Exempt institution, covered data: what Proposition 24 meant for banks and hospitals

The week

On November 3, 2020, California voters approved Proposition 24, the California Privacy Rights Act, with about 56 percent voting yes. Most of them were thinking about the presidential race. Further down the ballot, under a dry title, was a measure that would reshape how thousands of companies handle personal information, including banks, hospitals and insurers that believed federal law already had them covered.

The measure amended the California Consumer Privacy Act, the state’s landmark privacy law, which had only taken effect at the start of 2020. The attorney general had begun enforcing that law on July 1, 2020, and its implementing regulations had been approved in August. In less than a year, the rules were being rewritten.

The history explains the speed. The original law grew out of a 2018 ballot initiative led by Alastair Mactaggart, a San Francisco real estate developer, which was withdrawn once the legislature passed a privacy law of its own. Mactaggart’s group then brought Proposition 24 to the 2020 ballot, in part to lock in protections that lobbying might otherwise weaken. Under its terms, the legislature may amend the law only in ways consistent with its purpose of furthering privacy.

The biggest change was institutional. The measure created the California Privacy Protection Agency, a standalone regulator with rulemaking and enforcement powers, governed by a five-member board and funded through the measure itself. California now had an agency whose only job was privacy: writing detailed rules, issuing guidance and taking action against organizations that broke them.

The measure also changed the enforcement terms. It ended the automatic 30-day period that let businesses fix a violation after notice before facing penalties. It kept fines of up to $2,500 per violation and $7,500 for intentional ones, and added the higher figure for violations involving consumers under 16.

It sharpened definitions that would matter for vendors. “Sharing” now covered disclosing data for cross-context advertising whether or not money changed hands, closing a gap that some advertising arrangements had relied on. A new category of “contractor” joined “service provider,” and both needed contracts with specific terms.

It gave Californians new rights:

• A new category of sensitive personal information, such as precise location, government identification numbers, account log-ins and health details, with a right to limit how it is used.
• A right to correct inaccurate personal data an organization holds about them.
• Rules on sharing data for cross-context behavioral advertising: the practice of tracking what someone does on one website or app and using it to target ads to them somewhere else.

It also adjusted who is covered. A for-profit business falls under the law if it meets any one of three tests: annual gross revenue above $25 million, buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half its revenue from selling or sharing personal information. The middle threshold had been 50,000 and had counted devices as well.

The measure took legal effect in mid-December 2020, once the vote was certified, but most of the new provisions became operative on January 1, 2023, giving organizations just over two years to prepare. Consumers’ right to know what a business holds would reach data collected from January 1, 2022, so the record-keeping clock started a year before the obligations did. The measure also extended, until that same date, temporary exemptions for employee data and business-to-business data, meaning information about staff and about contacts at other companies.

Not every privacy advocate supported it. Some, including the ACLU of California, opposed the measure, arguing that it left too much of the burden on consumers to opt out and allowed businesses to offer different prices tied to data use. Supporters argued that a dedicated regulator would outweigh those flaws.

For many executives in regulated industries, the news barely registered. Banks answer to federal financial privacy law; hospitals answer to federal health privacy law. Surely a California consumer measure was someone else’s problem. As the following years showed, that assumption was the most expensive part of the story.

Most commentary on Proposition 24 focused on consumer technology and advertising: social networks, app makers and the companies that track people across the web. For regulated institutions the important point was structural.

California’s privacy law does not exempt a bank or a health system as an organization. It exempts specific categories of data governed by federal law. That distinction was easy to overlook in November 2020 and grew expensive later. The change for regulated institutions has three parts: a dedicated regulator, exemptions that follow the data, and new rights that land on operations. Each plays out differently inside a bank, a hospital and a public agency.

The sections below begin with the federal laws the state law sits on top of, then take the three parts in order. They then describe how an institution builds the foundation and what is at stake in cost, risk, trust and timing. The last two sections explain why one map serves many state laws and set out questions that test whether the work is done.

