Ad Tech Compliance
GLBA and Advertising: Rules for Using Bank Customer Data
Published · Last updated
Next scheduled review:
GLBA lets a financial institution use its own customers' nonpublic personal information to market to them, and share it with service providers under contract. Sharing with nonaffiliated advertisers requires notice and an opt-out, and account numbers may never be shared for marketing. Financial media networks therefore keep data inside, sell audiences and outcomes, and never hand records to brands.
This page is general information for compliance and product teams. It is not legal advice.
Key facts
- The statute has four moving parts. 15 U.S.C. § 6802 requires notice before sharing nonpublic personal information with a nonaffiliated third party (a), an opt-out (b), limits on reuse by the recipient (c), and a flat ban on sharing account numbers for marketing (d) (15 U.S.C. § 6802).
- Cookie data is financial information. Regulation P's examples of personally identifiable financial information include "any information you collect through an internet 'cookie'" and "credit or debit card purchase information" (12 CFR § 1016.3).
- Opt-out means 30 days. A consumer must get a reasonable opportunity to opt out before disclosure; the rule's example is 30 days from mailing or from electronic acknowledgement (12 CFR § 1016.10).
- Breaches now go to the FTC within 30 days. The Safeguards Rule amendment announced 27 October 2023 requires non-bank financial institutions to notify the FTC of breaches affecting at least 500 consumers no later than 30 days after discovery; it took effect in May 2024 (FTC, 27 October 2023; FTC Safeguards guidance).
- PCI DSS v4.0.1 is the only supported card-data standard. Published 11 June 2024; v4.0 retired 31 December 2024; future-dated requirements mandatory since 31 March 2025 (PCI SSC, 11 June 2024).
- The market is growing under these constraints. eMarketer forecasts US financial media network ad spend of $680 million in 2025 rising to $3.15 billion in 2028 (eMarketer, January 2026). Chase Media Solutions alone reports $11.2 billion of merchant spend driven in 2025 (Chase Media Solutions).
Definition
Nonpublic personal information (NPI): under Regulation P, "personally identifiable financial information" plus "any list, description, or other grouping of consumers" derived from it, excluding publicly available information. Personally identifiable financial information is any information a consumer provides to obtain a financial product, any information "resulting from any transaction involving a financial product or service", and anything else obtained in connection with providing one (12 CFR § 1016.3).
Who the rules cover, and which regulator enforces them
GLBA Title V applies to "financial institutions": banks, credit unions, card issuers, lenders, payment companies, money transmitters and other businesses "significantly engaged" in financial activities. The privacy rule is Regulation P (12 CFR Part 1016), enforced by the CFPB and the prudential regulators for banks and credit unions, and by the FTC under its own Privacy Rule (16 CFR Part 313) for non-bank financial institutions. The Safeguards Rule (16 CFR Part 314) applies to the FTC's population; banks follow the Interagency Guidelines Establishing Information Security Standards instead (FTC Safeguards guidance).
Card networks sit in a different position from issuers. Mastercard and Visa receive transaction data under contracts with issuers and merchants rather than from a consumer relationship, so their obligations are largely contractual and PCI-driven, with GLBA reaching them as service providers to issuers. The four networks in the table below span both positions: Chase and Amex are issuers; PayPal is a payment company with its own consumer relationship; Mastercard is a network.
The GLBA and Regulation P rules, in one table
10 of 10 rows
Download JSONTable by AdSovereign, CC BY 4.0.
