Your data and your home insurer: privacy rules

Three layers of law govern what your home insurer does with your data: the federal Gramm-Leach-Bliley Act, which requires privacy notices and lets you opt out of some sharing with outside companies; the Fair Credit Reporting Act, which gives you the right to see and dispute the reports used against you; and state insurance privacy rules. Newer state consumer privacy laws mostly exempt insurers, so your insurance regulator is usually the enforcer, not the state attorney general.

What your insurer collects

More than most people assume. The application and renewal give the insurer your identity, address, mortgage and claims history. Behind that, insurers and the vendors they hire add data from several sources:

• Your claims history. A CLUE report from LexisNexis Risk Solutions lists claims reported on you and your address for up to seven years, and A-PLUS reports from Verisk do similar work. See CLUE reports: how claims history follows you and your house.
• Credit-based data. An insurance score drawn from your credit file where state law allows. See insurance scores: how credit affects home insurance.
• Property data. Public records, tax data, permits, aerial and satellite images, and inspection results. See aerial imagery: how insurers inspect roofs from the sky.
• Device data. Smart water sensors, security systems and cameras, if you enroll in a discount program. See smart home technology and insurers.
• Claims data. Photos, recorded statements, contractor invoices, medical information for liability claims, and bank details for payments.

Insurers say this data lets them price accurately, detect fraud and pay claims faster. The concern is that more data means more places for errors and for uses you never expected, such as a sensor program whose data later informs renewal.

The federal layer: Gramm-Leach-Bliley

The Gramm-Leach-Bliley Act of 1999 treats insurers as financial institutions. Insurance regulation stays with the states, so each state's insurance regulator enforces the privacy rules against insurers, using models developed by the National Association of Insurance Commissioners (NAIC). In practice you get:

• A privacy notice when you become a customer, and an annual notice afterward unless the insurer qualifies for an exception, such as sharing only within narrow limits.
• An opt-out right before the insurer shares your nonpublic personal financial information with nonaffiliated third parties for most purposes. You get a reasonable time to opt out. Sharing needed to run your policy, process claims, prevent fraud or comply with law is allowed without an opt-out.
• Safeguards. Insurers must protect the data they hold. Many states have adopted the NAIC's Insurance Data Security Model Law, which requires an information security program and notice to the regulator after a cybersecurity event. Check your state's version.

States vary in how they apply this. The NAIC's model for carrying out GLBA is its Privacy of Consumer Financial and Health Information Regulation (#672). On the NAIC's state chart, last updated in spring 2024, 10 states have adopted the current version, 29 states plus D.C. and Puerto Rico have an earlier version, and 11 more have related laws or bulletins instead. Check your own state's rule for the details. The NAIC's Privacy Protections working group has been updating the models, which were written decades ago, and as of 2025 was reviewing them article by article.

The consumer report layer: FCRA

The Fair Credit Reporting Act governs "consumer reports," a category that covers credit-based insurance scores and claims-history reports. Your rights:

1. If an insurer takes an adverse action based in whole or in part on a consumer report, such as denying coverage, charging more or non-renewing, it must send a notice that names the reporting agency and tells you how to get a free copy.
2. You can request a free copy of your file from each reporting agency once every 12 months, and sooner after an adverse action.
3. You can dispute inaccurate or incomplete items. The agency has to investigate, generally within 30 days, and correct or delete what cannot be verified.
4. You can add a statement of dispute to your file.

The CLUE report is the one homeowners most often need. A claim on a prior owner's house can attach to the address; a denied or closed-without-payment claim may still show as an inquiry. See CLUE reports: how claims history follows you and your house for how to request and fix it.

State insurance privacy laws and consumer privacy laws

Seventeen states have adopted the NAIC's Insurance Information and Privacy Protection Model Act (#670), according to the NAIC's state chart (fall 2021 edition, the most recent posted): Arizona, California, Connecticut, Georgia, Illinois, Kansas, Maine, Massachusetts, Minnesota, Montana, Nevada, New Jersey, North Carolina, Ohio, Oregon, Virginia and Wisconsin. Kansas and Wisconsin adopted only portions. Arkansas, Hawaii and Wyoming have related laws. Confirm against your state's statute. Where it applies, the Act typically requires insurers to give written reasons for adverse underwriting decisions, to disclose the sources of information, and to let you see and correct recorded personal information. It also limits pretext interviews and some disclosures.

State comprehensive privacy laws (the ones that give consumers rights to access, delete and opt out of sale) are a separate matter. Most exempt GLBA-covered financial institutions at the entity level, which removes insurers from scope. Law-firm summaries note California is different, because the California Consumer Privacy Act exempts only data covered by GLBA or the state's insurance information law, so insurers there must work out which data falls outside the exemption. Some states have different carve-outs. If your state has a consumer privacy law, check whether it covers insurers before assuming you can send a deletion request.

What you can ask your insurer

1. For your privacy notice and opt-out form. Opt-out choices are usually on the notice or in your online account.
2. To see what is on file. In states with an insurance information privacy act, you can request recorded personal information and the identity of its source.
3. For the reason behind an adverse decision. Ask for it in writing and for the name of any report agency.
4. To correct a wrong fact. A wrong roof year, an old claim or a prior owner's loss may be fixed by sending documentation.
5. To delete or stop collecting device data. Ask what the program stores and what happens when you leave. Read the terms before enrolling.

Sample request, adjusted to your facts:

I am a policyholder (policy number ___). Please send me my current privacy notice and the opt-out form for sharing with nonaffiliated companies. Please also identify the consumer reports and data sources used to underwrite or rate my policy at the last renewal, and tell me how to correct any inaccurate information.

If you get no response within the time your state allows, file a complaint with the state regulator; see how to file a complaint with your state insurance department.

Practical protections

• Opt out of sharing wherever the form allows, and keep a dated copy.
• Pull your CLUE report and, where you have one, your credit file before shopping for a policy or buying a house.
• Be cautious with discount programs that stream data. A small discount may not justify ongoing data collection; read how long data is kept and whether it can influence renewal.
• Shred or secure claim paperwork. Claims files include bank, medical and identity information.
• Watch for phishing that mimics your insurer after a data breach; the insurer should notify you by letter as your state's breach law requires.

Key takeaways

• Federal law requires insurers to give privacy notices and opt-outs for most sharing with outside companies; the state insurance regulator enforces it.
• The Fair Credit Reporting Act lets you get free copies of claims and credit-based reports and dispute errors.
• Many state comprehensive privacy laws exempt insurers, so check before relying on a deletion right.
• Smart-home and telematics-style programs trade data for discounts; read the retention and renewal terms.
• Ask in writing for the reason and the source behind any adverse decision, and complain to your insurance department if the answer is missing.