Two federal laws and a state law on top

Before November 2020, privacy in the United States was mostly sector by sector. Two federal laws matter most here.

The Gramm-Leach-Bliley Act, usually called GLBA, governs how financial institutions handle the nonpublic personal information of their customers and consumers. It is why banks send privacy notices, why customers can opt out of some sharing with unaffiliated companies, and why customer account data is tightly controlled. Different regulators enforce it for different institutions: the banking agencies for banks, the National Credit Union Administration for credit unions, the Securities and Exchange Commission for broker-dealers and investment advisers, and the Federal Trade Commission for many nonbank lenders and fintechs.

HIPAA, the Health Insurance Portability and Accountability Act, governs protected health information: identifiable health data held by health plans, most health care providers and clearinghouses, which the law calls covered entities, and by the vendors that handle such data on their behalf, called business associates.

California’s consumer privacy law, in force since the start of 2020, and the amendments voters approved that November, layered a general privacy regime on top of these. The trouble lies in how the general state law meets the specific federal ones. Federal law built a few strong rooms in the house, for bank accounts and medical records. California put a lock on the whole house but left the federal rooms to their own keys, so everything outside those rooms, the hallway, the garage, the porch, now falls under California’s lock.

First, is the institution a “business” at all

One threshold question comes before the exemptions. California’s law applies to entities organized or operated for the profit or financial benefit of their owners. Many hospitals and health systems are nonprofit corporations and may fall outside that definition altogether. Their for-profit affiliates, physician groups, joint ventures and health technology subsidiaries often do not.

The amendments widened the net here. Entities that control or are controlled by a covered business and share its branding can be pulled in, as can certain joint ventures between covered businesses. A nonprofit health system with a for-profit ambulatory surgery venture or a branded consumer app has to analyze each entity separately. Credit unions, as member-owned cooperatives, raise their own version of the question. Each organization needs counsel’s view of its structure before it can map its data.

Why the distinction matters

Why does the distinction matter so much? Because most organizations answer the question of whether a law applies to them once, at the top, and then stop thinking about it. A general counsel’s memo that says “as a financial institution, we are largely exempt” can shape budgets and priorities for years without anyone revisiting it. Suppose the memo is right about the bank’s core accounts but wrong about its website, its marketing and its staff records. The gap then stays invisible until a regulator, a journalist or a customer finds it.

The task is to close that gap before someone else does.

A dedicated regulator

Before the vote, enforcement of the California Consumer Privacy Act lay with the state attorney general, whose office had many other priorities. The new California Privacy Protection Agency had one job.

A dedicated regulator behaves differently from a generalist one. It writes detailed rules, issues guidance and builds expertise in how consent screens, request forms and data flows actually work. It also finds mechanics worth examining that a generalist office might skip. An office juggling consumer fraud, antitrust and criminal appeals may never look closely at the wording of a cookie banner. A privacy agency will.

Powers that keep the rules moving

The measure gave the agency rulemaking authority over topics the statute barely defined. Those included:

• Automated decision-making: when software, rather than a person, makes or heavily shapes decisions about people, such as eligibility, pricing or hiring.
• Risk assessments for processing that presents significant risk to people’s privacy or security.
• Cybersecurity audits, independent checks of whether an organization protects data as it should.

The requirements would therefore keep moving after the vote, and a compliance program built to the statute’s text in 2021 would be incomplete by design. The amendment rule reinforced that direction. Because the legislature could change the law only in ways that furthered privacy, the main route to easing requirements was effectively closed. Changes were more likely to add obligations than remove them.

Enforcement without a grace period

The end of the automatic cure period changed the economics of noncompliance. Under the original law, a business that received notice of a violation had 30 days to fix it and avoid penalties. Many organizations treated that window as a safety net. From 2023 the agency could decide whether to allow time to cure, and it was not required to.

Penalties are counted per violation, and a single flawed opt-out process can touch many consumers. The figures are modest for one person and large in aggregate. A specialist regulator can also require changes to processes, training and contracts as part of a settlement, which often cost more than the fine.