What counts as NPI | PIFI plus any list derived from it; excludes publicly available information | Transaction history, balances, card purchases, and web-cookie data collected by the institution are all NPI; an audience segment built from them is also NPI | |
Consumer vs customer | A consumer obtained a product; a customer has an ongoing relationship; customers get annual notices | Prospects who only applied are still protected for what they gave you | |
Affiliates | Sharing with affiliates (common control) is outside the opt-out rule under GLBA; but using affiliate "eligibility information" for solicitations needs FCRA notice and opt-out | A bank's media unit can use data across affiliates, but an affiliate marketing to the customer on that basis must honor a Reg V opt-out of at least five years (§ 1022.22) | |
Nonaffiliated third parties | No disclosure unless initial notice, opt-out notice, reasonable opportunity (30 days), and no opt-out received | Giving an advertiser a customer list, even hashed, is a disclosure that needs this process | |
Service provider and joint marketing exception | Opt-out not required for disclosure to a nonaffiliate "to perform services for you" or under a joint agreement with another financial institution, if the initial notice is given and a contract "prohibits the third party from disclosing or using the information" beyond the stated purpose | The route for ad servers, clean rooms, measurement vendors and agencies working for the institution; the contract is the control | |
Processing exceptions | Disclosures necessary to effect, administer or enforce a transaction the consumer requested, including processing card payments and accruing incentives or bonuses | Settling a card-linked offer with a merchant is covered; building a lookalike audience for that merchant is not | |
Other exceptions | With the consumer's consent or direction (revocable); fraud prevention; legal compliance; consumer reporting; business transfers | Express consent opens disclosures the opt-out model would not; PayPal's opt-in in three states is an example | |
Reuse and redisclosure | A nonaffiliate that receives NPI may not pass it to another nonaffiliate unless the institution could have done so directly | A clean-room partner or agency cannot onward-share what it learns | |
Account numbers | No disclosure of account, credit card or transaction account numbers to nonaffiliates for telemarketing, direct mail or email marketing; encrypted numbers without the key are not "account numbers"; agents performing the institution's own marketing are exempt if they cannot initiate charges | PAN can never be the join key with an advertiser; tokens without a decode path are permitted | |
Annual notice | Customers receive a privacy notice annually unless the institution shares only under exceptions and has not changed its policy | Launching a media network that shares with nonaffiliates usually resets the notice |
What this means for the four ways a media network uses data
4 of 4 rows
Download JSONTable by AdSovereign, CC BY 4.0.
Onsite offers (cash-back offers in the bank's app, targeted on purchase history; the brand sees only redemptions) | Nobody outside the institution; the merchant learns of a purchase only when a customer redeems, which is a transaction the customer requested | Own-marketing use; settlement falls under the processing exception (§ 1016.14) | None under GLBA beyond the notice; the Chase notice says sharing "for our marketing purposes" cannot be limited (Chase privacy notice, December 2025) |
Offsite audiences (the institution's segments used to buy media on other sites through a DSP or clean room) | The DSP, clean room or SSP as service provider; the publisher sees an opaque ID | Service-provider exception with a contract that bars other use (§ 1016.13); if a brand's own DSP receives the segment, that is a nonaffiliate disclosure needing opt-out (§ 1016.10) | Opt-out where any nonaffiliate receives the list; "for nonaffiliates to market to you" is the line in the model notice |
Measurement and attribution (matching exposures to purchases; reporting lift) | Measurement vendor as service provider; brand receives aggregates | Service-provider exception; reuse limits bind the vendor (§ 6802(c)) | None if only aggregates leave; opt-out if person-level results are shared |
Data licensing (selling transaction-derived segments or insights to brands or data companies) | A nonaffiliate, for its own use | Nonaffiliate disclosure: notice plus opt-out; account numbers never (§ 1016.12) | Opt-out, and in practice opt-in in states that require it; most networks avoid this model |
The first three rows describe what Chase, PayPal, Mastercard and Amex say they do. None of them describes the fourth, which is the shape the rule imposes. The commercial logic behind the shape is in Financial media networks explained and the architecture in How a bank can launch a media network without moving customer data.
Security rules: Safeguards, interagency guidance and PCI DSS
Safeguards Rule (FTC-covered institutions). The program must have a designated qualified individual, a written risk assessment, access controls, a data inventory, encryption in transit and at rest, multi-factor authentication, secure disposal within two years of last use, logging and monitoring, annual penetration testing and six-monthly vulnerability scans, staff training, service-provider oversight, a written incident response plan and an annual written report to the board (FTC Safeguards guidance). Since May 2024, a "notification event" involving unencrypted information of at least 500 consumers must be reported to the FTC within 30 days (FTC, 27 October 2023). An ad tech vendor holding segments or event logs for a fintech is inside this program's scope as a service provider.
