Ad Tech Compliance
Are card networks covered by GLBA, and what does that mean for their advertising data?
Published · Last updated
Whether card networks are covered by GLBA depends on the legal entity and the activity. The statute defines financial institutions by what they do, and its privacy and security rules attach in different ways. Lawyers differ on how the rules apply to a network that processes payments and also runs a media business.
Contents
Key facts
- The statute defines a financial institution by reference to financial activities under the Bank Holding Company Act. 15 U.S.C. § 6809(3).
- The Federal Reserve rule lists processing and transmission activities involving specified financial, banking or economic data. 12 CFR 225.28(b)(14).
- Regulation P identifies the financial institutions and persons within its scope. 12 CFR 1016.1(b).
- The Safeguards Rule covers customer information held by covered institutions, including information about customers of other financial institutions. 16 CFR 314.1(b).
- The rule calls for notice to the Federal Trade Commission for a qualifying notification event. 16 CFR 314.4(j).
- The disclosure route can limit a recipient’s reuse and redisclosure. 12 CFR 1016.11.
Definition
Financial institution under the Gramm-Leach-Bliley Act (GLBA) refers to an institution whose business involves activities described as financial in section 4(k) of the Bank Holding Company Act.
What the rule text says
6 of 6 rows
15 U.S.C. § 6809(3) | The statute defines a financial institution by reference to financial activities under the Bank Holding Company Act. | |
12 CFR 225.28(b)(14) | The Federal Reserve rule lists processing and transmission activities involving specified financial, banking or economic data. | |
12 CFR 1016.1(b) | Regulation P identifies the financial institutions and persons within its scope. | |
16 CFR 314.1(b) | The Safeguards Rule covers customer information held by covered institutions, including information about customers of other financial institutions. | |
16 CFR 314.4(j) | The rule calls for notice to the Federal Trade Commission for a qualifying notification event. | |
12 CFR 1016.11 | The disclosure route can limit a recipient’s reuse and redisclosure. |
15 U.S.C. § 6809(3)
- What it says
The statute defines a financial institution by reference to financial activities under the Bank Holding Company Act.
- Source
12 CFR 225.28(b)(14)
- What it says
The Federal Reserve rule lists processing and transmission activities involving specified financial, banking or economic data.
- Source
12 CFR 1016.1(b)
- What it says
Regulation P identifies the financial institutions and persons within its scope.
- Source
16 CFR 314.1(b)
- What it says
The Safeguards Rule covers customer information held by covered institutions, including information about customers of other financial institutions.
- Source
16 CFR 314.4(j)
- What it says
The rule calls for notice to the Federal Trade Commission for a qualifying notification event.
- Source
12 CFR 1016.11
- What it says
The disclosure route can limit a recipient’s reuse and redisclosure.
- Source
Table by this library, CC BY 4.0.
GLBA points to the activity-based definition in the Bank Holding Company Act. Federal Reserve rules include providing data processing and data transmission services where the data to be processed or furnished meet the rule’s conditions. Different entities in a network group can perform different activities. {V06a:15 U.S.C. § 6809(3)}; {V06b:12 U.S.C. § 1843(k)}; {V06c:12 CFR 225.28(b)(14)}.
A consumer under Regulation P is an individual who obtains a financial product or service from the institution for personal, family or household purposes. One example treats a borrower as a consumer of an institution that holds ownership or servicing rights to the loan. A separate example concerns a company that only acts as another institution’s agent or processor. 12 CFR 1016.3(e)(1), (e)(2)(iv)–(v).
The Safeguards Rule addresses customer information and coverage within the Federal Trade Commission’s jurisdiction. It expressly addresses information from other financial institutions. Its incident notice requirement took effect on 13 May 2024. Those provisions answer security questions distinct from the notice, opt-out and use limits for a disclosure. 16 CFR 314.1(b); 16 CFR 314.2; 16 CFR 314.4(j); 16 CFR 314.5.
A network receiving nonpublic personal information (NPI) can face limits tied to the route by which it received the information. Transaction processing and providing a service under a use-limiting contract have their own provisions. Counsel can match the route to both the processing activity and a later proposed media use. 12 CFR 1016.11; 12 CFR 1016.13; 12 CFR 1016.14.