What a specialist review asks for

An inquiry from a privacy regulator looks different from a federal safety-and-soundness examination. It tends to ask for artifacts that show how the machinery works:

• The notice given at the point of collection on each website and app, and the retention periods it states.
• Logs of consumer requests, with dates received, verification steps and dates closed.
• Written procedures for verification, for authorized agents and for applying legal exceptions.
• Contracts with service providers, contractors and advertising partners that receive non-exempt data.
• An inventory of website tags and evidence of how opt-out signals are detected and honored.

An institution that can produce these quickly signals a working program. One that has to assemble them from scratch shows the regulator where to look next.

Two enforcers, not one

The attorney general kept enforcement authority alongside the new agency. That meant two offices with different priorities could look at the same organization. The attorney general’s office tended toward cases with wide public visibility; the agency could pursue detailed process failures. An institution had to be ready for either.

Watching the rulemaking

The practical consequence was a monitoring task. Someone in each institution needed to follow the agency’s rulemaking, assess each draft against the institution’s data map, and budget for changes before they were final. Leaving that to outside counsel alone risks learning about a requirement only when it is final, with little time left to change systems.

The monitoring role works best when it has a direct line to the people who own systems. A privacy analyst who reads a draft rule on risk assessments should be able to tell the head of analytics within a week which models it might reach. Comment periods are also an opportunity. Regulated institutions with specific operational concerns, such as how a federal record-keeping duty interacts with a state deletion right, can raise them while the rule can still change.

Exemptions that follow the data

The exemptions for financial and health information are the part regulated institutions most often misread.

Banks and other financial institutions

For financial institutions, the law exempts personal information collected, processed, sold or disclosed under the Gramm-Leach-Bliley Act and California’s own financial privacy law. That covers much customer account data, though far from everything a bank holds. Website analytics on visitors who never became customers, marketing lists, some prospect data and, once the temporary exemption expired, data about employees and business contacts can all fall inside the California law.

Take a regional bank. Its checking and loan records are GLBA data. But its public website runs analytics that record every visitor, most of whom never open an account. Its marketing team buys lists of likely mortgage prospects. Its HR system holds data on hundreds of California employees. Its commercial bankers keep contact details for people at client businesses. Not one of those fits comfortably inside the federal room, and all of them may fall in California’s house.

The pattern shifts by type of firm. A credit union has a smaller marketing footprint but often a large share of members who are also employees’ families and local businesses. A broker-dealer or wealth manager holds client account data under GLBA and the SEC’s privacy rule, but its advisers maintain extensive prospect files and event lists. A fintech lender may hold more website and app behavioral data than account data. The exemption covers the same kind of data in each, and the remainder differs widely.

What the financial exemption does not reach

One detail often surprised banks. The GLBA exemption does not extend to the law’s data breach provision. California gives consumers a private right of action, with statutory damages of $100 to $750 per consumer per incident, when certain unencrypted personal information is exposed through a failure to maintain reasonable security. A breach of GLBA-covered account data can still lead to that kind of suit. Security investment for exempt data therefore still carries California exposure.

Hospitals and health systems

For health care, the law exempts protected health information held by covered entities and business associates under HIPAA. It also exempts providers and covered entities to the extent they maintain patient information in the same manner as protected health information. A health system’s website tracking, consumer wellness apps, some fundraising and marketing data, and employee information can still fall outside that boundary. California’s own Confidentiality of Medical Information Act adds another layer for medical information.

A hospital network’s clinical records are protected health information. Its free symptom-checker app, used by people who may never become patients, may not be. Neither may the tracking code on its public website that records which service-line pages visitors read, or its donor database, or its staff records. Each needs its own answer.

A separate state law signed in September 2020, Assembly Bill 713, refined the health exemptions shortly before the vote. It addressed patient information de-identified under HIPAA standards and added conditions for selling or licensing it, including contract terms barring re-identification. Life sciences companies and health systems with research or data-licensing programs had a new set of contract requirements to meet, alongside the exemptions they relied on. Information collected as part of clinical trials subject to federal research protections was also addressed separately.