Banks. Banks follow the Interagency Guidelines and the third-party risk management guidance that the Federal Reserve, FDIC and OCC issued jointly on 6 June 2023, which covers planning, due diligence, contracting, ongoing monitoring and termination for third parties including technology companies (Federal Reserve, 6 June 2023). A DSP, clean room or retail-media platform is a third-party relationship under that guidance.
PCI DSS. Card data is governed by PCI DSS v4.0.1, published 11 June 2024, the only supported version since v4.0 was retired on 31 December 2024; its future-dated requirements became mandatory on 31 March 2025 (PCI SSC, 11 June 2024). For advertising the consequence is simple: the primary account number is cardholder data, it cannot be used as a join key or identifier in any marketing system, and any system that touches it is in PCI scope. Networks build targeting on tokenized or internal customer IDs and keep the PAN in the payment environment. The wider control set is in Ad tech compliance: PCI, HIPAA, SOC 2 and the ad tech compliance hub.
The CFPB, open banking and the reopened privacy question
The CFPB's Personal Financial Data Rights rule under Section 1033 of the Dodd-Frank Act was issued on 22 October 2024, published in the Federal Register on 18 November 2024 and took effect on 17 January 2025 (CFPB). It is not being enforced as written. Bank trade groups sued in the Eastern District of Kentucky; on 29 July 2025 the court stayed the litigation pending a new rulemaking and stayed the compliance dates, which had run from 1 April 2026, by 90 days (Cooley, 27 August 2025). The CFPB published an advance notice of proposed rulemaking on 22 August 2025, with comments due 21 October 2025, asking whether data providers may charge fees, who may act as a consumer's "representative", whether data security standards are adequate and "whether GLBA and other privacy protections are sufficient" for third-party sharing (Cooley). As of 5 August 2026 the Bureau's regulatory agenda said it "plans to issue a proposed rule to reconsider" the 2024 rule (PYMNTS, 5 August 2026).
Two points matter for media networks. First, the 1033 rule governs data the consumer sends to a third party at the consumer's direction; it does not authorize the institution to share data for advertising. Second, the ANPR's question about GLBA adequacy is the first time the CFPB has openly asked whether the opt-out model is enough. A network built on opt-out today should assume a stricter answer is possible.
State law overlay
California's CCPA exempts "personal information collected, processed, sold, or disclosed subject to" GLBA, but the exemption is information-level, not entity-level (Cal. Civ. Code § 1798.145). Web analytics, app telemetry and advertising cookies that a bank collects outside the GLBA relationship are CCPA data with sale and sharing opt-outs. PayPal's decision to run an opt-in for California, North Dakota and Vermont residents and an opt-out everywhere else illustrates the patchwork (Digital Transactions, 1 October 2024). Health-adjacent purchases, such as pharmacy or clinic transactions, add a further layer covered in HIPAA-compliant programmatic advertising.
How the four live networks describe data use
The table uses each company's own public statements. Where a company does not address a point, the cell says so.
4 of 4 rows
Download JSONTable by AdSovereign, CC BY 4.0.