The Payment Card Industry Data Security Standard (PCI DSS) sets a baseline of technical and operational requirements for payment account data. A security standard’s scope differs from the statutory terms that govern a disclosure for marketing. Contracts can name the standard along with separate obligations for use and reporting. {V06d:PCI Security Standards Council, PCI DSS, overview}; 12 CFR 1016.11.
Where readings differ
3 of 3 rows
Reading 1: the network as service provider | A network that only processes transactions for issuers and acquirers has no consumer relationship of its own. Its privacy duties come from its contracts with issuers and from the reuse limits that travel with the data. | The definition of consumer in 1016.3(e); 1016.11, 1016.13 and 1016.14 | The issuer's contract and the route of disclosure decide what the network may do |
Reading 2: the network as financial institution | Processing financial data is itself a financial activity, so a network entity can be a financial institution in its own right under the Federal Trade Commission's rules. The Safeguards Rule then applies directly to the customer information it holds, even where notice and opt-out duties do not arise. | The activity-based definition; 16 CFR 314.1(b) | Security duties attach by rule, not only by contract; privacy duties still follow the route |
A different position | A network that also issues cards through its own bank has consumers and customers of its own for that business. | The definitions of consumer and customer | Issuer rules apply to the issuing business |
Reading 1: the network as service provider
- What it holds
A network that only processes transactions for issuers and acquirers has no consumer relationship of its own. Its privacy duties come from its contracts with issuers and from the reuse limits that travel with the data.
- What it relies on
The definition of consumer in 1016.3(e); 1016.11, 1016.13 and 1016.14
- What it means for a design
The issuer's contract and the route of disclosure decide what the network may do
Reading 2: the network as financial institution
- What it holds
Processing financial data is itself a financial activity, so a network entity can be a financial institution in its own right under the Federal Trade Commission's rules. The Safeguards Rule then applies directly to the customer information it holds, even where notice and opt-out duties do not arise.
- What it relies on
The activity-based definition; 16 CFR 314.1(b)
- What it means for a design
Security duties attach by rule, not only by contract; privacy duties still follow the route
A different position
- What it holds
A network that also issues cards through its own bank has consumers and customers of its own for that business.
- What it relies on
The definitions of consumer and customer
- What it means for a design
Issuer rules apply to the issuing business
Table by this library, CC BY 4.0.
Where the readings collide. The same group can house transaction processing, an issuing bank and a media product in different entities. Counsel can examine which of them held the data and who decided to reuse it. The labels aggregated and anonymized also depend on which fields leave and what a recipient can match.
Facts that change the answer
- Which legal entity is the counterparty and which entities receive data?
- Does each entity handle processing, issuance, loyalty, media or insights?
- Where did the transaction data come from and through which disclosure route?
- Which uses do issuer and acquirer contracts describe?
- Which fields, counts or keys leave the network and who gets them?
- Which state and national rules cover the activity?
A brand name on an invoice can cover more than one company or service. A signed agreement and a system map can identify the counterparty, the processor and the party operating the media service. Counsel can compare the roles before reaching a view about which rules attach to each.
A processing network might generate a report for the issuer under one arrangement and offer analysis to a merchant under another. The same count can travel with different keys, filters and timing in each arrangement. The contract and a sample of the actual output help reveal which use counsel needs to assess.
One institution can view a file as aggregate while a merchant holds transaction receipts that narrow its groups. The meeting record can state which recipient, reference data and date supported the assessment. If the merchant gets new data or the reporting cadence changes, counsel can revisit the same conclusion with updated facts. A network could receive the same type of transaction field through two contracts. One arrangement may cover routing and settling a payment, while another may cover reporting for a rewards program. Counsel can examine where each field in a media output came from before deciding which restrictions follow that field.
The analysis also changes when a separate entity operates the media service. An internal transfer between members of a group can appear as a line on the system map, even if a buyer deals with just one contact. A review can link that step to a legal entity, service description and recipient’s access rights.
When an output is described as aggregate, the facts can include the grouping rule and minimum group size. The number of times a merchant can retrieve the same output can matter too. A sample across consecutive releases may give counsel a more useful picture than a single report displayed in a product demo.
The source record can include changes to entity names or ownership over time. An old contract may name a different affiliate from the one running the current service. The two names can be reconciled against the actual recipients.
Questions to take to your counsel
- Which entity is our counterparty, and is it a financial institution under GLBA for this activity?
- Under which Regulation P route did the data reach the network, and what reuse does that route allow?