Employees, applicants and business contacts

The expiry of the temporary exemptions in 2023 brought a large category of data into scope at once. California employees, job applicants and contractors gained the same rights as consumers: to know what the organization holds, to delete it subject to exceptions, and to correct it. Employers had to give notice at collection to staff and applicants, and the rules on sensitive information reached HR data such as Social Security numbers, health details in leave records and union membership.

The work fell on teams that had rarely dealt with privacy requests. HR systems, payroll providers, benefits administrators, background-check firms and recruiting platforms all held relevant data. For a regional bank with a commercial lending arm, the business-contact data in its relationship management system was a second large pool. Each contact at a client company became a person with rights under the law.

Public agencies and their vendors

Public agencies were generally outside the law. Their contractors and vendors often were not, at least for data handled outside the public contract. A company that runs a state’s benefits portal may be outside the law for that work, and inside it for the commercial products it sells elsewhere. Agencies buying from such vendors had reason to ask how data from public programs was kept apart from the vendor’s commercial data sets.

One answer per data set

The consequence is the same in all three sectors. Whether an organization is covered cannot be settled at the level of the institution; it has to be settled data set by data set.

That requires a data map: a maintained record of what personal data the organization holds and where it flows. For each significant data set, it records which law governs it, which systems hold it, and who owns it. The exemption boundaries are detailed and fact-specific, so where each data set falls is a question for the institution’s lawyers.

Mixed data sets cause the most trouble. A customer relationship management system at a bank may hold account holders, prospects and business contacts in the same tables. A health system’s patient portal may serve patients and also people who registered but never received care. The map has to record the mix, and sometimes systems have to be changed so the categories can be told apart.

New rights that land on operations

The third part is operational. Each new right translates into a process that has to reach real systems.

• The right to correct needs a request process that can find the data across systems, decide whether it is inaccurate and fix it within set timelines. For a bank, that may touch a marketing platform, a prospect database and an HR system owned by three teams.
• The right to limit use of sensitive personal information requires knowing where such information is used beyond what is necessary to provide a service, including in analytics.
• Rules on cross-context behavioral advertising reach the tracking pixels and tags embedded in public websites. Marketing teams often add those without involving compliance.

That last item surprises many executives. A tracking pixel or tag is a tiny piece of code, invisible to visitors, that a website loads from an advertising or analytics company. It reports what the visitor did, which pages they viewed and sometimes what they typed into search boxes. Marketing teams add them routinely, often through a web tool that needs no involvement from IT. A health system’s public site can carry dozens of them, each sharing visitor behavior with a third party.

Duties that apply before any request arrives

The amendments also added obligations that do not wait for a consumer to ask. Collection and use must be reasonably necessary and proportionate to the purposes disclosed. Notices must say how long each category of data will be kept. Contracts with service providers, contractors and third parties must contain specific terms limiting how they use the data.

Those duties reach deep into procurement. A bank’s marketing agency, a health system’s survey vendor and a fintech’s analytics provider all need contracts that meet the statute. Many existing contracts were written for GLBA or HIPAA and said nothing about the California terms for non-exempt data. Renewals were the practical moment to fix them, and the inventory of vendors touching non-exempt data had to exist first.

Sensitive information inside regulated firms

Banks and health systems hold a great deal of sensitive information, but much of it is in exempt data sets. The right to limit applies where non-exempt sensitive information is used for purposes beyond those the regulations allow, such as inferring characteristics about people. The places to look are specific: precise location collected by a mobile app, health-related interests inferred from website browsing, and HR data used in workforce analytics. A health system’s app that uses location to suggest the nearest urgent care clinic is one case; the same location data passed to an advertising partner is another.

Timelines and exceptions

Requests to know, delete or correct generally require a response within 45 days, which can be extended once by another 45 days with notice. The clock runs across holidays, system freezes and staff absences. Deletion and correction rights also have exceptions, such as data the organization must keep to comply with a legal obligation. A broker-dealer’s record-keeping duties under SEC rules are one example; a hospital’s medical record retention requirements are another. Applying those exceptions consistently needs a written rule, not a judgment made fresh each time.

