{"page":"/blog/glba-joint-marketing-exception","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Sharing scenario","Rule that decides","Notice or opt-out under the rule text","Citation"],"rows":[["Bank targets its own customers with its own card offer inside its app","No disclosure to a nonaffiliated third party","Privacy notice describes practices; no opt-out because nothing is disclosed","§ 1016.4(a)(1); § 1016.10(a)"],["Bank sends a hashed customer list to a DSP or ad platform to market the bank's own product","Service provider exception","Initial notice; contract limiting use to the campaign; separate notice statement; no opt-out","§ 1016.13(a), (b); § 1016.6(a)(5)"],["Bank and an insurance company co-sponsor a product under a written agreement","Joint marketing exception","Initial notice; contract limiting use to the joint marketing; opt-out optional","§ 1016.13(a)(2), (c)"],["Bank gives a retailer a segment so the retailer can advertise its own goods","Nonaffiliate disclosure","Initial notice, opt-out notice, reasonable opportunity, no opt-out received; recipient's onward sharing limited","§ 1016.10(a); § 1016.11(d)"],["Clean room returns only aggregate counts to a brand","Definition of personally identifiable financial information","Aggregate or blind data that identifies no consumer is excluded; whether an output qualifies is fact-dependent","§ 1016.3(q)(2)(ii)(B)"],["Issuer tells an offer platform which cardholder earned a reward, to credit it","Processing exception","No opt-out; no initial notice to non-customers; reuse limited to that purpose","§ 1016.14(b)(2)(iv); § 1016.11(c)"],["Consumer ticks a box asking the bank to share data with a named partner","Consent exception","No opt-out process; consent revocable","§ 1016.15(a)(1), (b)"],["Bank gives card numbers to a telemarketing agent selling the bank's own product; agent cannot post charges","Account-number exception for agents","Exception applies","§ 1016.12(b)(1)"],["Bank gives card numbers to a third party for that party's email marketing","Account-number limit","The rule says the institution \"must not\" disclose","§ 1016.12(a)"],["Bank shares an encrypted token with no decode key","Account-number example","Not an \"account number\"; other Regulation P rules still apply to the data","§ 1016.12(c)(1)"],["Bank shares a list of former customers with a nonaffiliate","Opt-out and revised notice rules","Opt-out applies to former customers; revised notice if they never had an opt-out chance","§ 1016.7(i)(2); § 1016.8(b)(1)(iii)"],["Bank's insurance affiliate emails a bank customer an offer based on the bank's data","FCRA affiliate marketing rule","Notice and opt-out, unless an exception such as a pre-existing relationship applies","§ 1022.21(a), (c)"],["Same affiliate runs a television or billboard campaign","Definition of solicitation","Not a solicitation; Subpart C does not apply","§ 1022.20(b)(5)(ii)"]],"sourceUrls":[["https://www.law.cornell.edu/cfr/text/12/1016.4","https://www.law.cornell.edu/cfr/text/12/1016.10"],["https://www.law.cornell.edu/cfr/text/12/1016.13","https://www.law.cornell.edu/cfr/text/12/1016.6"],["https://www.law.cornell.edu/cfr/text/12/1016.13"],["https://www.law.cornell.edu/cfr/text/12/1016.10","https://www.law.cornell.edu/cfr/text/12/1016.11"],["https://www.law.cornell.edu/cfr/text/12/1016.3"],["https://www.law.cornell.edu/cfr/text/12/1016.14","https://www.law.cornell.edu/cfr/text/12/1016.11"],["https://www.law.cornell.edu/cfr/text/12/1016.15"],["https://www.law.cornell.edu/cfr/text/12/1016.12"],["https://www.law.cornell.edu/cfr/text/12/1016.12"],["https://www.law.cornell.edu/cfr/text/12/1016.12"],["https://www.law.cornell.edu/cfr/text/12/1016.7","https://www.law.cornell.edu/cfr/text/12/1016.8"],["https://www.law.cornell.edu/cfr/text/12/1022.21"],["https://www.law.cornell.edu/cfr/text/12/1022.20"]]}