What is GLBA? The Gramm-Leach-Bliley Act explained

The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to protect customers’ private information and explain how they share it. This U.S. federal law, passed on November 12, 1999 (Pub. L. 106-102), limits sharing with nonaffiliated third parties and bans obtaining customer information through deception. There are only a few exceptions.

Privacy researchers Lu Xian, Florian Schaub, and their team reviewed the privacy policies of the 2,067 largest U.S. banks for a study accepted at the 2025 ACM Conference on Computer and Communications Security. Of those banks, 45.2% provided multiple privacy policies. Among those, 53.8% stated in their GLBA notice that they do not share with third parties, but their other policies revealed that they actually do.

This mismatch shows how easily GLBA rules can be misunderstood. For compliance, privacy, and security teams, avoiding these errors starts with knowing the basics. This guide breaks down exactly what the law requires.

What is the Gramm-Leach-Bliley Act (GLBA), and is it still in effect?

Congress passed GLBA to allow banks, securities firms, and insurance companies to affiliate under what its long title calls a

“prudential framework for the affiliation of banks, securities firms, insurance companies, and other financial service providers”. 

Title V added its consumer privacy and data security duties. Our guide to data privacy regulations shows where GLBA sits among US federal and state privacy laws.

GLBA is still in effect. Its privacy and pretexting provisions, codified at 15 U.S.C. 6801 to 6809 and 6821 to 6827, are current law, and the Federal Trade Commission (FTC) has amended its Safeguards Rule since.

With GLBA, Congress repealed sections 20 and 32 of the Banking Act of 1933, the law known as the Glass-Steagall Act. GLBA is also called the Financial Services Modernization Act of 1999, the bill’s name in the Senate Banking Committee’s report, but the enacted short title is the Gramm-Leach-Bliley Act. President Clinton signed it into law.

What are the three key rules of GLBA?

GLBA’s three key rules are the privacy rules, the safeguards rules, and the pretexting provisions. The pretexting provisions reach any person.

• Privacy rules (the Financial Privacy Rule). Financial institutions must tell customers how they share nonpublic personal information and let consumers opt out of certain sharing with nonaffiliated third parties.
• Safeguards rules (the Safeguards Rule for institutions under the FTC). Institutions must keep administrative, technical, and physical safeguards and maintain a comprehensive information security program to protect customer data from unauthorized access.
• Pretexting provisions (also called the pretexting rule). Getting a financial institution’s customer information by false pretenses is illegal, outside a few statutory exceptions.

Who has to comply with GLBA, and does it only apply to banks?

No. GLBA covers businesses significantly engaged in financial activities, whether or not they are banks. The FTC describes them as companies that offer consumers financial products or services like loans, financial or investment advice, or insurance. Colleges that lend to consumers can be financial institutions too.

Under the statute, a financial institution is any institution whose business is engaging in financial activities as described in 12 U.S.C. 1843(k). The FTC’s Safeguards Rule treats an institution significantly engaged in those activities as a financial institution (Regulation P, one of GLBA’s privacy rules, says the same for the FTC-enforced institutions it covers). Its examples “include, but are not limited to”:

• mortgage lenders, “pay day” lenders, finance companies and mortgage brokers
• account servicers, check cashers and wire transferors
• collection agencies, credit counselors and other financial advisors
• travel agencies operated in connection with financial services
• tax preparation firms
• non-federally insured credit unions
• investment advisors that are not required to register with the Securities and Exchange Commission (SEC)
• entities acting as finders

GLBA also covers banks, credit unions, brokers, investment companies and insurers. The FTC’s 2000 Privacy Rule (65 FR 33646, at 33648) said many, if not all, colleges “appear to be significantly engaged in lending funds to consumers”. It rejected comments saying otherwise.

Three cases work differently:

• Colleges. A college that complies with the Family Educational Rights and Privacy Act (FERPA), the federal student-records law, and is a financial institution under the FTC’s enforcement is deemed to comply with Regulation P; that deeming covers the privacy rule only and does not mention the Safeguards Rule.
• Insurers. Insurers are covered by GLBA, but for their insurance activities and activities incidental to them, while supervised by a state insurance regulator, their privacy duties come from state insurance law, enforced by the insurance authority of the state where they are domiciled, not from the Consumer Financial Protection Bureau’s (CFPB’s) Regulation P.
• Stricter state laws. GLBA overrides only state laws that conflict with its privacy provisions, and a state law that gives greater protection, as determined by the CFPB, is not treated as conflicting, so stricter state laws still apply. A state law can instead exempt GLBA data: the California Consumer Privacy Act (CCPA) does not apply to personal information collected, processed, sold, or disclosed subject to GLBA (its GLBA exemption, Cal. Civ. Code 1798.145(e)), except for the CCPA’s data-breach right of action.