- What does our contract say about the network's own use of transaction data?
- What standard does "aggregated" or "anonymized" meet, and who tested it?
- Which state privacy laws apply to data outside the GLBA exemption?
- Which security rule applies to each party: the Safeguards Rule, banking-agency guidelines, payment-card standards, or several?
Bring the fact sheet from the counsel briefing kit so that counsel answers your flow, not a generic one.
How business strategy and risk appetite enter
An institution may get value from network-wide insights even when its own records cover only its customers. The same program can also seek row-level audience matches or attribution. Each output changes the amount of data involved and the value management is weighing against uncertainty about reuse.
The reversal cost depends in part on where the work sits. A change to a reporting schema can be quicker than moving a long-running processing integration. A decision record can tie each assumption to a counterparty, activity and output so the team can revisit only the parts that change.
3 of 3 rows
Buy aggregate insights only | Uses market patterns without requesting customer records. | Small cells, repeated outputs and match capability still matter. | Report dimensions can change without changing the processing contract. |
Limit network reuse by contract | Connects permitted use to the documented service and purpose. | Existing routes, data copies and actual behavior need review. | A negotiated limit can require amendments across several parties. |
Ask for written source and route evidence | Gives counsel an account of how a media audience was made. | Entity classification and recipient ability to identify people still matter. | The evidence requirement can travel with the procurement process. |
Buy aggregate insights only
- What it gives the business
Uses market patterns without requesting customer records.
- What stays open
Small cells, repeated outputs and match capability still matter.
- How hard it is to reverse
Report dimensions can change without changing the processing contract.
Limit network reuse by contract
- What it gives the business
Connects permitted use to the documented service and purpose.
- What stays open
Existing routes, data copies and actual behavior need review.
- How hard it is to reverse
A negotiated limit can require amendments across several parties.
Ask for written source and route evidence
- What it gives the business
Gives counsel an account of how a media audience was made.
- What stays open
Entity classification and recipient ability to identify people still matter.
- How hard it is to reverse
The evidence requirement can travel with the procurement process.
Table by this library, CC BY 4.0.
Which option fits is a business decision taken with counsel. It depends on how much the program is worth to you, how much uncertainty you accept and who signs for it.
Status and recent developments
The notification event provision took effect on 13 May 2024. The Federal Trade Commission’s guide describes coverage and the separate incident notification step. 16 CFR 314.5, effective dates; FTC Safeguards Rule guide, checked 10 November 2026.
Related references
FAQ
Is a card network a financial institution under GLBA?
Does the Safeguards Rule apply to payment processors?
Can a card network use transaction data for advertising?
Is PCI DSS a privacy law?
How this works on owned infrastructure
An institution can keep transaction matching and media reporting in distinct access zones when it operates the relevant systems. A record of each output can name its owner, fields and recipient. This helps separate processing on the institution’s behalf from a media service receiving another set of data.
AdSovereign can run on infrastructure the operator controls. Its architecture provides a way to discuss those boundaries with counsel. The location of a join, limits on access and actual exports can change the facts. The legal entity and nature of the work still need separate analysis.
Sources
- 15 U.S.C. § 6809(3). Checked 10 November 2026.
- 12 CFR 225.28(b)(14). Checked 10 November 2026.
- 12 CFR 1016.1(b). Checked 10 November 2026.
- 16 CFR 314.1(b). Checked 10 November 2026.
- 16 CFR 314.4(j). Checked 10 November 2026.
- 12 CFR 1016.11. Checked 10 November 2026.
- 12 U.S.C. § 1843(k), financial activities. Checked 10 November 2026.
- 12 CFR 1016.3(e), (p)–(q), consumer and information definitions. Checked 10 November 2026.
- 16 CFR 314.2, definitions. Checked 10 November 2026.
- 16 CFR 314.5, effective dates. Checked 10 November 2026.
More sources (4)
- PCI Security Standards Council, Payment Card Industry Data Security Standard overview. Checked 10 November 2026.
- Federal Trade Commission, Safeguards Rule guide, coverage and notification. Checked 10 November 2026.
- 12 CFR 1016.13(a), service provider and joint marketing exceptions. Checked 10 November 2026.
- 12 CFR 1016.14(a)–(b), transaction processing. Checked 10 November 2026.
Changelog
- 10 November 2026: Published.