Ad Tech Compliance
Does the GLBA service provider exception cover an advertiser, a DSP or a clean room?
Published · Last updated
The GLBA service provider exception lets a financial institution share customer information with a vendor that works for it under a contract limiting use. Whether that covers an advertiser, a demand-side platform (DSP) or a clean room depends on whose product the campaign promotes and what leaves the institution. Readings differ on merchant-funded offers.
Contents
Key facts
- The general disclosure rule sets out notice, an opportunity to opt out and the consumer’s choice. 12 CFR 1016.10(a).
- The service provider exception calls for an initial notice and a contract limiting the recipient’s use and disclosure to the purposes for which the information was disclosed. 12 CFR 1016.13(a).
- The rule describes marketing the institution’s own products or financial products under a written agreement with other financial institutions. 12 CFR 1016.13(b)–(c).
- The reuse and redisclosure limits differ according to the route by which the recipient received the information. 12 CFR 1016.11(a)–(b).
- The rule restricts sharing account numbers for marketing and states limited exceptions and a treatment for encrypted numbers. 12 CFR 1016.12(a)–(c).
- Nonpublic personal information includes personally identifiable financial information and certain lists derived from it. 12 CFR 1016.3(p)–(q).
Definition
Service provider exception refers to Regulation P’s provision for disclosure to a nonaffiliated party that performs functions for a financial institution under an initial notice and a use-limiting contract.
What the rule text says
6 of 6 rows
12 CFR 1016.10(a) | The general disclosure rule sets out notice, an opportunity to opt out and the consumer’s choice. | |
12 CFR 1016.13(a) | The service provider exception calls for an initial notice and a contract limiting the recipient’s use and disclosure to the purposes for which the information was disclosed. | |
12 CFR 1016.13(b)–(c) | The rule describes marketing the institution’s own products or financial products under a written agreement with other financial institutions. | |
12 CFR 1016.11(a)–(b) | The reuse and redisclosure limits differ according to the route by which the recipient received the information. | |
12 CFR 1016.12(a)–(c) | The rule restricts sharing account numbers for marketing and states limited exceptions and a treatment for encrypted numbers. | |
12 CFR 1016.3(p)–(q) | Nonpublic personal information includes personally identifiable financial information and certain lists derived from it. |
12 CFR 1016.10(a)
- What it says
The general disclosure rule sets out notice, an opportunity to opt out and the consumer’s choice.
- Source
12 CFR 1016.13(a)
- What it says
The service provider exception calls for an initial notice and a contract limiting the recipient’s use and disclosure to the purposes for which the information was disclosed.
- Source
12 CFR 1016.13(b)–(c)
- What it says
The rule describes marketing the institution’s own products or financial products under a written agreement with other financial institutions.
- Source
12 CFR 1016.11(a)–(b)
- What it says
The reuse and redisclosure limits differ according to the route by which the recipient received the information.
- Source
12 CFR 1016.12(a)–(c)
- What it says
The rule restricts sharing account numbers for marketing and states limited exceptions and a treatment for encrypted numbers.
- Source
12 CFR 1016.3(p)–(q)
- What it says
Nonpublic personal information includes personally identifiable financial information and certain lists derived from it.
- Source
Table by this library, CC BY 4.0.
The Gramm-Leach-Bliley Act (GLBA) privacy framework distinguishes the routes by which nonpublic personal information (NPI) reaches a recipient. Regulation P’s general route considers initial notice, an opt-out notice, a reasonable opportunity to opt out and whether the consumer did so. A different route can apply to a service provider under a qualifying contract and the initial notice. 12 CFR 1016.10(a); 12 CFR 1016.13(a).
Section 1016.13 describes services that include marketing the institution’s own products. It also describes joint marketing of financial products or services under a written agreement with other financial institutions. Calling a merchant relationship joint marketing in a commercial deck does not establish the role of that merchant in the regulation’s definition. 12 CFR 1016.13(b)–(c).
Separate exceptions concern processing or servicing a transaction the consumer requests or authorizes and disclosures at the consumer’s direction or with consent. Limits on a recipient’s subsequent use or disclosure turn on the route used. The rule on account numbers looks at the recipient, the marketing purpose and its means to decode an encrypted number. 12 CFR 1016.14(a)–(b); 12 CFR 1016.15(a)(1); 12 CFR 1016.11; 12 CFR 1016.12.
