GLBA Marketing Opt-Out and the Joint Marketing Exception: Regulation P and FCRA Affiliate Marketing Rules

What the rule says. Regulation P (12 CFR Part 1016) applies to financial institutions for which the CFPB writes GLBA privacy rules. It also binds third parties that are not financial institutions but receive nonpublic personal information from one (§ 1016.1(b)). Certain motor vehicle dealers fall under the FTC's own Privacy Rule, and SEC and CFTC registrants follow their agencies' rules.

The rule protects only individuals who obtain products "primarily for personal, family, or household purposes". Business customers are outside it (§ 1016.1(b)(1)). A consumer is anyone who obtains, or applies for, such a product. A customer is a consumer with a continuing relationship, such as a deposit account or a loan (§ 1016.3(e), (i), (j)).

Why it matters for advertising. Two definitions do most of the work. Nonpublic personal information includes "any list, description, or other grouping of consumers" derived from nonpublic financial data (§ 1016.3(p)). An audience segment built from transactions is therefore covered. The rule also excludes "aggregate information or blind data" that identifies no consumer (§ 1016.3(q)(2)(ii)(B)).

What the law requires. The statute bars disclosure to a nonaffiliated third party without three things (15 U.S.C. § 6802(b)(1)). The consumer needs a clear notice, a chance to say no before the first disclosure, and an explanation of how to say no. Regulation P turns this into a sequence. Each step has its own section.

Two details catch marketing teams. First, an opt-out survives the end of the relationship for data collected during it (§ 1016.7(i)(2)). Second, sharing data about a former customer who had no earlier opt-out chance needs a revised notice first (§ 1016.8(b)(1)(iii)).

What regulators have said. The model privacy form in the appendix to Part 1016 has a row "For nonaffiliates to market to you". Its instructions also define a separate reason, "For joint marketing with other financial companies", for which an opt-out is optional (Appendix to Part 1016). Using the model form "constitutes compliance with the notice content requirements" of §§ 1016.6 and 1016.7, though it is not mandatory (§ 1016.2(a)).

What practitioners do (practice, not law). A bank that adds a data partnership with an outside brand typically plans a revised notice cycle before the launch date. Many also keep one opt-out register that feeds audience building and ad serving. The rule does not prescribe that architecture; it prescribes the outcome.

What the rule requires. Section 1016.13 has three elements. The recipient must perform services for the institution or functions on its behalf. The institution must have given the initial notice. And a contract must prohibit the recipient "from disclosing or using the information other than to carry out the purposes for which you disclosed the information" (§ 1016.13(a)(1)).

The services may include two kinds of marketing (§ 1016.13(b)):

1. Marketing of the institution's own products or services, by any vendor.
2. Marketing of financial products offered under a joint agreement with one or more other financial institutions.

The statute words the contract duty differently. It requires a contract that obliges the third party "to maintain the confidentiality of such information" (15 U.S.C. § 6802(b)(2)). The exception removes the opt-out only. The initial notice still applies, and the notice must separately list the categories of data and contracted parties (§ 1016.6(a)(5)).

An example. A credit union wants to show its auto-loan ads to members on a streaming service. It sends a hashed email list to a demand-side platform (DSP). The DSP is marketing the credit union's own product, so the § 1016.13 route is available if the contract limits use to that campaign. If the same DSP also folds the list into an audience it sells to other advertisers, that use falls outside the purpose the contract describes.

Where it stops. A retailer, airline or consumer brand is usually not a financial institution. It therefore cannot be the other party to a "joint agreement" as § 1016.13(c) defines it. Giving such a brand a segment for the brand's own marketing is a disclosure to a nonaffiliated third party, which needs the opt-out process (§ 1016.10). The commercial models that run into this line are mapped in card-linked offers explained and financial media networks explained.

Onward sharing. A recipient may not pass the data to a fourth party unless the institution could lawfully have made that disclosure directly (15 U.S.C. § 6802(c); § 1016.11(d)).

The table separates terms the rule requires from terms practitioners add. Only the first group is law.

What the rule says. These exceptions go further than § 1016.13. They remove the opt-out, the § 1016.13 contract duty and the initial notice to non-customer consumers (§ 1016.14(a); § 1016.15(a)). Customers still receive their initial and annual notices.

Section 1016.14 covers disclosures "necessary to effect, administer, or enforce a transaction that a consumer requests or authorizes". Its definition includes accruing or recognising "incentives or bonuses associated with the transaction that are provided by you or any other party" (§ 1016.14(b)(2)(iv)). It also covers card authorization, settlement and clearing (§ 1016.14(b)(2)(vi)(A)). That is the text a card-linked offer program points to when it credits a reward.

Section 1016.15 lists consent or direction of the consumer, fraud prevention, risk control, disclosures to consumer reporting agencies, business transfers and legal process (§ 1016.15(a)). Consent can be revoked by a later opt-out (§ 1016.15(b)(2)).

The reuse limit. Data received under these exceptions may be used only for the activity the exception covers. The rule's own example says a processor "could not disclose that information to a third party for marketing purposes or use that information for your own marketing purposes" (§ 1016.11(a)(2)).

The statute. GLBA says an institution "shall not disclose, other than to a consumer reporting agency, an account number" for a card, deposit or transaction account to a nonaffiliated third party (15 U.S.C. § 6802(d)). The ban covers use "in telemarketing, direct mail marketing, or other marketing through electronic mail". The statute itself lists no exceptions.

The regulation. Regulation P repeats the ban and adds two exceptions (§ 1016.12(b)):

1. Disclosure to an agent or service provider "solely in order to perform marketing for your own products or services", if it cannot directly initiate charges to the account.
2. Disclosure to a participant in a private label credit card program or an affinity program, if participants are identified to the customer at enrolment.

