This bill amends Title V of the Gramm‑Leach‑Bliley Act (GLBA) to: (1) require financial institutions to minimize collection and disclosure of nonpublic personal information; (2) expand consumer control through continuing opt‑out rights and an opt‑in requirement for "sensitive" financial data; (3) limit how financial data aggregators may use consumer access credentials; and (4) give current and former customers explicit rights to obtain disclosures and (with limits) demand deletion of their financial data.
For compliance and policy teams, the bill repackages GLBA from a disclosure regime into a treatment‑focused framework. It tightens data handling expectations, adds new notice content (including AI use and overseas processing), creates operational timelines (response, appeals, safe harbors), and defines new covered terms—most notably “access credentials,” “financial data aggregator,” and “sensitive nonpublic personal information.”
At a Glance
What It Does
The bill amends GLBA to add a data‑minimization obligation, require opt‑in for specified sensitive data, mandate disclosure and opt‑out opportunities before use of consumer access credentials, and establish customer/former customer rights to disclosure and deletion of nonpublic personal information. It also expands the statute’s definitions and directs agencies to update model privacy notices and consider smaller institutions in rulemaking.
Who It Affects
Banks, credit unions, fintechs, and any entity defined as a financial data aggregator; consumer reporting agencies when acting under the FCRA exceptions; third‑party service providers handling account access credentials; and state insurance authorities charged with enforcement of GLBA privacy rules.
Why It Matters
The bill replaces some long‑standing GLBA assumptions with affirmative obligations that will require data inventories, consent flows, notice redesigns, identity‑verification and deletion workflows, and contract changes with vendors and aggregators—raising both compliance costs and operational risks for firms that handle consumer financial data.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The bill reframes GLBA Title V from a narrow disclosure regime to a broader set of rules about how financial institutions treat nonpublic personal information. It adds a data‑minimization duty that requires institutions to collect or disclose only what is adequate, relevant, and reasonably necessary for the stated purpose, subject to enumerated exceptions (for example, CFPB 1033 requests, regulatory reporting, and certain affiliate or FCRA uses).
The minimization rule takes effect two years after enactment, giving firms time to perform inventories and adjust collection practices.
On consumer controls, the bill preserves and expands the opt‑out pathway for routine disclosures, but it also creates an affirmative opt‑in requirement for "sensitive nonpublic personal information"—a new category that explicitly includes biometric data and precise geolocation, among other items. The opt‑in and opt‑out rights are continuing: consumers can exercise or revoke them at any time.
Notices must be reworked to explain these choices, list disclosure recipients, describe retention practices, and disclose use of artificial intelligence and cross‑border processing destinations.The bill addresses account‑access credentialing—usernames, passwords, PINs, security answers—by requiring any financial data aggregator or nonaffiliated third party that uses a consumer’s credentials to provide a clear, pre‑collection disclosure describing uses, third‑party sharing, and risks, and to give the consumer the opportunity to direct that credentials not be used. Financial institutions are forbidden from denying credential‑based requests for information if the aggregator delivered the disclosure and the consumer had that opt‑out opportunity.
The provision is carefully tied back to CFPB Section 1033 to avoid conflict with consumer access rules and becomes effective one year after enactment.Finally, the bill creates a new Section 503A giving customers and former customers explicit rights to obtain copies of nonpublic personal information (consistent with section 1033) and to request deletion if they are former customers. Deletions are not absolute: the bill lists exceptions (retention for legal/regulatory purposes, FCRA uses, dispute handling) and requires identity verification, a 45‑day response window (one 45‑day extension allowed), limited free annual requests, a process for fees on subsequent requests, and an appeal mechanism with a 60‑day response timeline.
Regulators are instructed to update model GLBA notices and to consider financial institutions with $15 billion or less in assets when drafting rules.
The Five Things You Need to Know
The bill imposes a statutory data‑minimization duty on financial institutions: collect or disclose only what is ‘adequate, relevant, and reasonably necessary’ for the purpose, with enumerated exceptions; this requirement becomes effective 2 years after enactment.
A new opt‑in rule requires consumer consent before collecting or disclosing ‘sensitive nonpublic personal information’ (explicitly including biometric data and precise geolocation); consumers may revoke consent at any time; this rule takes effect 1 year after enactment.
Financial data aggregators must give clear, pre‑collection disclosures about use and sharing of access credentials and offer consumers the option to block credential‑based access; if those conditions are met, a financial institution cannot refuse a credential‑based disclosure request; effective in 1 year.
Section 503A creates rights for customers and former customers to obtain copies of their nonpublic personal information and permits former customers to request deletion, subject to verification, enumerated exceptions, a 45‑day response window (one 45‑day extension), two free requests per year, and an appeals process.