Chase Media Solutions (JPMorgan Chase) | 3 April 2024; 80 million customers at launch; built on Figg (acquired 2022) | First-party transaction data across $1.94 trillion of annual card sales; offers targeted on purchase history | Chase Offers inside Chase's owned channels (app, site, email) | Campaign views, redemptions and incremental-lift reports via a performance dashboard; brands are charged only when a customer views and purchases; no statement that advertisers receive customer records | GLBA notice (December 2025): sharing "for our marketing purposes" cannot be limited; "for nonaffiliates to market to you" can be limited by phone or at chase.com/privacypreferences; online policy offers DAA opt-out for interest-based ads | Chase, 3 April 2024; Chase Media Solutions; Chase privacy notice; Chase online privacy policy, September 2023 |
PayPal Ads (PayPal, Venmo, Honey) | Onsite earlier; Offsite Ads 29 April 2025 (US); Germany and UK 17 September 2025 | Transaction graph of more than 430 million consumer and merchant accounts across about 200 markets; "actual cross-merchant purchase data" | PayPal properties; Offsite display, video and CTV on third-party sites and apps | Audiences based on "real shopping intent" and closed-loop measurement; the press release describes "strict privacy protections" and "privacy-safe messaging" without stating what advertisers see | Personalized-shopping sharing with merchants effective 27 November 2024; opt-in for California, North Dakota and Vermont, opt-out elsewhere via Data & Privacy settings; accounts found opted in by default at launch | PayPal, 17 September 2025; PPC Land, 29 April 2025; Digital Transactions, 1 October 2024; 404 Media, 1 October 2024 |
Mastercard Commerce Media | 1 October 2025 | "Permissioned data" linked to 160 billion annual transactions; about 500 million enrolled consumers; Dynamic Yield personalization | Mastercard owned channels and partner bank and publisher inventory; point of sale and wallets planned | Audience identification and purchase attribution; about 25,000 existing advertisers; company claim of up to 22x return on ad spend; no statement on whether individual-level data is shared | Described as "permissioned"; the coverage does not explain how consent is obtained or managed | |
Amex Ads (American Express) | 6 October 2025 | First-party spend data across online and offline purchases on Amex and partner cards; "360-degree view" of card-member spend | AmexTravel.com first, other Amex-owned platforms later; direct-sold | Targeted placements and measurement linking exposure to online and offline sales; pilot results reported for Marriott Bonvoy and Tumi; the coverage does not describe consent, opt-out or what advertisers see | Not addressed in the launch coverage beyond an executive statement about maintaining privacy and security |
Three observations. First, every network keeps the identifier inside: brands buy an audience or an outcome, not a record. Second, only Chase's model privacy notice makes the GLBA sharing categories visible, and it shows the opt-out that GLBA requires for nonaffiliate marketing. Third, PayPal is the only one of the four that has published a consumer-facing mechanism for sharing with merchants, and it chose opt-in where state law demands it. The full roster of networks, including non-financial ones, is in the Commerce media networks directory.
A compliant data flow
Diagram by AdSovereign, CC BY 4.0.
The same topology serves EU and UK institutions with GDPR substituted for GLBA and consent substituted for opt-out; the bidstream rules are in GDPR, ePrivacy and the bidstream, and the hosting question in the data sovereignty hub.
Checklist for a financial media network
- Classify every field. Mark transaction, balance, card and cookie data as NPI (§ 1016.3); mark the PAN as cardholder data under PCI DSS v4.0.1.
- Decide the model. Onsite offers and service-provider buying need notice only; any nonaffiliate receiving a list needs the opt-out process (§ 1016.10).
- Update the privacy notice. If "for nonaffiliates to market to you" changes from No to Yes, re-issue the notice and wait out the 30-day opportunity before the first disclosure.
- Build the opt-out register first. Feed it from every channel (phone, web, mail) and suppress at audience build and at ad serving.
- Contract every vendor as a service provider. Use § 1016.13 language that bars use beyond the engagement and onward disclosure (§ 1016.13); add the 2023 interagency third-party risk requirements for banks.
- Never export account numbers. Join on tokens that cannot be decoded by the recipient (§ 1016.12).
- Keep affiliates honest. If an affiliate markets on eligibility information from another affiliate, give the Reg V notice and honor a five-year opt-out (§ 1022.21; § 1022.22).
- Aggregate before it leaves. Measurement, lift and clean-room outputs should be aggregates with minimum cell sizes; see Clean room architectures compared.
- Map state law. Treat web and app data outside the GLBA relationship as CCPA data; implement opt-in where a state requires it, as PayPal did for three states.
- Run the Safeguards program on the ad stack. Qualified individual, risk assessment, encryption, MFA, logging, vendor oversight and the 30-day FTC breach notification apply to segments and event logs too.
- Watch Section 1033. Record which data flows would change if the CFPB tightens third-party sharing or consent rules in the reconsidered rule.
- Document the audit trail. For every campaign, be able to show the notice version, the opt-out state at serving time, the vendor contract and where the data sat; the controls that passed audit in one case are described in Case: finance ad tech compliance.
