Glossary
GLBA (Gramm-Leach-Bliley Act)
Published · Last updated
Next scheduled review:
GLBA is the 1999 US federal law whose Title V requires financial institutions to tell customers how their non-public personal information is shared, to let customers opt out of sharing with non-affiliated third parties, and to maintain safeguards for that information, which constrains how a bank or payments company can use account and transaction data for advertising.
The privacy provisions are codified at 15 U.S.C. §§ 6801–6809 (Cornell LII, 15 U.S.C. Chapter 94, Subchapter I). The FTC's Privacy of Consumer Financial Information Rule (16 CFR Part 313) defines non-public personal information, the notice requirements and the opt-out, and its Safeguards Rule (16 CFR Part 314) sets the security program (eCFR, 16 CFR Part 313; eCFR, 16 CFR Part 314). Banks are supervised under parallel rules by their prudential regulators and the CFPB.
GLBA shapes financial media networks in three ways. Sharing identifiable transaction data with an advertiser or an ad platform is sharing with a non-affiliated third party and triggers notice and opt-out, so networks keep the data inside and sell offers or aggregated segments. Service providers that process the data on the bank's behalf must be bound by contract and fall under the Safeguards Rule, which is the clause an on-premise or dedicated deployment is written to satisfy. And the opt-out must be honored in the ad system, which means a suppression list the bidder checks. The networks that have made these choices are tabulated in the commerce media networks directory.
Example: a card issuer wants to let a retailer target "customers who spent over $500 at competitors last quarter" on the open web; sending that list to a DSP is a third-party disclosure under GLBA; showing those customers an offer inside the issuer's own app, with the match done inside the bank, is not.
Related: financial media network, CPNI, clean room, data residency.
Source: 15 U.S.C. §§ 6801–6809; 16 CFR Parts 313 and 314.