{"page":"/tools/commerce-media-platform-rfp","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Item","Question","Why it matters","A good answer contains"],"rows":[["B1 (gate)","For each data use, which GLBA and Regulation P basis do you rely on, and who sends the notices?","The service-provider and joint-marketing exception needs a contract limiting use (12 CFR 1016.13); a recipient may not pass the data on unless the bank could (15 U.S.C. 6802(c)).","A use-by-use map, the draft contract clauses limiting use and reuse, and the notice owner."],["B2","Does any feature disclose account numbers or access codes to a third party for marketing?","Regulation P prohibits it with two exceptions; an encrypted number counts only if the recipient cannot decode it (12 CFR 1016.12).","A plain \"no\", backed by architecture showing tokens only, or the exception relied on."],["B3","Will any audience use consumer report data, or support credit or insurance offers?","Prescreened lists are allowed only for firm offers of credit or insurance (15 U.S.C. 1681b(c)); affiliate data used for solicitations needs notice and opt-out (12 CFR 1022.21).","Which features touch consumer reports, the prescreen workflow, or a clear statement that none do."],["B4","Which state privacy laws do you treat as applying, and how do you handle data outside the GLBA exemption?","California exempts data collected subject to GLBA, not the company (Cal. Civ. Code 1798.145(e)); Virginia exempts GLBA institutions and data (Va. Code 59.1-576).","A state-by-state matrix and how sale and sharing opt-outs work for web and app data."],["B5","How do you stop sensitive inferences, such as health, from entering audiences?","Pharmacy and clinic purchases can reveal health conditions, and state health data laws apply to such data.","Merchant-category and keyword blocklists, tests, and a named policy owner."]],"sourceUrls":[["https://www.law.cornell.edu/cfr/text/12/1016.13","https://www.law.cornell.edu/uscode/text/15/6802"],["https://www.law.cornell.edu/cfr/text/12/1016.12"],["https://www.law.cornell.edu/uscode/text/15/1681b","https://www.law.cornell.edu/cfr/text/12/1022.21"],["https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf","https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-576/"],[]]}