map supports your GLBA program and any state privacy law that reaches your non-GLBA data. If you are not sure which of your systems hold data outside GLBA, we can help you find out.