Two clarifications narrow the ban further. An encrypted number is not an account number "as long as you do not provide the recipient with a means to decode" it (§ 1016.12(c)(1)). A transaction account excludes accounts to which third parties cannot initiate charges (§ 1016.12(c)(2)).

Where the text is silent. The ban names telemarketing, direct mail and email. It does not name display, video or social advertising. An account number is still nonpublic personal information, so the opt-out rules in § 1016.10 apply to any disclosure outside an exception. Whether § 1016.12 itself reaches an online ad channel is a question for counsel.

GLBA and affiliates. GLBA's opt-out covers disclosures to nonaffiliated third parties only (15 U.S.C. § 6802(b)). Sharing with a company under common control does not trigger it. The Fair Credit Reporting Act (FCRA) adds two rules that do apply among affiliates.

Rule 1: sharing "other information". Affiliates may share their own transaction and experience data without FCRA consequences. Other information, such as data from a credit application or a credit report, is different (15 U.S.C. § 1681a(d)(2)(A)). Sharing it stays outside the consumer report definition only if the consumer was told first and given a chance to opt out.

Rule 2: affiliate marketing (Regulation V, Subpart C). A company may not use "eligibility information" from an affiliate to make a solicitation without three conditions (12 CFR § 1022.21(a)). The consumer must get a concise notice and a reasonable, simple way to opt out, and must not have opted out. The rule's mail and email examples again use 30 days (§ 1022.24(b)). The opt-out lasts at least five years and can be renewed (§ 1022.22(b); § 1022.27).

The definitions decide most cases (§ 1022.20(b)):

• Eligibility information is what would be a consumer report if the affiliate exclusions did not exist. It excludes "aggregate or blind data" (§ 1022.20(b)(3)).
• A solicitation is marketing "to a particular consumer" based on that information. It excludes "marketing communications that are directed at the general public", such as television, magazine and billboard ads.
• A pre-existing business relationship lasts 18 months after a transaction or account, or three months after an inquiry or application (§ 1022.20(b)(4)).

The exceptions cover pre-existing relationships, consumer-initiated contact, a consumer's request for solicitations, services performed for an affiliate, employee-benefit communications, and conflicts with state insurance law (§ 1022.21(c)). A pre-checked box does not count as a request (§ 1022.21(d)(4)(iii)).

What the rule does not settle. The examples of a solicitation are a telemarketing call, direct mail and email (§ 1022.20(b)(5)(iii)). A display ad matched to one identified customer sits between "a particular consumer" and "the general public". We found no CFPB statement that places it on either side.

The answers below restate the rule text for the scenario as described. A changed fact, such as who controls the data or what the contract says, can change the answer.

The table covers federal rules only. Regulation P does not override state laws that give consumers more protection (§ 1016.17). The state overlay, including opt-in states, is summarised in GLBA and advertising with bank customer data. Credit offers built from credit-bureau data follow a third regime, covered in FCRA prescreen rules. Targeting choices for credit ads also raise fair lending questions, covered in fair lending advertising rules for targeted ads.

These points turn on facts or on interpretation that we could not settle from primary sources. Each one changes the answer in the decision table.

1. Platform terms as the § 1016.13 contract. Self-serve ad platforms publish standard customer-list terms. Whether those terms "prohibit" other use in the way § 1016.13(a)(1)(ii) requires depends on their wording at the time of upload.
2. Who is performing services for whom. A media network that runs a merchant's campaign on the bank's audience may be serving the bank, the merchant, or both. The rule asks whether the recipient performs services "for you".
3. When aggregate output stops being aggregate. Small cells, repeated queries and join keys can make a clean-room output identify people. The rule gives no numeric threshold; see clean room architectures compared for the design side.
4. Online channels and § 1016.12. The account-number ban names three channels and no others.
5. Targeted display ads as affiliate "solicitations". Regulation V's examples stop at telemarketing, direct mail and email.

A wider tour of the rules that sit beside GLBA in a bank's ad program is in bank advertising rules, and the hub for this topic is ad tech compliance.

1. 15 U.S.C. § 6802, Obligations with respect to disclosures of personal information (Cornell LII, accessed 9 November 2026). https://www.law.cornell.edu/uscode/text/15/6802
2. 12 CFR Part 1016, Privacy of Consumer Financial Information (Regulation P), eCFR, up to date as of 5 November 2026. https://www.ecfr.gov/current/title-12/chapter-X/part-1016
3. 12 CFR § 1016.3, Definitions (Cornell LII). https://www.law.cornell.edu/cfr/text/12/1016.3
4. 12 CFR § 1016.4, Initial privacy notice (Cornell LII). https://www.law.cornell.edu/cfr/text/12/1016.4
5. 12 CFR § 1016.5, Annual privacy notice (Cornell LII). https://www.law.cornell.edu/cfr/text/12/1016.5
6. 12 CFR § 1016.6, Information in privacy notices (Cornell LII). https://www.law.cornell.edu/cfr/text/12/1016.6
7. 12 CFR § 1016.7, Opt-out notice and methods (Cornell LII). https://www.law.cornell.edu/cfr/text/12/1016.7
8. 12 CFR § 1016.8, Revised privacy notices (Cornell LII). https://www.law.cornell.edu/cfr/text/12/1016.8
9. 12 CFR § 1016.9, Delivering notices (Cornell LII). https://www.law.cornell.edu/cfr/text/12/1016.9
10. 12 CFR § 1016.10, Limits on disclosure to nonaffiliated third parties (Cornell LII). https://www.law.cornell.edu/cfr/text/12/1016.10