What is not covered by GLBA?

Outside GLBA’s privacy and safeguards duties fall business-purpose data, information that is not NPI, and a few named activities and institutions. The pretexting ban and the reuse limit on NPI received from a financial institution can still apply. Excluded are, among others:

• information about companies, or about individuals who obtain a financial product for business, commercial or agricultural purposes
• information that is not nonpublic personal information
• a retailer whose only means of extending credit are occasional lay-away and deferred payment plans or accepting credit cards issued by others
• a merchant that does no more than let customers run a tab
• financial activity under the Commodity Futures Trading Commission’s jurisdiction
• the Federal Agricultural Mortgage Corporation and Farm Credit Act institutions
• institutions chartered by Congress for secondary-market transactions as long as they do not sell or transfer nonpublic personal information to a nonaffiliated third party

Who is a customer under GLBA?

A customer, under GLBA, is a consumer who has a continuing relationship with the financial institution. The difference decides who gets which notice.

• Consumer: An individual who obtains a financial product or service to be used primarily for personal, family, or household purposes. Regulation P’s examples include someone who applies for credit, whether or not the credit is extended.
• Customer: A consumer in a continuing relationship, such as a deposit or investment account, a loan, an insurance product, or a lease of personal property (Regulation P’s examples).

What data does GLBA protect?

GLBA protects nonpublic personal information (NPI). That is personally identifiable financial information that a consumer gives a financial institution to obtain a product, that results from a transaction, or that the institution otherwise obtains about the consumer in connection with providing a financial product or service, plus any list of consumers derived from it. Regulation P’s examples include:

• information on an application for a loan, a credit card or another financial product
• account balances, payment history, overdraft history and credit or debit card purchases
• the fact that someone is or has been the institution’s customer
• any information collected through an internet cookie, when it is obtained in connection with a financial product or service
• information from a consumer report

Unless it sits on a list derived from nonpublic data, publicly available information is excluded. So is data that identifies no consumer. Aggregate information and blind data without personal identifiers are examples.

Who enforces GLBA, and who writes its rules?

GLBA has no single enforcer. Each type of institution answers to its own regulator. The CFPB writes the privacy rule, Regulation P, for three of the six institution types below, and the other regulators each set the safeguards standard for their own institutions.

Beyond its rule-writing, the CFPB enforces the privacy provisions for institutions under its jurisdiction. Safeguards enforcement is not part of that role. The Commodity Futures Trading Commission writes a privacy rule for the firms it oversees (17 CFR Part 160).

Under interagency guidance for banks, an institution that learns of unauthorized access to sensitive customer information and determines that misuse of a customer’s information has occurred or is reasonably possible should notify the affected customer. It should do so as soon as possible.

What does the GLBA Financial Privacy Rule require?

The Financial Privacy Rule requires notices and opt-outs. An institution must give customers a privacy notice and give a consumer one before sharing their NPI with nonaffiliated third parties for purposes outside Regulation P’s 1016.14 and 1016.15, which include processing and servicing. It must also offer a reasonable opportunity to opt out before sharing with nonaffiliated third parties outside a longer list of exceptions. The rule limits reuse by recipients and account-number sharing.

What counts as a nonaffiliated third party? It is anyone except the institution’s affiliates (companies that control it, are controlled by it or are under common control with it) and people it employs jointly with another company.

