Every time a policyholder hands over personal information to get a quote, renew a policy, or file a claim, that data begins a journey they know almost nothing about. It flows from agents to management systems, quoting engines, carriers, and data aggregators, often without explicit consent for each use along the way. In a recent InsurTech Association webinar, Frank Sentner, creator of Sagitta (now part of Vertafore) and a 50-year veteran of insurance technology, made the case that this problem is about to get dramatically worse, and that the industry needs to act now.
Sentner joined ITA co-founder Josh Hollander for a wide-ranging conversation on data rights, AI, and what he calls an “Insurance Data Bill of Rights.” His central argument: the industry has operated on implicit trust for decades, but AI is shining a spotlight on just how little control policyholders have over their own information.
Takeaway 1: Data Rights Start With the Policyholder
Sentner’s first principle is straightforward: data rights start with the policyholder, not with the vendor, carrier, or agent. “If the data is about me or about my company, it’s my data,” he said. “I should have unlimited, unfettered access to it at any point in time, including up to: I want you to delete all my data.”
The problem? Most policyholders have no idea where their data ends up. When they provide information to an agent, they assume it’s being used to quote, write, and service their policies. But that data often flows into SaaS platforms, quoting engines, and aggregators under terms buried deep in contracts that agents themselves may not have read carefully. Sentner pointed out that some SaaS vendors monetize this data, and in some cases sell insights derived from it back to the very agents and customers who provided it, all without explicit permission.
Takeaway 2: The Industry Must Shift From Opt-Out to Opt-In
The second pillar of Sentner’s framework is a shift from opt-out to opt-in. Today, most data agreements default to broad usage rights unless the user actively opts out (often by finding and unchecking a box buried in a lengthy terms-and-conditions document). Sentner wants that flipped: every use of policyholder data should require affirmative, specific consent.
He laid out a practical approach: start with a clear statement of purpose on the very first screen. “Your data is being collected for this purpose and this purpose only. Do you agree?” If the company wants to use data for additional purposes (training AI models, building analytics products, aggregating for resale), each one should be presented separately and require its own opt-in. “If you’re burying gotchas 19 paragraphs deep into the document, there’s a reason you’re doing that,” Sentner said. “You are counting on the fact that the person will not get that far.”
Takeaway 3: Agentic AI Is Accelerating the Problem
Perhaps the most urgent theme was timing. Sentner described five demos he’d seen in recent weeks, all using agentic AI to deconstruct policies, push data through comparative quoting engines, generate proposals, and send them to customers, all without any manual data entry. One company even demonstrated AI conducting a life insurance interview with a customer directly. “Six months ago, I didn’t really know what agentic AI was,” Sentner said. “Today, I’m seeing companies whose major premise for being is that they will do the work that previously was done by a producer or a CSR.”
This acceleration makes the data rights question more pressing, not less. As AI agents handle more of the insurance workflow autonomously, the volume of data being collected, processed, and shared grows exponentially. Without clear guardrails, policyholders lose even more visibility into how their information is used. Sentner drew a parallel to connected cars: drivers who sign up for connected services unknowingly grant manufacturers complete control over all vehicle data. One driver couldn’t even access their own data to defend themselves in court.
Sentner’s proposed framework boils down to four principles: start with the policyholder, state the purpose explicitly, require opt-in consent for every use, and include the right to have data deleted. He believes regulation through the NAIC (National Association of Insurance Commissioners) is the most practical path forward, since proactive industry regulation could head off a messy patchwork of state legislation.
“We have to want to change,” Sentner said. “It’s the most important thing we have to do.”
The full recording of this session is now available on our site. If you’re a founder building on insurance data, a broker wondering what’s in your vendor contracts, or an industry leader thinking about trust and governance, this conversation is essential viewing.