An audience list can derive from personally identifiable financial information. The rule treats aggregate or blind data without personal identifiers differently, so a report and a matching file can raise different questions. A merchant with its own lookup table can be in a different position from a merchant that receives a total. 12 CFR 1016.3(p)–(q).
California’s Consumer Privacy Act exemption addresses information subject to the federal law. An issuer’s notice can also describe separate practices for California and Vermont. The notice tells readers what the company states about its own choices and provides no general determination about another institution’s obligations. California Civil Code § 1798.145(e); Chase consumer privacy notice, California and Vermont, company statement.
Where readings differ
2 of 2 rows
A cautious reading | The exception covers vendors that work for the institution to market the institution's own products. A merchant, or a DSP that acts for a merchant, uses the audience to promote the merchant's brand and performs no service for the institution. That disclosure needs the notice and opt-out route, or it must be limited to outputs that are not NPI. | The words "to perform services for you or functions on your behalf"; the limit of joint marketing to financial institutions | Merchants receive aggregates only, or the audience is built from consumers who have not opted out |
A permissive reading | A merchant-funded offers program is the institution's own rewards product. Vendors that deliver and measure those offers, on or off the institution's own channels, serve the institution under a contract that limits use. The exception applies to them. | 1016.13(b), marketing of "your own products or services"; the use-limiting contract | Offsite delivery runs through vendors bound by contract, with the institution as the advertiser of record |
A cautious reading
- What it holds
The exception covers vendors that work for the institution to market the institution's own products. A merchant, or a DSP that acts for a merchant, uses the audience to promote the merchant's brand and performs no service for the institution. That disclosure needs the notice and opt-out route, or it must be limited to outputs that are not NPI.
- What it relies on
The words "to perform services for you or functions on your behalf"; the limit of joint marketing to financial institutions
- What it means for a design
Merchants receive aggregates only, or the audience is built from consumers who have not opted out
A permissive reading
- What it holds
A merchant-funded offers program is the institution's own rewards product. Vendors that deliver and measure those offers, on or off the institution's own channels, serve the institution under a contract that limits use. The exception applies to them.
- What it relies on
1016.13(b), marketing of "your own products or services"; the use-limiting contract
- What it means for a design
Offsite delivery runs through vendors bound by contract, with the institution as the advertiser of record
Table by this library, CC BY 4.0.
Where the readings collide. A merchant may pay for an offer while the institution calls it part of its rewards product. The issue is who controls the offer, targeting and buying seat, and what the merchant receives. The answer can differ between an onsite placement and an offsite campaign that exports audience rows.
Facts that change the answer
- Who is the advertiser of record at each placement?
- Who sets creative, eligibility and targeting rules?
- Whose seat buys the ads and who can change its settings?
- Which identifiers, segments, match results and totals leave the institution?
- What purpose limits and audit rights does each contract document?
- Which notices were given to the affected customers?
- In which states are the customers located?
- Does the offer promote a credit product?
An audience file and a merchant-facing report can look unrelated in a system diagram. A data map can show whether they share a key and who can look it up. The same map can show which service performs matching, which party keeps the inputs and whether a merchant receives more than totals.
Who controls the creative does not necessarily control the placement. A merchant may supply a logo while the institution sets who sees the offer. An offsite buyer may instead be able to change targeting or use the same audience for a new campaign. Contracts and access permissions make those differences concrete.
A notice can describe categories of sharing without naming each configuration. Counsel can pair its exact version with a dated test of who received the data and what the consumer chose. That record is particularly helpful when the campaign serves people in several states. Measurement can rely on a match without exposing the match file to the merchant. For example, a service can produce a count from an internal match and the merchant can see the count on a dashboard. The procurement record and output sample together show where the matching took place and which parties had access to the inputs.
A reporting contract can limit a vendor’s ability to use a list for another merchant while the platform still gives an operator broad access. A data flow review can record both the restriction and the actual permission. These records can help counsel distinguish a service delivered to the institution from a product the vendor operates for itself.
A design can also have different routes for delivery and redemption. Delivery may select an offer while redemption confirms a specific transaction. A map that records one purpose at each step gives counsel a way to consider a transaction exception without treating it as the basis for the whole program.
Questions to take to your counsel
- For each recipient, which Regulation P route applies: service provider, joint marketing, transaction, consent, or notice and opt-out?
- Is the offers program our own product for this purpose?
- Does any output to a merchant contain NPI, including a derived list?
- Does each contract limit use and redisclosure as 12 CFR 1016.13 and 1016.11 require?
