{"page":"/blog/glba-advertising-bank-data","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Use case","Who receives NPI","GLBA treatment","Consumer control required"],"rows":[["Onsite offers (cash-back offers in the bank's app, targeted on purchase history; the brand sees only redemptions)","Nobody outside the institution; the merchant learns of a purchase only when a customer redeems, which is a transaction the customer requested","Own-marketing use; settlement falls under the processing exception (§ 1016.14)","None under GLBA beyond the notice; the Chase notice says sharing \"for our marketing purposes\" cannot be limited (Chase privacy notice, December 2025)"],["Offsite audiences (the institution's segments used to buy media on other sites through a DSP or clean room)","The DSP, clean room or SSP as service provider; the publisher sees an opaque ID","Service-provider exception with a contract that bars other use (§ 1016.13); if a brand's own DSP receives the segment, that is a nonaffiliate disclosure needing opt-out (§ 1016.10)","Opt-out where any nonaffiliate receives the list; \"for nonaffiliates to market to you\" is the line in the model notice"],["Measurement and attribution (matching exposures to purchases; reporting lift)","Measurement vendor as service provider; brand receives aggregates","Service-provider exception; reuse limits bind the vendor (§ 6802(c))","None if only aggregates leave; opt-out if person-level results are shared"],["Data licensing (selling transaction-derived segments or insights to brands or data companies)","A nonaffiliate, for its own use","Nonaffiliate disclosure: notice plus opt-out; account numbers never (§ 1016.12)","Opt-out, and in practice opt-in in states that require it; most networks avoid this model"]],"sourceUrls":[["https://www.law.cornell.edu/cfr/text/12/1016.14","https://www.chase.com/digital/resources/privacy-security/privacy/consumer-privacy-notice"],["https://www.law.cornell.edu/cfr/text/12/1016.13","https://www.law.cornell.edu/cfr/text/12/1016.10"],["https://www.law.cornell.edu/uscode/text/15/6802"],["https://www.law.cornell.edu/cfr/text/12/1016.12"]]}