Bank Advertising Rules: the US regulations behind targeted bank ads (GLBA, FCRA, ECOA, UDAAP)

What the law says. A financial institution may not disclose nonpublic personal information to a nonaffiliated third party unless four conditions are met. It has given an initial notice and an opt-out notice, it has given a reasonable opportunity to opt out, and the consumer has not opted out (12 CFR 1016.10(a)).

The opt-out does not apply when the third party performs services for the bank under a contract that bars other use. Those services may include marketing the bank's own products, or products offered under a joint agreement with another financial institution (12 CFR 1016.13). Account numbers are a separate, stricter rule (12 CFR 1016.12).

Affiliates are treated differently. Sharing inside a corporate family is outside the Regulation P opt-out. But an affiliate that uses eligibility information from another affiliate to make solicitations must first give notice and an opt-out. That opt-out must last at least five years (12 CFR 1022.21; 1022.22(b)). Exceptions include an affiliate that has its own pre-existing business relationship with the consumer.

What regulators and courts have said. On 12 May 2025 the CFPB withdrew a long list of guidance documents. The list includes its July 2022 advisory opinion on permissible purposes for consumer reports and its 2022 interpretive rule on FCRA preemption (90 FR 20084). The statutes and regulations did not change.

Practice. Live bank networks keep records inside the bank and release segment IDs, offer placements and aggregate reports. Whether a given partner fits the service-provider route depends on facts: who the advertiser is, whose product is marketed, and what output leaves. The service-provider and joint-marketing questions are the subject of the GLBA joint marketing exception; a reference architecture is in How a bank can launch a media network without moving customer data.

What the law says. A consumer reporting agency may furnish a report for a credit or insurance transaction the consumer did not start only in two cases. Either the consumer authorises it, or the transaction is a firm offer, the consumer has not opted out and age conditions are met (15 U.S.C. 1681b(c)(1)). A firm offer is one that will be honoured if the consumer meets the criteria used to select them (15 U.S.C. 1681a(l)).

The user of a prescreened list may receive only three things: the name and address, a non-unique identifier for verification, and information that does not reveal the consumer's relationship with a particular creditor (1681b(c)(2)).

Each written solicitation must state that report information was used, that the offer may be withdrawn if criteria are not met, and how to opt out (15 U.S.C. 1681m(d)). The notice has a short and a long part. On paper the short part goes on the front of the first page, in type larger than the main text and at least 12-point. Electronic notices go on the same page and close to the main marketing message (12 CFR 1022.54). An opt-out made through the agencies' notification system lasts five years; a signed election form lasts until revoked (1681b(e)).

What regulators and courts have said. No current CFPB rule addresses prescreened lists used for display or social audiences. The Bureau's FCRA advisory opinions on permissible purposes were among the documents withdrawn in May 2025 (90 FR 20084).

Practice. Teams ask three questions before using credit data for an online audience. Is the audience built from consumer-report data? Is the ad a firm offer? Is the delivery a "written solicitation" that must carry the notice? The answers change the design. The full treatment is in FCRA prescreen rules for credit advertising.

What the law says. ECOA makes it unlawful for a creditor to discriminate against an applicant on a prohibited basis (15 U.S.C. 1691).

Regulation B adds a discouragement rule. As amended, a creditor may not make an oral or written statement, in advertising or otherwise, that it "knows or should know" would discourage on a prohibited basis. The test is whether a reasonable person would believe the creditor would deny credit, or grant it on worse terms, because of that characteristic. Statements include words and "visual images such as symbols, photographs, or videos" (12 CFR 1002.4(b)). For housing, the Fair Housing Act separately bars any advertisement for a dwelling that "indicates any preference, limitation, or discrimination" on a protected basis (42 U.S.C. 3604(c)).

What regulators and courts have said. The CFPB's final rule of 22 April 2026, effective 21 July 2026, makes three changes (91 FR 21620):

1. It states that ECOA does not authorise disparate-impact liability.
2. It limits discouragement to statements and says that encouraging one group to apply does not discourage people who were not the intended recipients. The Bureau writes that the revised commentary "makes clear that creditors are permitted to engage in targeted advertising".
3. It removes comment 4(b)-2 on affirmative advertising to under-served groups and adds conditions for special purpose credit programs (91 FR 21620).

The Bureau acknowledged that "certain groups of consumers may be excluded from advertising campaigns" as a result. The rule does not amend the Fair Housing Act. We did not confirm whether the final rule has been challenged in court.

Practice. Fair-lending reviews now separate content (still tested under the discouragement rule) from audience selection (tested as possible disparate treatment rather than effects). Mortgage ads keep a housing review. The checklist for targeted ads is in ECOA, fair lending and fair housing advertising rules.

What the law says. A deposit ad may not be misleading, may not call an account "free" if a maintenance or activity fee can apply, and must state any rate as an "annual percentage yield" (12 CFR 1030.8(a)-(b)). Stating the APY or a bonus triggers more terms, such as minimum balance and time requirements. Ads in "broadcast or electronic media, such as television or radio", outdoor media and telephone response machines may omit some of those terms (1030.8(e)(1)). The statute sets the same structure (12 U.S.C. 4302).

For credit, Regulation Z lists "trigger terms". In a closed-end credit ad, stating a down payment, the number of payments, a payment amount or a finance charge requires the down payment, repayment terms and APR as well (12 CFR 1026.24(d)). Open-end ads, such as card ads, have their own triggers (12 CFR 1026.16(b)). Dwelling-secured credit ads also face a list of prohibited acts (1026.24(i)).

What regulators and courts have said. Whether a programmatic banner or a social post counts as "electronic media" for the Regulation DD exemption is not settled in the regulation text itself; we list it as an open question for counsel.

