{"page":"/blog/bank-advertising-rules","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Rule","What it covers","Citation","What it means for a targeted ad"],"rows":[["GLBA and Regulation P: sharing","Disclosure of nonpublic personal information to nonaffiliated third parties: notice, opt-out, reasonable opportunity","15 U.S.C. 6802(a)-(c); 12 CFR 1016.10(a)","Handing an audience list to a brand or its DSP is a disclosure that needs this process unless an exception applies"],["Regulation P: service providers and joint marketing","Opt-out does not apply to disclosures to a third party performing services for the bank, under a contract limiting use","12 CFR 1016.13","Ad servers, agencies and clean rooms working for the bank can fit here; a merchant marketing its own brand is a different case"],["Regulation P: account numbers","No disclosure of account numbers to nonaffiliated third parties for telemarketing, direct mail or email marketing","15 U.S.C. 6802(d); 12 CFR 1016.12","Card numbers cannot be the matching key; encrypted numbers without a decode key are not account numbers"],["FCRA: prescreened offers","Consumer-report lists for credit or insurance only with a firm offer; content and form of the opt-out notice","15 U.S.C. 1681b(c); 1681m(d); 12 CFR 1022.54","A credit-score-based audience is a prescreen; each written solicitation carries the notice"],["FCRA: affiliate marketing","Using eligibility information from an affiliate to make solicitations needs notice and opt-out","15 U.S.C. 1681s-3; 12 CFR 1022.20-1022.22","A bank's insurance or brokerage affiliate cannot target on bank data until the opt-out runs"],["ECOA and Regulation B","No discrimination on a prohibited basis; no discouraging statements in advertising","15 U.S.C. 1691; 12 CFR 1002.4(b)","Words and images in credit ads are tested; audience selection is tested as disparate treatment since July 2026"],["Fair Housing Act","No notice, statement or advertisement for a dwelling showing preference or limitation on a protected basis","42 U.S.C. 3604(c)","Mortgage and home-equity ads carry a separate housing test"],["Truth in Savings and Regulation DD","Deposit ads: no misleading claims, APY as the only rate, \"free\" limits, bonus disclosures","12 U.S.C. 4302; 12 CFR 1030.8","A rate in a banner triggers APY terms; some media get a partial exemption"],["Truth in Lending and Regulation Z","Credit ads: trigger terms require extra disclosures; prohibited acts for dwelling-secured credit","12 CFR 1026.16; 12 CFR 1026.24","\"$25 a month\" or \"48 payments\" in an ad brings in the full set of terms"],["UDAAP and FTC Act Section 5","Unfair, deceptive or abusive acts in consumer finance; unfair or deceptive acts in commerce","12 U.S.C. 5531, 5536; 15 U.S.C. 45","The overall truthfulness test for every claim, including offers and partner placements"],["FDIC official sign and advertising statement","\"Member FDIC\" in deposit ads; digital sign on websites and apps; non-deposit signage","12 CFR 328.6; 328.5","Deposit ads carry the statement unless an exemption applies; crypto or investment ads must not imply insurance"],["FDIC misrepresentation of insured status","No person may imply an uninsured product is FDIC-insured","12 CFR 328.102","Applies to fintech partners and publishers, not only banks"],["State law","CCPA exempts GLBA-covered information only; California's financial privacy law sets its own sharing limits","Cal. Civ. Code 1798.145(e), in CCPA text effective 1 Jan 2026","Web and app data a bank collects outside GLBA can be \"sale\" or \"sharing\" under state law"]],"sourceUrls":[["https://www.law.cornell.edu/uscode/text/15/6802","https://www.law.cornell.edu/cfr/text/12/1016.10"],["https://www.law.cornell.edu/cfr/text/12/1016.13"],["https://www.law.cornell.edu/uscode/text/15/6802","https://www.law.cornell.edu/cfr/text/12/1016.12"],["https://www.law.cornell.edu/uscode/text/15/1681b","https://www.law.cornell.edu/uscode/text/15/1681m","https://www.ecfr.gov/current/title-12/chapter-X/part-1022/subpart-I/section-1022.54"],["https://www.law.cornell.edu/uscode/text/15/1681s-3","https://www.law.cornell.edu/cfr/text/12/1022.21"],["https://www.law.cornell.edu/uscode/text/15/1691","https://www.ecfr.gov/current/title-12/chapter-X/part-1002/subpart-A/section-1002.4"],["https://www.law.cornell.edu/uscode/text/42/3604"],["https://www.law.cornell.edu/uscode/text/12/4302","https://www.law.cornell.edu/cfr/text/12/1030.8"],["https://www.law.cornell.edu/cfr/text/12/1026.16","https://www.law.cornell.edu/cfr/text/12/1026.24"],["https://www.law.cornell.edu/uscode/text/12/5531","https://www.law.cornell.edu/uscode/text/12/5536","https://www.law.cornell.edu/uscode/text/15/45"],["https://www.ecfr.gov/current/title-12/chapter-III/subchapter-B/part-328/subpart-A/section-328.6","https://www.ecfr.gov/current/title-12/chapter-III/subchapter-B/part-328/subpart-A/section-328.5"],["https://www.ecfr.gov/current/title-12/chapter-III/subchapter-B/part-328/subpart-B/section-328.102"],["https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf"]]}