• Notice. The rule requires “a clear and conspicuous notice that accurately reflects” the institution’s privacy policies and practices, given to a customer no later than when the customer relationship begins (with limited exceptions in 1016.4(e)) and to a consumer who is not a customer before any sharing with a nonaffiliated third party other than for processing, servicing and the other purposes in 1016.14 and 1016.15.
  Using the model privacy form in Regulation P’s appendix satisfies the content requirements but is not required.
• Opt-out. Before sharing a consumer’s nonpublic personal information with a nonaffiliated third party, the institution must have given the initial notice, an opt-out notice, and a reasonable opportunity to opt out, and the consumer must not have opted out.
• Reuse limits. A company that receives nonpublic personal information from a financial institution may pass it on to a company unaffiliated with both of them only where the original institution could lawfully have made that disclosure itself. NPI received under a notice and opt-out exception can be disclosed and used only for the activity that exception covers, besides disclosures to affiliates.
• Account numbers. No institution may give a nonaffiliated third party a consumer’s credit card, deposit, share or transaction account number, or a similar access number or code, for telemarketing, direct mail or email marketing to the consumer, except to a consumer reporting agency.
  Narrow exceptions cover an agent or service provider marketing the institution’s own products that cannot initiate charges, and private-label or affinity programs whose participants are identified to the customer when the customer enters the program. A number in encrypted form without the means to decode it does not count.

Other US privacy laws add disclosure duties. What a privacy policy must disclose under each US law sets them out.

Are annual privacy notices still required?

Not always. Since December 4, 2015, an institution can skip the annual notice if it meets both conditions below (Pub. L. 114-94, section 75001):

• Sharing only within the exceptions. It shares nonpublic personal information with nonaffiliated third parties only under the service-provider, processing, and other listed exceptions, so no opt-out right is triggered.
• No change in practices. Its policies and practices on sharing nonpublic personal information have not changed since the most recent notice it sent.

Once either condition fails, the exception ends.

What are exceptions to a customer’s opt-out request?

The opt-out does not reach sharing with service providers and joint marketers (provided the institution gave the initial notice and bound them by contract) or sharing needed for a transaction the consumer requests or authorizes. Regulation P lists other purposes too. A consumer’s opt-out covers sharing with nonaffiliated third parties and lasts until the consumer revokes it in writing or, if the consumer agrees, electronically.

• Service providers and joint marketing. Sharing with a company that performs services for the institution, including marketing its own products or financial products under a joint agreement with other financial institutions, if the institution has given the initial notice and has a contract limiting the company’s use of the information to that purpose.
• Processing and servicing. Sharing needed to carry out a transaction the consumer requests or authorizes.
• Other listed purposes. Among them, sharing with the consumer’s consent, to protect records and prevent fraud, with a consumer reporting agency under the Fair Credit Reporting Act, in connection with the sale or merger of a business, with the institution’s attorneys, accountants and auditors, and to comply with the law.

Among affiliates, sharing sits outside GLBA’s opt-out. That opt-out covers nonaffiliated third parties only, and the choice to stop certain sharing among affiliates comes from the Fair Credit Reporting Act.

What does the GLBA Safeguards Rule require to protect customer information?

The FTC’s Safeguards Rule, which carries out section 501(b) of the Act (15 U.S.C. 6801(b)), requires a financial institution under FTC jurisdiction to keep a comprehensive, written information security program. Its safeguards must be administrative, technical, and physical, suited to the institution’s size and complexity and its activities. They must also fit the customer information’s sensitivity.

The rule’s stated objectives are to ensure the security and confidentiality of customer information and to protect against anticipated threats or hazards to its security or integrity. A third covers unauthorized access or use. It is limited to the kind that “could result in substantial harm or inconvenience to any customer”.

Ten elements, 314.4(a) to (j), form the program:

• (a) Qualified Individual. Designate one person to oversee, implement, and enforce the program.
• (b) Risk assessment. Base the program on a risk assessment, written under (b)(1). How to assess privacy risk covers the method.
• (c) Safeguards. Control the risks found, including access controls, identifying and managing data, personnel, devices, systems and facilities, encryption of customer information in transit over external networks and at rest (with compensating controls the Qualified Individual approves where encryption is infeasible), secure development practices, multi-factor authentication (unless the Qualified Individual approves equivalent or stronger controls in writing), change management, activity monitoring and logging, and procedures for secure disposal with periodic review of how long data is kept.
• (d) Testing and monitoring. Regularly test or monitor key controls. For information systems, (d)(2) calls for continuous monitoring or periodic penetration testing and vulnerability assessments.
• (e) People. Train staff in security awareness and use qualified security personnel who keep their knowledge current.
• (f) Service providers. Oversee service providers.
• (g) Evaluate and adjust. Evaluate and adjust the program.
• (h) Incident response plan. Keep a written plan.
• (i) Board report. The Qualified Individual reports in writing, at least annually, to the board or equivalent body, or to a senior officer if there is none.
• (j) FTC notification. Notify the FTC of notification events involving at least 500 consumers.

