Your customer's personal information is not yours to sell. Two California laws set the ground rules: one controls sharing it, the other gives the customer rights when an insurer says no.

California Financial Information Privacy Act (CalFIPA), Financial Code §§4050–4060: - Sharing with nonaffiliated third parties (for example, selling a list to an outside marketing company): the business needs the consumer's explicit prior consent, given on a separate form that the consumer signs and dates. - Sharing with affiliates: an annual notice that gives the consumer a chance to object (opt out). Note the trap: an annual notice and no objection is enough for affiliates, not for outsiders.

Insurance Information and Privacy Protection Act (IIPPA), Insurance Code §§791–791.29: a declination is an "adverse underwriting decision." If the person asks in writing for the specific reasons, within the 90 business days allowed for the request, the insurer or agent must furnish the reasons and the information behind them within 21 business days of receiving the request.

Memory hook: the customer has 90 business days to ask; the insurer has 21 business days to answer. The IIPPA also governs pretext interviews (see the pretext interview page).