- Do California, Vermont or other state rules require opt-in for this flow?
- Do our privacy notices describe this sharing accurately?
- Do credit-marketing rules apply to this campaign?
Bring the fact sheet from the counsel briefing kit so that counsel answers your flow, not a generic one.
How business strategy and risk appetite enter
The commercial return from merchant-funded offers may come from a commission, better retention or more use of an institution’s card. Each goal can rely on a different measurement or delivery design. Management can compare which data path supports the goal and which path adds uncertainty about a recipient’s role.
Switching off an export and changing the seller of record are different kinds of reversal. One can involve a configuration change and the other a revised contract and billing setup. The decision record can capture which assumptions were important when management decided to pursue the offer and when it plans to revisit them.
4 of 4 rows
Offers in institution-owned channels | Uses existing placements and direct reporting. | Eligibility, notice and downstream services still matter. | Placements can change without transferring a buying seat. |
Contracted vendors with aggregate outputs to merchants | Adds delivery or measurement capacity. | Vendor functions and the exact merchant outputs need review. | Replacing integrations and contracts can take time. |
Sharing under notice and opt-out | Connects delivery to a separate disclosure route. | Scope, notices and consumer choices need evidence. | New disclosures can stop, while past copies remain a separate issue. |
Sharing with the consumer’s consent | Connects sharing to a specific recorded choice. | Consent scope, other rules and recipient reuse remain open. | Suppression can change faster than downstream contracts. |
Offers in institution-owned channels
- What it gives the business
Uses existing placements and direct reporting.
- What stays open
Eligibility, notice and downstream services still matter.
- How hard it is to reverse
Placements can change without transferring a buying seat.
Contracted vendors with aggregate outputs to merchants
- What it gives the business
Adds delivery or measurement capacity.
- What stays open
Vendor functions and the exact merchant outputs need review.
- How hard it is to reverse
Replacing integrations and contracts can take time.
Sharing under notice and opt-out
- What it gives the business
Connects delivery to a separate disclosure route.
- What stays open
Scope, notices and consumer choices need evidence.
- How hard it is to reverse
New disclosures can stop, while past copies remain a separate issue.
Sharing with the consumer’s consent
- What it gives the business
Connects sharing to a specific recorded choice.
- What stays open
Consent scope, other rules and recipient reuse remain open.
- How hard it is to reverse
Suppression can change faster than downstream contracts.
Table by this library, CC BY 4.0.
Which option fits is a business decision taken with counsel. It depends on how much the program is worth to you, how much uncertainty you accept and who signs for it.
Status and recent developments
The Consumer Financial Protection Bureau’s public rulemaking index separates current activity from codified rules. The index reviewed on 10 November 2026 did not list a pending Regulation P amendment for the service provider exception. {V05b:CFPB, rules under development, checked 10 November 2026}.
Related references
FAQ
Can a bank share customer lists with advertisers?
What is the GLBA service provider exception?
Are card-linked offers joint marketing?
Is a hashed customer list NPI?
How this works on owned infrastructure
A bank running campaign logic on its own infrastructure can limit where a buying system reads eligibility and where a merchant receives a report. A table of outbound fields can distinguish a row key from a campaign total. Logs can help show which seat sent the request and which service received it.
AdSovereign can run inside boundaries the institution controls. The architecture describes the control points a bank can compare with its own flow. Counsel still needs to classify what each recipient got, which purpose it served and how the contract limits later use.
Sources
- 12 CFR 1016.10(a). Checked 10 November 2026.
- 12 CFR 1016.13(a). Checked 10 November 2026.
- 12 CFR 1016.13(b)–(c). Checked 10 November 2026.
- 12 CFR 1016.11(a)–(b). Checked 10 November 2026.
- 12 CFR 1016.12(a)–(c). Checked 10 November 2026.
- 12 CFR 1016.3(p)–(q). Checked 10 November 2026.
- 12 CFR 1016.14(a)–(b), transaction and servicing exceptions. Checked 10 November 2026.
- 12 CFR 1016.15(a)(1), consent or direction. Checked 10 November 2026.
- California Civil Code § 1798.145(e), exemption for specified information. Checked 10 November 2026.
- Chase consumer privacy notice, California and Vermont (company statement). Checked 10 November 2026.
More sources (1)
- CFPB rules under development, public index. Checked 10 November 2026.
Changelog
- 10 November 2026: Published.