FAQ
Can a bank use my transaction data for advertising? Yes, for its own marketing and for offers shown in its own channels, with notice but without an opt-out under GLBA; Chase's model notice lists "for our marketing purposes" as sharing you cannot limit (Chase privacy notice, December 2025). Sharing your information with nonaffiliated companies so they can market to you requires an opt-out (12 CFR § 1016.10), and account numbers can never be shared for marketing (§ 1016.12).
Does GLBA require consent for marketing? No. GLBA is an opt-out regime: the institution must give notice and a reasonable opportunity, typically 30 days, to opt out before disclosing NPI to a nonaffiliated third party (12 CFR § 1016.10). Consent appears only as an exception that permits disclosures the consumer directs (§ 1016.15). Some states require opt-in for some sharing, which is why PayPal runs opt-in in California, North Dakota and Vermont (Digital Transactions, 1 October 2024).
What counts as nonpublic personal information under GLBA? Any personally identifiable financial information: what a consumer provides to get a product, what results from a transaction, and anything else obtained in providing the product, including "credit or debit card purchase information" and "any information you collect through an internet 'cookie'", plus any list of consumers derived from such information. Publicly available information is excluded (12 CFR § 1016.3).
Can banks share customer data with affiliates for marketing? GLBA's opt-out does not apply to affiliates, and Chase's notice shows affiliate sharing of transaction and experience information as "cannot limit" (Chase privacy notice). The Fair Credit Reporting Act adds a separate rule: an affiliate may not use eligibility information received from another affiliate to make a solicitation unless the consumer had notice and an opportunity to opt out, with exceptions for pre-existing relationships and consumer-initiated contact; the opt-out lasts at least five years (12 CFR § 1022.21; § 1022.22).
Does PCI DSS allow using card data for targeting? Not the card number. Under PCI DSS v4.0.1, published 11 June 2024 and the only supported version since 31 December 2024, the primary account number is cardholder data and every system that stores or processes it is in scope (PCI SSC). Networks therefore build audiences on tokenized customer IDs and transaction features, keep the PAN in the payment environment, and never use it as a join key with a partner, which GLBA independently prohibits for marketing (§ 1016.12).
How this works on owned infrastructure
The data flow above only works if the audience builder, the offer engine, the opt-out register and the measurement warehouse sit inside the institution's perimeter and the ad stack reaches them without copying records out. AdSovereign is an enterprise, on-premise RTB stack (DSP, SSP, exchange, DMP and clean room) that deploys inside that perimeter: segments are built on tokenized customer IDs where the transaction data already lives, the opt-out register suppresses at audience build and at bid time, offsite buying runs through an owned bidder under a § 1016.13-style contract, and the clean room returns aggregates only. The architecture page shows the zones, the security page maps the controls to the Safeguards elements and PCI scope, the use cases page covers banks and card networks, and the pilot page describes a 90-day evaluation on your own data.
Sources
- 15 U.S.C. § 6802, Obligations with respect to disclosures of personal information (Legal Information Institute). https://www.law.cornell.edu/uscode/text/15/6802
- 12 CFR § 1016.3, Definitions (Regulation P). https://www.law.cornell.edu/cfr/text/12/1016.3
- 12 CFR § 1016.5, Annual privacy notice to customers required. https://www.law.cornell.edu/cfr/text/12/1016.5
- 12 CFR § 1016.10, Limits on disclosure of nonpublic personal information to nonaffiliated third parties. https://www.law.cornell.edu/cfr/text/12/1016.10
- 12 CFR § 1016.12, Limits on sharing account number information for marketing purposes. https://www.law.cornell.edu/cfr/text/12/1016.12
- 12 CFR § 1016.13, Exception to opt out requirements for service providers and joint marketing. https://www.law.cornell.edu/cfr/text/12/1016.13
- 12 CFR § 1016.14, Exceptions to notice and opt out requirements for processing and servicing transactions. https://www.law.cornell.edu/cfr/text/12/1016.14