Practice. Small formats drive design. A small display banner that names a rate either carries the required terms, links to a page that carries them where the rules permit, or drops the rate. Teams keep the trigger terms of 12 CFR 1026.24(d) as a checklist in the creative review tool.

What the law says. The CFPB may act against a covered person or service provider for an unfair, deceptive or abusive act in connection with a consumer financial product (12 U.S.C. 5531(a)), and it is unlawful for them to engage in one (12 U.S.C. 5536(a)(1)(B)). Unfairness needs substantial injury that consumers cannot reasonably avoid and that is not outweighed by benefits (5531(c)). The FTC Act declares unfair or deceptive acts in commerce unlawful, but excludes banks from the FTC's own enforcement power (15 U.S.C. 45(a)); bank regulators apply the same standard to banks.

What regulators and courts have said. In August 2022 the CFPB said digital platforms that help target financial ads could be service providers under the Consumer Financial Protection Act. That interpretive rule was among the documents withdrawn on 12 May 2025 (90 FR 20084). The statutory definition of service provider remains.

Practice. UDAAP reviews look at the net impression of the whole placement: the offer, the fine print and the landing page. For co-branded offers the review covers whose product the ad appears to sell.

What the law says. Each insured bank must include the official advertising statement, such as "Member FDIC", in ads that promote deposit products or non-specific banking services (12 CFR 328.6(c)). Ten types of ads are exempt, including ads that do not name the bank, radio or TV ads of 30 seconds or less other than display ads, and items where the statement is impractical (328.6(d)). Ads that relate only to non-deposit products must not carry the statement or imply deposit insurance (328.6(e)).

Websites and apps that take deposits must show the FDIC official digital sign on the homepage, the login page and where account opening starts. They need non-deposit signage on pages about non-deposit products, and a one-time notice per session before a logged-in customer leaves for a third party's non-deposit product (12 CFR 328.5). Separately, no person may imply that an uninsured product is FDIC-insured, in any medium (12 CFR 328.102).

What regulators have said. The FDIC amended the digital and ATM signage rules on 29 January 2026 to address "implementation issues and sources of potential confusion" from the 2023 rule. The amendments took effect on 2 March 2026; compliance is required by 1 April 2027 (91 FR 3812).

Practice. For media networks inside bank apps, the signage rule reaches the surface itself. An onsite placement that sends a logged-in customer to a partner's investment or crypto product sits on exactly the path the one-time notice covers.

What the law says. The California Consumer Privacy Act does not apply to personal information "collected, processed, sold, or disclosed subject to" GLBA or the California Financial Information Privacy Act (Cal. Civ. Code 1798.145(e), CCPA text effective 1 January 2026). The exemption follows the data, not the company. Web, app and advertising data that a bank collects outside a financial relationship stays in scope, including the opt-out of "sharing" for cross-context behavioural advertising (1798.140(ah)).

What regulators have said. State attorneys general enforce sale and sharing opt-outs on advertising data; California's actions are listed on its privacy enforcement page. State privacy laws differ on whether they exempt financial institutions as entities or only GLBA data; the count and status of those laws changes each session.

Practice. Bank teams map each data source to its regime: GLBA data under Regulation P, website and app data under state privacy law, and loyalty or rewards data under both. The consent side of that map, including state laws, the EU and the UK, is in Loyalty program data in advertising.

This page does not tell any reader what to do. These are the facts that, in our reading of the sources above, decide which rule applies:

1. Product type. Deposit, credit, mortgage or non-deposit investment product. Each brings a different content rule.
2. Data source. The bank's own customer data, a consumer-report prescreen, an affiliate's data, or web and app data outside GLBA.
3. What leaves the bank. Records or hashed lists, segment IDs, or aggregate results only.
4. Who the advertiser is. The bank marketing its own product, a joint-marketing partner that is a financial institution, or a merchant marketing its own brand.
5. Channel. Printed or emailed solicitation, display, social, connected TV or in-app placement.
6. Where the consumer lives. State privacy and financial privacy laws differ.

1. Federal Register, CFPB, "Equal Credit Opportunity Act (Regulation B)", final rule, 91 FR 21620 (22 April 2026; effective 21 July 2026). https://www.federalregister.gov/documents/2026/04/22/2026-07804/equal-credit-opportunity-act-regulation-b
2. Federal Register, CFPB, "Interpretive Rules, Policy Statements, and Advisory Opinions; Withdrawal", 90 FR 20084 (12 May 2025). https://www.federalregister.gov/documents/2025/05/12/2025-08286/interpretive-rules-policy-statements-and-advisory-opinions-withdrawal
3. Federal Register, FDIC, "FDIC Official Signs and Advertisement of Membership...", final rule, 91 FR 3812 (29 January 2026). https://www.federalregister.gov/documents/2026/01/29/2026-01806/fdic-official-signs-advertisement-of-membership-false-advertising-misrepresentation-of-insured
4. Cornell LII, 15 U.S.C. § 6802 (current). https://www.law.cornell.edu/uscode/text/15/6802
5. Cornell LII, 12 CFR § 1016.10 (current). https://www.law.cornell.edu/cfr/text/12/1016.10
6. Cornell LII, 12 CFR § 1016.12 (current). https://www.law.cornell.edu/cfr/text/12/1016.12
7. Cornell LII, 12 CFR § 1016.13 (current). https://www.law.cornell.edu/cfr/text/12/1016.13
8. Cornell LII, 15 U.S.C. § 1681a (current). https://www.law.cornell.edu/uscode/text/15/1681a
9. Cornell LII, 15 U.S.C. § 1681b (current). https://www.law.cornell.edu/uscode/text/15/1681b
10. Cornell LII, 15 U.S.C. § 1681m (current). https://www.law.cornell.edu/uscode/text/15/1681m