If an institution maintains customer information concerning fewer than 5,000 consumers, it is excused only from 314.4(b)(1), (d)(2), (h) and (i). Every other element, including FTC notification, still applies.

In 2021, the rule was revised. That FTC revision (86 FR 70272) took effect January 10, 2022, and its provisions in 314.4(a), (b)(1), (c)(1) to (8), (d)(2), (e), (f)(3), (h) and (i) apply from June 9, 2023 (87 FR 71509). A 2023 amendment added reporting to the FTC (88 FR 77499).

Who needs to be notified of a data breach?

A financial institution covered by the Safeguards Rule must notify the FTC when unencrypted customer information of at least 500 consumers is acquired without authorization. Notice is due as soon as possible and no later than 30 days after discovery. That duty began May 13, 2024.

The FTC’s rule itself requires no consumer notice. By contrast, the SEC’s Regulation S-P requires brokers, dealers, investment companies, and registered investment advisers and transfer agents to notify affected individuals when their sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. 

That notice is not required if a reasonable investigation shows the sensitive customer information has not been and is not reasonably likely to be used in a way that would cause substantial harm or inconvenience.

With 2024 amendments, the SEC added the duty. Larger covered institutions had to comply by December 3, 2025, and smaller ones by June 3, 2026 (89 FR 47688).

• Trigger. A notification event: acquisition of unencrypted customer information without the authorization of the person it relates to. Unauthorized access is presumed to be acquisition unless the institution has reliable evidence otherwise, and information counts as unencrypted if the encryption key was accessed by an unauthorized person.
• Discovery. The 30 days run from discovery, the first day the institution knows of the event.
• Recipient. The FTC, electronically, on its reporting form, which warns that “Your report may be made public.”

When it adopted the duty (88 FR 77499), the FTC left out a consumer-notice requirement because “all States have some form of consumer notification requirement.” FTC staff estimated about 115 affected institutions yearly. Whether an incident is reportable is a separate question, covered in deciding whether a privacy incident is reportable.

Do vendors and service providers have to comply with GLBA?

Some vendors must comply directly. The Safeguards Rule makes the financial institution oversee its service providers, including by contract. Any service provider that is itself a financial institution under FTC jurisdiction must also run its own program for the customer information it holds.

A service provider is any person or company that receives, maintains, processes, or otherwise has access to customer information through services it provides directly to a financial institution covered by the Safeguards Rule. The institution must:

• take reasonable steps to select and retain providers capable of maintaining appropriate safeguards
• require them by contract to implement and maintain those safeguards
• assess them periodically, based on the risk they present and the continued adequacy of their safeguards

“If you’re a financial company, vendor oversight is not just a good idea, it’s the law,”

said Andrew Smith when the FTC announced its December 2020 settlement with Ascension Data & Analytics. He then headed the Bureau of Consumer Protection. How to run a vendor privacy-risk program covers the work around those three steps.

What do the GLBA pretexting provisions prohibit?

GLBA’s pretexting provisions bar any person from getting, or trying to get, a financial institution’s customer information about someone else by false pretenses, or asking someone else to do so. Knowing and intentional violations are crimes punishable by up to 5 years in prison, and aggravated violations by up to 10 years. The prohibited methods are:

• a false, fictitious, or fraudulent statement to an officer, employee, or agent of the institution
• a false, fictitious or fraudulent statement to a customer of the institution
• a document given to the institution’s staff that the person knows is forged, counterfeit, lost or stolen, was gained by fraud, or contains a false statement
• asking someone else to get the information, knowing they will use one of these methods

For example, someone who phones a bank posing as an account holder to learn that person’s balance is making a false statement to the institution’s staff. That is pretexting. The statute lists five exceptions:

• law enforcement agencies performing their official duties
• a financial institution testing its own security, investigating misconduct or negligence by its staff, or recovering customer information lost to pretexting
• an insurance institution investigating criminal activity, fraud, material misrepresentation or material nondisclosure, where state law authorizes it
• information otherwise available as a public record filed under the securities laws
• a state-licensed private investigator collecting court-ordered child support, where a court has authorized it and no other law forbids it

Violations are aggravated when they happen while violating another US law or as part of a pattern of illegal activity involving more than $100,000 in a 12-month period. Aggravation also doubles the fine.