- 12 CFR § 1016.15, Other exceptions to notice and opt out requirements. https://www.law.cornell.edu/cfr/text/12/1016.15
- 12 CFR § 1022.21, Affiliate marketing opt-out and exceptions (Regulation V). https://www.law.cornell.edu/cfr/text/12/1022.21
- 12 CFR § 1022.22, Scope and duration of opt-out. https://www.law.cornell.edu/cfr/text/12/1022.22
- FTC, "FTC Amends Safeguards Rule to Require Non-Banking Financial Institutions to Report Data Security Breaches" (27 October 2023). https://www.ftc.gov/news-events/news/press-releases/2023/10/ftc-amends-safeguards-rule-require-non-banking-financial-institutions-report-data-security-breaches
- FTC, "FTC Safeguards Rule: What Your Business Needs to Know" (breach notification in effect May 2024). https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
- Federal Reserve Board, "Agencies issue final guidance on third-party risk management" (6 June 2023). https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230606a.htm
- PCI Security Standards Council, "Just Published: PCI DSS v4.0.1" (11 June 2024). https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1
- CFPB, "Required Rulemaking on Personal Financial Data Rights" (final rule 22 October 2024; Federal Register 18 November 2024; effective 17 January 2025). https://www.consumerfinance.gov/rules-policy/final-rules/required-rulemaking-on-personal-financial-data-rights/
- Cooley, "CFPB Reconsiders Section 1033 Rule, Signaling Potential Overhaul of Personal Financial Data Rights Framework" (27 August 2025). https://www.cooley.com/news/insight/2025/2025-08-27-cfpb-reconsiders-section-1033-rule-signaling-potential-overhaul-of-personal-financial-data-rights-framework
- PYMNTS, "CFPB Readies Changes to Open Banking Rule" (5 August 2026). https://www.pymnts.com/dashboard-post/legal/cfpb/2026/cfpb-readies-changes-to-open-banking-rule/
- California Civil Code § 1798.145 (CCPA exemptions). https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.145.&lawCode=CIV
- JPMorgan Chase, "Chase Launches Chase Media Solutions" (3 April 2024). https://media.chase.com/news/chase-launches-chase-media-solutions
- Chase Media Solutions, homepage (figures for 2025; retrieved 17 October 2026). https://www.chase.com/mediasolutions/home
- Chase, "U.S. Consumer Privacy Notice" (December 2025). https://www.chase.com/digital/resources/privacy-security/privacy/consumer-privacy-notice
- Chase, "Online Privacy Policy" (last updated September 2023). https://www.chase.com/digital/resources/privacy-security/privacy/online-privacy-policy
- PayPal Newsroom, "PayPal Expands Offsite Ads to Germany and the UK" (17 September 2025). https://newsroom.paypal-corp.com/2025-09-17-PayPal-Expands-Offsite-Ads-to-Germany-and-the-UK
- PPC Land, "PayPal launches Offsite Ads with transaction data targeting" (29 April 2025). https://ppc.land/paypal-launches-offsite-ads-with-transaction-data-targeting/
- Digital Transactions, "PayPal Updates Its User Agreement to Collect More Personalized Information" (1 October 2024). https://www.digitaltransactions.net/paypal-updates-its-user-agreement-to-collect-more-personalized-information/
- 404 Media, "PayPal Opted You Into Sharing Data Without Your Knowledge" (1 October 2024). https://www.404media.co/paypal-personalized-shopping-opt-out/
- Marketing Dive, "Mastercard makes bigger grab for commerce media dollars with new network" (1 October 2025). https://www.marketingdive.com/news/mastercard-bigger-grab-commerce-media-dollars-new-network/761568/
- MediaPost, "American Express Unveils Digital Ad Platform Using First-Party Data" (6 October 2025). https://www.mediapost.com/publications/article/409646/american-express-unveils-digital-ad-platform-using.html
- Axios, "Amex launches ads business" (6 October 2025; returned 403 to the fetcher, used in A1). https://www.axios.com/2025/10/06/amex-ads-american-express-media
- eMarketer, "The State of Financial Media Networks 2026" (January 2026; returned 403 to the fetcher, figures as used in A1). https://www.emarketer.com/content/state-of-financial-media-networks-2026
Changelog
18 October 2026: aligned the title and heading and applied recorded source-URL corrections where needed. Factual research cutoff remains 17 October 2026.
17 October 2026. First edition. Next review 15 January 2027: CFPB 1033 proposed rule, litigation status, network privacy notices.