Each of these rights is more about plumbing than policy. They need a reliable data inventory, a way to verify requesters without collecting more data than necessary, and workflows that reach systems owned by different teams. Institutions with mature records management and data catalogs found the work tractable. Those relying on manual searches across email and shared drives did not.

Consider a single correction request at a well-prepared insurer. A former website visitor writes in to say the company has the wrong home address on file and wants it fixed. The privacy team checks the data map, sees that addresses for non-customers live in two places, the marketing platform and a prospect database, and routes tasks to each owner. Both confirm within days. Because customer policy data is governed by federal law, the team notes that it handles any record there under its existing processes. The request closes on time, with a record of what was done. At an unprepared organization, the same request triggers a week of emails asking which systems might hold an address.

Opt-out signals and browser settings

Advertising rules also brought a technical mechanism into scope. Some browsers and extensions send an automatic signal that the user does not want their data sold or shared. California’s regulators treated such signals as valid opt-out requests. A website that ignored them, while running advertising tags, was failing to honor requests it never saw a person submit. Supporting the signal means configuring the site’s consent tools to detect it and switch off the relevant tags.

Building the map, in four stages

Few executives have seen privacy operations up close. At a mid-sized health system, building the foundation might unfold in four stages.

1. Inventory. A small team interviews the owners of every major system, from the clinical record to the donor database to the website, and asks the same questions: what personal data is here, about whom, where did it come from, and where does it go?
2. Classify. With counsel, the team marks each data set by governing law: protected health information under HIPAA, medical information under California’s own medical privacy law, or general personal information under the consumer privacy law. Some data sets turn out to be mixed and need splitting.
3. Connect. For data that falls under the California law, the team builds request workflows: who receives a request, how the requester is verified, which systems are searched, who fixes or deletes the record, and how the response is logged.
4. Maintain. The map is tied to the organization’s change process. A new system, a new vendor or a new website tag then triggers an update, and the map does not drift out of date unnoticed.

The fourth stage is where most programs weaken. A data map is a snapshot the moment it is finished, and systems change monthly. Without a habit of updating it, the map gradually describes an organization that no longer exists.

Hooks that keep the map current

The practical answer is to attach the map to processes that already exist. Procurement can require a privacy review before signing any contract with a vendor that will receive personal data. The change advisory process can ask whether a new system holds personal data. The web team’s tag manager can require approval before a new tag goes live. Each hook adds a small step to a routine process and keeps the map from going stale.

A few measures tell leadership whether the program is working:

• The number of systems and vendors in the map, and the share reviewed in the past year.
• Request volumes by type, and the share closed within the statutory deadline.
• The number of website tags in use, and the share approved through the review process.
• Open findings from audits or assessments, with owners and dates.

Verification without over-collection

Verification deserves a separate word. When someone asks to see, correct or delete their data, the organization must be reasonably sure the request really comes from that person. Otherwise the privacy process itself becomes a way for a fraudster to obtain or alter someone else’s information. The trick is to verify without collecting more personal data than the organization already has, for example by matching details already on file rather than demanding new identity documents.

The required level of assurance varies by request. A request to opt out of sale or sharing does not need identity verification at all under California’s rules, while a request for specific pieces of data needs more. Banks and health systems are used to strong identity checks, and their instinct to apply them everywhere can itself become a compliance problem.

Automated decisions

The agency’s authority over automated decision-making adds another dimension for regulated institutions. Banks use software to score applications and flag fraud; health systems use it to prioritize outreach and schedule care; insurers use it in pricing and claims. Where those tools touch data outside the federal exemptions, the organization needs to know they exist, what they decide and what data they use, which again starts with the map.

Cost, risk, trust and timing

For a regulated institution, the stakes are practical.

Cost. Building a data map and request workflows is real work. Doing it once, well, is far cheaper than doing it repeatedly under deadline. The cost of skipping it shows up later as rushed projects and outside counsel hours.

