# Does the GLBA service provider exception cover an advertiser, a DSP or a clean room?

## Where readings differ

| Reading | What it holds | What it relies on | What it means for a design |
|---|---|---|---|
| A cautious reading | The exception covers vendors that work for the institution to market the institution's own products. A merchant, or a DSP that acts for a merchant, uses the audience to promote the merchant's brand and performs no service for the institution. That disclosure needs the notice and opt-out route, or it must be limited to outputs that are not NPI. | The words "to perform services for you or functions on your behalf"; the limit of joint marketing to financial institutions | Merchants receive aggregates only, or the audience is built from consumers who have not opted out |
| A permissive reading | A merchant-funded offers program is the institution's own rewards product. Vendors that deliver and measure those offers, on or off the institution's own channels, serve the institution under a contract that limits use. The exception applies to them. | 1016.13(b), marketing of "your own products or services"; the use-limiting contract | Offsite delivery runs through vendors bound by contract, with the institution as the advertiser of record |

**Where the readings collide.** A merchant may pay for an offer while the institution calls it part of its rewards product. The issue is who controls the offer, targeting and buying seat, and what the merchant receives. The answer can differ between an onsite placement and an offsite campaign that exports audience rows.

## Questions to take to your counsel

1. For each recipient, which Regulation P route applies: service provider, joint marketing, transaction, consent, or notice and opt-out?
2. Is the offers program our own product for this purpose?
3. Does any output to a merchant contain NPI, including a derived list?
4. Does each contract limit use and redisclosure as 12 CFR 1016.13 and 1016.11 require?
5. Do California, Vermont or other state rules require opt-in for this flow?
6. Do our privacy notices describe this sharing accurately?
7. Do credit-marketing rules apply to this campaign?

[Read the full checkpoint](https://adsovereign.com/blog/glba-service-provider-exception-advertising) · [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/)