{"page":"/blog/glba-advertising-bank-data","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Rule","What it says","Citation","Effect on an advertising business"],"rows":[["What counts as NPI","PIFI plus any list derived from it; excludes publicly available information","§ 1016.3","Transaction history, balances, card purchases, and web-cookie data collected by the institution are all NPI; an audience segment built from them is also NPI"],["Consumer vs customer","A consumer obtained a product; a customer has an ongoing relationship; customers get annual notices","§ 1016.3","Prospects who only applied are still protected for what they gave you"],["Affiliates","Sharing with affiliates (common control) is outside the opt-out rule under GLBA; but using affiliate \"eligibility information\" for solicitations needs FCRA notice and opt-out","§ 1016.3; 12 CFR § 1022.21","A bank's media unit can use data across affiliates, but an affiliate marketing to the customer on that basis must honor a Reg V opt-out of at least five years (§ 1022.22)"],["Nonaffiliated third parties","No disclosure unless initial notice, opt-out notice, reasonable opportunity (30 days), and no opt-out received","§ 1016.10","Giving an advertiser a customer list, even hashed, is a disclosure that needs this process"],["Service provider and joint marketing exception","Opt-out not required for disclosure to a nonaffiliate \"to perform services for you\" or under a joint agreement with another financial institution, if the initial notice is given and a contract \"prohibits the third party from disclosing or using the information\" beyond the stated purpose","§ 1016.13","The route for ad servers, clean rooms, measurement vendors and agencies working for the institution; the contract is the control"],["Processing exceptions","Disclosures necessary to effect, administer or enforce a transaction the consumer requested, including processing card payments and accruing incentives or bonuses","§ 1016.14","Settling a card-linked offer with a merchant is covered; building a lookalike audience for that merchant is not"],["Other exceptions","With the consumer's consent or direction (revocable); fraud prevention; legal compliance; consumer reporting; business transfers","§ 1016.15","Express consent opens disclosures the opt-out model would not; PayPal's opt-in in three states is an example"],["Reuse and redisclosure","A nonaffiliate that receives NPI may not pass it to another nonaffiliate unless the institution could have done so directly","15 U.S.C. § 6802(c)","A clean-room partner or agency cannot onward-share what it learns"],["Account numbers","No disclosure of account, credit card or transaction account numbers to nonaffiliates for telemarketing, direct mail or email marketing; encrypted numbers without the key are not \"account numbers\"; agents performing the institution's own marketing are exempt if they cannot initiate charges","§ 1016.12","PAN can never be the join key with an advertiser; tokens without a decode path are permitted"],["Annual notice","Customers receive a privacy notice annually unless the institution shares only under exceptions and has not changed its policy","§ 1016.5","Launching a media network that shares with nonaffiliates usually resets the notice"]],"sourceUrls":[["https://www.law.cornell.edu/cfr/text/12/1016.3"],["https://www.law.cornell.edu/cfr/text/12/1016.3"],["https://www.law.cornell.edu/cfr/text/12/1016.3","https://www.law.cornell.edu/cfr/text/12/1022.21","https://www.law.cornell.edu/cfr/text/12/1022.22"],["https://www.law.cornell.edu/cfr/text/12/1016.10"],["https://www.law.cornell.edu/cfr/text/12/1016.13"],["https://www.law.cornell.edu/cfr/text/12/1016.14"],["https://www.law.cornell.edu/cfr/text/12/1016.15"],["https://www.law.cornell.edu/uscode/text/15/6802"],["https://www.law.cornell.edu/cfr/text/12/1016.12"],["https://www.law.cornell.edu/cfr/text/12/1016.5"]]}