The FTC enforces the pretexting provisions in the same manner as it enforces the Fair Debt Collection Practices Act, and the federal banking agencies and the NCUA enforce them for the institutions they oversee. State laws that give greater protection survive. The FTC makes that call.

What are the penalties and fines for GLBA non-compliance?

Instead of a single civil fine, GLBA leaves penalties to each regulator’s own law. Banks and their institution-affiliated parties, such as officers and directors, face per-day civil money penalties, and FTC-regulated companies face penalties for violating a final FTC order. Only pretexting is criminal under the privacy title.

Each route below sets its own trigger and its own maximum. The routes include:

Both the SEC and the NCUA act under other laws. So do state insurance authorities.

In one case, the FTC alleged that Ascension Data & Analytics, a Texas mortgage analytics company, violated the Safeguards Rule by failing to adequately vet its vendors, not requiring them by contract to safeguard the data and failing to conduct risk assessments of all of its third-party vendors, as the rule requires. One vendor, OpticsML, allegedly stored mortgage documents in plain text on a cloud server. The complaint alleges dozens of server accesses.

Ascension agreed to settle, and the Commission voted 3-1-1, with Commissioner Rohit Chopra dissenting. The FTC finalized it in December 2021.

Under the order, Ascension must have a comprehensive data security program and biennial assessments by an independent organization. Each year, a senior executive must certify compliance.

The Eighth Circuit held in Dunmire v. Morgan Stanley DW Inc. (2007) that GLBA creates no private right of action. Individuals cannot sue under GLBA itself. So a consumer’s claim has to rest on another law.

How do you achieve GLBA compliance?

Comply with GLBA requirements by giving the required privacy notices and honoring opt-outs. Keep an information security program with the elements your regulator’s safeguards rules list. Oversee service providers by contract and periodic assessment. Hold records that show compliance for whoever checks.

1. Confirm whether your business is a financial institution under the coverage test and find your regulator in the enforcement table.
2. Identify the nonpublic personal information you hold and where it goes, using the definition of what GLBA protects.
3. Give the privacy notices your customers and consumers are owed, and honor opt-outs before any sharing outside the exceptions (Financial Privacy Rule).
4. Keep an information security program with the elements your regulator’s safeguards standard lists (for institutions under the FTC, the Safeguards Rule’s ten elements).
5. Select, contract with, and periodically assess your service providers (the service-provider duty above).
6. If the FTC’s Safeguards Rule covers you, be ready to report notification events to the FTC under its notification duty.
7. Evaluate and adjust the program, and report to your board where your rule requires it (Safeguards Rule elements (g) and (i)).

One framework maps GLBA’s duties beside other laws.

Who checks GLBA compliance, and what does an audit look for?

Your own regulator checks. It can be a federal banking agency examining a bank, the CFPB examining or enforcing compliance with the privacy provisions, or the FTC investigating an institution under its jurisdiction. Each looks for the records the rules require.

How can you check that customer data goes only where your privacy notice says?

List, duty by duty, what the privacy notice and contracts record. Check that against where customer information actually goes. The FDIC’s examination manual gives examiners the objective of “specifically ensuring consistency between what the financial institution tells consumers in its notices about its policies and practices and what it actually does“, and tells examiners to compare the categories of information shared, and with whom, against those stated in the privacy notice.

“Where indicated by the institution’s risk assessment“, the Interagency Guidelines say a bank must “monitor its service providers to confirm that they have satisfied their obligations“.

Among its examples of personally identifiable financial information, Regulation P lists information collected through an internet cookie when it is obtained in connection with a financial product or service. So a site’s cookies can collect NPI. How observed data flows are checked against what a site states explains the method.

MELURNA aims to track regulated data through every handoff. Even so, some duties only paper can prove. Documents prove the written program, the board report and training, and the contract proves a contract term.

Flow evidence answers where customer information actually goes. MELURNA traces identity and transaction data through processors, fraud services, analytics, cloud infrastructure, and downstream providers, and it maps observed behavior to GLBA and other requirements without separating the control from its supporting evidence. 

Review a financial data path →

FAQs

DISCLAIMER: This guide is for general informational purposes only and does not constitute legal advice. While we strive for accuracy, we make no warranties about the completeness or reliability of this information, and are not liable for any errors, omissions, or actions taken based on its contents. Consult a licensed attorney for guidance specific to your business.