“Non-breach privacy" refers to situations where legally protected information (business or personal) is collected, transferred, stored, used, or given access to without the express notice or consent of the data subject. Generally, the risk derives from gaps in a company’s data collection and privacy posture. It results in entities unwittingly collecting, transferring, disclosing, or misusing personal or business information in violation of state and federal laws. A typical example is a marketing department using tools to collect this information without the IT or legal departments knowing what information is being collected.

Privacy-related disputes arising out of the use and collection of digital information skyrocketed in 2024. The plaintiffs’ bar has used “wiretapping laws,” like the California Invasion of Privacy Act, and other “multiparty consent” state and federal laws against companies. In a typical scenario, plaintiffs’ lawyers conduct scans of websites to see if ad tracking technology is deployed and sharing information without notice or consent on a company’s website. They then leverage one or more individuals to serve as a putative plaintiff or claimant and assert that the individual(s) went to the website and had their information collected without notice. As a result, the use of ad tracking tools, including pixels, cookies, session replay, and chat bots increases a company’s exposure for both lawsuits and regulatory scrutiny.

Insurance coverage for this risk varies and as the risk continues to evolve, it’s important to discuss with your broker the availability of coverage in your cyber policy.

In 2025, we expect the underwriting environment to continue to be in-depth, complex, and multi-faceted. Besides the usual robust ransomware controls, which are now non-negotiable, underwriters will be looking for an in-depth discussion around privacy controls relating to wrongful collection of data, biometric information, and privacy policy governance and enforcement. This means insureds may need a data privacy leader as well as strong privacy and data governance controls if they maintain, process, or share large volumes of personally identifiable information (PII).

To drive successful cyber insurance renewal outcomes, insureds will need to bring all stakeholders to the table—not just the CISO and risk manager—to prepare a detailed underwriting submission. They can also ensure that the coverage in place aligns with the company’s balance sheet protection strategy, data privacy goals, and network security and ransomware resilience. Use a well-known framework like NIST 2.0 or CIS, and engage your broker to facilitate frank and cross-functional dialogues with your company’s stakeholders and security vendors. These steps will save time and work and is a big advantage for companies trying to differentiate their risk and security culture to underwriters.