A golden retriever named Tommy lives with me. He is the best. When the family is sitting around our living room — especially if we have guests — he likes to make his rounds. There’s always a degree of likelihood that he knocks a wine glass off the coffee table. Tail risk!
Tail risk is a core concept in risk management but, like many fundamentals, it is evolving rapidly. Insurance policies are term-limited, which offers some degree of predictability, but claims or losses can manifest after a policy expires, sometimes significantly so, in both severity and time passed. Traditionally, tail risk sits in “occurrence” policies. Those coverages respond to injury or damage that takes place during the policy period, regardless of when anyone makes a claim. The prototypical examples are asbestos, environmental, and construction defect. Claims-made coverage, by contrast, has traditionally offered more certainty on the back end: it requires a claim during the policy period and reaches back only as far as the retroactive date. Markets and policyholders now face a new reality: claims-made long-tail exposure.
Admittedly, this is a wonky topic and involves a swath of coverage minutiae (retro dates, prior acts, related wrongful acts and batching, “deemer” clauses), but it is nevertheless a critical consideration for insureds across industries and market segments. Privacy liability has emerged as a major tail risk, and not just for big tech or healthcare-adjacent entities. California’s privacy agency set what was then its record CCPA fine against Tractor Supply, a rural retailer, over privacy notices, vendor contracts, and opt-out mechanisms. A clothing retailer, Todd Snyder, paid a fine after allegedly failing to honor opt-out requests for 40 days. The FTC assessed penalties against Apitor, a maker of interactive robot toys.
Government enforcement is only part of the calculus. Private plaintiffs have filed more than 4,000 wiretap-based class actions against website operators since 2022, aimed at standard configurations of pixels, session replay, chatbots, and analytics tools. Forbes agreed to pay $10 million to resolve litigation alleging that LinkedIn and Microsoft tracking pixels violated users’ privacy. Simply put, privacy liability is not limited to organizations managing large volumes of PHI or PII, nor is it necessarily tethered to a security breach or data leak.
Beyond fines, penalties, and judgments, defense and compliance costs create massive financial obligations and are a major emerging driver of claims-made tail risk. Indeed, it is not uncommon for a claim to fully exhaust an insurance program midway through defense because the claim triggered an earlier year’s program, often one with lower aggregate limits than the programs that followed.
Policy structure creates this dynamic. A claims-made policy responds to claims first made during the policy period, and nearly every form treats related claims as a single claim, made at the time of the first, even when the first was only a demand letter. A tracking pixel installed in 2022 can produce a demand letter in 2024, a class action in 2025, and a regulator’s inquiry in 2026. If the conduct behind them is sufficiently related, the 2024 policy alone responds to all three, subject to the 2024 limit and the 2024 retention.
The front end carries its own trap. Privacy class periods often reach back several years. A retroactive date set at a company’s first cyber purchase, or reset when the program changed carriers, can remove that conduct from coverage entirely. Many cyber forms also exclude or sublimit wrongful collection and tracking-technology claims, and defense costs erode limits on nearly all of them. The limit that matters is rarely the one on this year’s declarations page. It is the limit of whichever year a future claim attaches to, net of whatever defense has already spent.
Put together, a growth-stage company’s risk management posture matters not only at a point in time, but for where the company is going. A program built with the tail in mind protects against disproportionate retained losses down the road, and it provides certainty for later-stage goals. A financing, an acquisition, or a sale goes much more smoothly with early and consistent risk hygiene. At a sale, the extended reporting period or run-off decides whether old exposure has any insurance behind it at all.
When Tommy smacks glassware, I know the night it happened, and I can keep a closer eye on the coffee table next time. Claims-made tail risk rarely offers that courtesy. The conduct occurred years ago, perhaps to little concern, but the claims that follow may land on an insurance program the company outgrew long ago, putting that hard-earned growth directly at risk.