Regulatory risk. A specialist regulator examines details: how an opt-out link works, how many steps a request takes, whether a banner nudges people toward consent. Institutions accustomed to federal examiners focused on other issues can be caught off guard.

Litigation risk. The breach provision applies even to exempt financial data, and plaintiffs’ lawyers read privacy notices and website code closely. A tracking tag that a regulator might treat as a process failure can also become the basis of a private lawsuit under other state laws.

Customer trust. Banks and hospitals trade on trust. Discovering that a health system’s website was sharing visitor behavior with advertisers, without visitors knowing, is the kind of story customers remember, whatever the legal technicalities.

Timing. The exemptions for employee and business-to-business data were temporary from the start, extended by the measure only to January 1, 2023. Many organizations deferred that work, reasonably, then compressed it into the final months of 2022. Treating a sunset date as a planning date, instead of hoping for another extension, spreads the effort.

How the burden differs by organization

The effort did not scale neatly with size. A large bank had the most systems to map but also existing data governance, a privacy office and procurement controls it could extend. A community bank or credit union had fewer systems but often no dedicated privacy staff, and depended heavily on core-processing and marketing vendors whose contracts it had limited power to change.

Health systems faced the threshold question first, entity by entity, and then a tangle of affiliated practices. An ambulatory network or physician group organized for profit was more clearly covered and often had less privacy infrastructure than a hospital. A vendor serving public agencies had to separate its government work from its commercial work, which sometimes meant changing how shared platforms stored and tagged data.

The case for waiting

In 2020 there was a reasonable argument for doing little. The operative date was more than two years away. The new agency did not yet exist, and its rules would not be written for some time. A federal privacy law, possibly with preemption, was being discussed in Congress. Early work might be wasted.

Each point had some truth, and none justified inaction on the foundation. Detailed rules would change, but every plausible version required knowing where personal data lived and which law governed it. The map was useful under any outcome, including a federal law. Institutions could reasonably wait on the detailed process design while building the inventory immediately.

One map, many state laws

The data map that California demanded did not stay a California asset. It served as the base for every state law that followed. Institutions that built it once, and kept it current as systems changed, spent their later effort on genuinely new requirements. Those that answered each new law with a separate project kept rediscovering where their data was.

Later states did not copy California’s approach to exemptions. Virginia, the first to follow in 2021, exempted financial institutions subject to GLBA and HIPAA covered entities as whole organizations. A bank could therefore be exempt in one state and partly covered in another, for the same website and the same marketing list. A map that records each data set’s characteristics, rather than a single answer per law, can answer each state’s test from the same facts.

The stronger programs classify each significant data set by governing law instead of giving a single yes-or-no answer for the whole institution. They name a person to track rulemaking and assess drafts against the map. Compliance reviews website tags and pixels before they go live and audits them periodically. Request workflows reach marketing, prospect and HR systems, with clear owners and deadlines. And sunset dates sit on the planning calendar as real deadlines.

The weaker ones make the opposite moves. They give the entity-level answer, “we are a bank, so we are exempt,” which is usually wrong for a meaningful share of data. They publish a well-written privacy notice with no reliable way to find and fix the data behind it. They leave marketing in the blind spot, adding tracking code to websites without anyone in compliance knowing. And they rebuild the inventory every time a new state acts.

What the map should record

A map built to answer many laws needs attributes, not verdicts. For each significant data set, it should record:

• Whose data it is: customers, patients, prospects, website visitors, employees, applicants or business contacts.
• Which categories it holds, with sensitive categories flagged.
• Where the data came from and for what purposes it is used.
• Which systems hold it, which vendors receive it, and under what contracts.
• Whether any of it is sold or shared for advertising.
• How long it is kept, and the legal or business reason.
• Which federal regime, if any, governs it, and the states where the people concerned live.

With those facts recorded once, the question of whether a new state law applies becomes a query against the map rather than a new project. The legal judgment still belongs to counsel; the map simply gives counsel the facts in a form that can be reused.

