Although the U.S. government has yet to introduce a comprehensive federal data privacy law, significant progress has been made at the state level, with several states enacting their own privacy regulations. Since the passage of the California Consumer Privacy Protection Act (CCPA) in 2018, there has been ongoing movement toward consumer data protection, though the process remains fragmented. This blog explores the current state of privacy legislation, its potential future developments, and the implications for the title industry.
The Title Industry and Consumer Data Protection
The title industry has long been committed to safeguarding consumer financial data. Title insurers, agents, and settlement service providers have adhered to the Gramm-Leach-Bliley Act (GLBA) since 1999. This federal law mandates that businesses in the financial sector disclose their policies and practices regarding the protection of personal financial information. However, as state-level privacy laws continue to develop, the title industry must adapt to meet new requirements while maintaining compliance with federal laws.
Typically, federal law preempts state law only when the state law is “inconsistent” with federal requirements. In practice, this means that states are free to enact laws that offer greater protections than those provided by federal regulations. As a result, businesses subject to GLBA, including those in the title industry, must also comply with state-level privacy laws, provided those laws don’t create a federal exemption or carve-out.
The Rise of State-Level Consumer Privacy Laws
As of now, 20 states have passed comprehensive consumer privacy laws, including California, Virginia, Colorado, and Texas. These laws share several common provisions, such as giving consumers the right to access and delete personal information and the option to opt-out of the sale of personal data. Additionally, many of these laws include GLBA carve-outs, which provide exemptions for businesses in the financial sector when it comes to certain aspects of consumer data protection.
For instance, California’s CCPA, which was expanded by the California Privacy Rights Act (CPRA) in 2020, offers a GLBA carve-out for personal information that is collected, processed, or sold by financial institutions. However, businesses must still adhere to reasonable security practices to prevent breaches and data leaks.
Other states have more robust carve-outs that exempt businesses in the financial industry from certain consumer privacy requirements. Examples include:
-
Virginia: The Consumer Data Protection Act (VCDPA) – Effective January 1, 2023
-
Iowa: The Consumer Data Protection Act (ICDPA) – Effective January 1, 2023
-
Colorado: The Colorado Privacy Act (CPA) – Effective July 1, 2023
-
Connecticut: The Data Privacy Act (CTDPA) – Effective July 1, 2023
Federal Privacy Legislation Update
Federal consumer privacy bills have seen limited success, with the most notable being the American Data Privacy Protection Act (ADPPA), which was advanced to the U.S. House of Representatives in 2022 but failed to pass. In April 2024, another attempt at federal privacy legislation, the American Privacy Rights Act (APRA), was introduced. This bill would have granted consumers rights such as access to personal information, the ability to delete data, and the option to opt-out of data transfers or targeted advertising. However, like its predecessor, the APRA bill failed to advance, mainly due to disagreements over preemption of state laws and the introduction of a private right of action.
As of February 2025, there is renewed momentum at the federal level. The House Committee on Energy and Commerce has established a working group to explore data privacy legislation. Chairman Brett Guthrie and Vice Chairman John Joyce issued a statement emphasizing the need for a national standard to protect consumers’ online rights and ensure that the U.S. remains competitive in digital technologies, including artificial intelligence.
The Outlook for the Title Industry
Despite the evolving privacy landscape, the GLBA remains the title industry’s primary framework for consumer data protection. Since its enactment in 1999, the GLBA has provided a robust structure for limiting the use and sharing of consumer data within the financial sector. In addition, the American Land Title Association (ALTA) has been proactive in promoting best practices for data privacy and security, including the establishment of national standards for consumer privacy protection in 2020.
As state and federal laws continue to evolve, title companies will need to stay informed about specific requirements, including GLBA carve-outs, to ensure compliance. At Old Republic Title, we remain committed to protecting consumer data privacy and security. With a national network of offices and affiliates, we are actively monitoring changes in the privacy regulatory environment and are prepared to adjust our practices to meet evolving standards.
As privacy laws continue to develop, title companies must evaluate both state and federal requirements to ensure that they remain compliant while safeguarding consumers’ personal information. We will continue to prioritize consumer privacy protection and make necessary adjustments to our practices in line with emerging legislation.