Who owns the map

Ownership varies by sector. In banks, privacy often reports through compliance, with strong ties to the GLBA program. In health systems, it usually lives with the HIPAA privacy officer, whose instincts are clinical rather than marketing. In both, the map needs a partner in data governance or enterprise architecture who can keep it tied to real systems. A privacy office without that partner tends to maintain a spreadsheet that drifts from reality.

Where the data sits, system by system

• Which of our data sets are governed by GLBA or HIPAA, which are not, and can you show me the map?
• How many tracking tags and pixels run on our public websites, who added them, and what do they share?
• If someone asked us to correct their data tomorrow, which systems would we need to search, and who owns each one?
• Who is following the California regulator’s rulemaking, and how do drafts reach the teams that would have to change systems?
• When a new state passes a privacy law, do we extend one map, or start a new project?

The answers should come from the map and its owners, not from a memo. An institution that can answer all five with evidence has done the foundational work. One that answers with assurances has not yet started.

With hindsight

The California Privacy Protection Agency has been an active regulator. Its first regulations were approved in March 2023. The statute’s new provisions became enforceable on July 1, 2023, though a state trial court delayed enforcement of the new regulations that summer. In February 2024 a state appeals court reversed that delay. By 2026 the agency had adopted the shorter public name CalPrivacy.

Its rulemaking reached the topics the measure had left open. In September 2025 its rules on automated decision-making technology, risk assessments and cybersecurity audits were approved, taking effect at the start of 2026. Businesses using automated decision-making for significant decisions must comply from January 2027. Risk assessment attestations are due from April 2028, and cybersecurity audit certifications are phased in by revenue between 2028 and 2030.

Early enforcement focused on mechanics rather than dramatic breaches. Before the agency’s first actions, the attorney general settled with the retailer Sephora in August 2022 for $1.2 million, in part for failing to honor browser opt-out signals. In March 2025 the agency settled with Honda for $632,500. It alleged that Honda demanded too much information to verify opt-out requests, presented privacy choices unevenly and shared data with advertising technology firms without the required contract terms. In September 2025 it announced a $1.35 million penalty against Tractor Supply.

That focus is telling. A dedicated regulator looked first at the everyday machinery of privacy: the forms, the buttons, the verification steps, the vendor contracts. Those are exactly the operational details that a bank or hospital relying on a federal exemption may never have examined for the data outside it.

The agency also took on data brokers under a separate law, the Delete Act of 2023. A single deletion platform for consumers went live in January 2026, extending California’s approach from individual businesses to the market that trades data between them.

Health care faced its own reckoning over tracking code. In December 2022 the federal health privacy regulator warned that tracking technologies on hospital websites could disclose protected health information. A federal court vacated part of that guidance in June 2024, but by then many health systems had removed or reconfigured tags, and several had notified patients of disclosures. Federal Trade Commission actions against health apps in 2023 and Washington’s My Health My Data Act, also passed in 2023, pushed in the same direction. Plaintiffs also filed many suits over website tracking and chat tools under California’s older wiretapping statute, the California Invasion of Privacy Act, adding a litigation channel the 2020 measure had not created.

Meanwhile close to twenty states passed comprehensive privacy laws, starting with Virginia in 2021. Each took its own approach to financial and health data: some exempt entities, others only data. For an institution operating in many states, that patchwork makes a single, maintained data map more valuable each year, because it is the only way to answer different rules from one set of facts.

The temporary exemptions for employee and business data expired on January 1, 2023, as scheduled. A federal privacy law was proposed several times, and a bill cleared a House committee in 2022, but none passed. Anyone who waited for one national standard to simplify the picture is still waiting.

Privacy compliance has become a permanent operating capability rather than a series of legal projects. The organizations in the best position are those that invested early in knowing where their data lives and which law governs each piece of it.

The 2020 vote marked the start of privacy compliance in the U.S. as a permanent, state-by-state data mapping discipline, including for institutions that believed federal law already covered them.