Regulators must update GLBA model disclosure forms (with a 2‑year safe harbor), and the agencies must account for institutions with $15 billion or less in assets when writing regulations, with automatic five‑year GDP‑indexed threshold adjustments.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Cosmetic and heading changes to reflect 'treatment' of nonpublic data
This section renames GLBA Title V headings—changing references from ‘Disclosure’ to ‘Treatment’ and replacing the phrase ‘disclosures of’ with ‘nonpublic’ in section captions. The change signals the statute’s broader focus on how institutions use and retain data, not just what they disclose, and may affect how regulators interpret the scope of the subtitle in rulemaking and enforcement.
Data‑minimization duty and exceptions
The bill adds a formal data‑minimization requirement: institutions must limit collection and disclosure of nonpublic personal information to what is adequate, relevant, and reasonably necessary for the purpose. The text lists several explicit exceptions—e.g., disclosures required by CFPB Section 1033, FCRA‑covered consumer reporting purposes, regulatory or SRO reporting, and other legal requirements—so institutions cannot invoke minimization to refuse compliance with separate legal obligations. The two‑year delayed effective date gives firms lead time for data mapping, purpose inventories, and policy rewrites.
Continuing opt‑out right
The bill revises the existing opt‑out framework so that the opportunity to opt out of disclosures is not a one‑time decision at account opening: the consumer’s right to direct that their nonpublic personal information not be disclosed may be exercised at any time and must be made accessible in the institution’s disclosures. Practically, institutions will need systems to record, honor, and audit opt‑out directions across product lines and over time.
Limits and notice requirements for use of consumer access credentials
Financial data aggregators and other nonaffiliated third parties must provide consumers with a clear, pre‑collection disclosure that explains how they will use access credentials, whether they will share them, and the privacy and security risks, and must give consumers the opportunity to bar credential usage. The bill also prevents financial institutions from denying credential‑based access requests if the aggregator provided the disclosure and the consumer had the opt‑out chance. The section explicitly preserves compliance with CFPB Section 1033 obligations, creating a tailored interaction between consumer access rights and credential‑based aggregator models.
Expanded notice content and customer access to privacy policies
Notices must now include categories of purposes for collection and disclosure, retention practices, whether the institution uses AI with nonpublic data, whether data are processed, retained, or disclosed to a covered nation, and instructions for exercising opt‑out, disclosure, and deletion rights. Agencies are directed to update GLBA model forms and provide a 2‑year safe harbor for institutions using the existing model form; institutions should plan to revise consumer notices and website disclosures to meet the new specificity requirements.
Customer and former customer disclosure and deletion procedures
New Section 503A requires institutions to disclose nonpublic personal information to customers or former customers consistent with CFPB Section 1033 and to provide a list of categories of affiliates and nonaffiliated third parties that received the consumer’s data (excluding certain exception disclosures). Former customers may request deletion, but deletion is barred when retention is required by law, for FCRA uses, to respond to disputes, or under enumerated exceptions. The statute mandates verification procedures, a 45‑day response deadline (one 45‑day extension), two free deletion requests per year, fee/decline mechanics for additional requests, and an appeals route with a 60‑day appeal response window and referral path to enforcement authorities.
Opt‑in for sensitive nonpublic personal information
The bill defines 'sensitive nonpublic personal information' and requires affirmative consumer consent before collecting or disclosing that category of data (consent must be clear, affirmative, and revocable). The provision expressly exempts several disclosure circumstances already in GLBA’s exceptions (e.g., law enforcement and regulatory needs). Firms should inventory whether any product flows involve the newly labeled sensitive fields—biometric data and precise geolocation are specifically called out—and design consent capture and revocation mechanisms accordingly.
Regulatory consideration for smaller institutions
Agencies drafting GLBA privacy regulations must assess the impacts on financial institutions with $15 billion or less in assets, including resource and technical limitations. The provision instructs agencies to increase the $15 billion threshold every five years, indexed to current‑dollar GDP. This creates a formal requirement to calibrate rules to avoid disproportionate burdens on midsize and community firms; however, agencies retain discretion on tailoring approaches.
Preemption of State consumer privacy laws, with insurance carve‑out
The bill explicitly preempts State statutes and regulations establishing consumer data privacy or security requirements for nonpublic personal information covered by the subtitle. The carve‑out preserves state insurance authorities’ power to enforce GLBA and to adopt implementing regulations that are 'consistent and comparable with, and not more restrictive than,' federal regulations. The change narrows the patchwork for firms but could block state efforts to impose stricter protections on financial data.
New and amended definitions (access credentials, aggregators, sensitive data)
The bill expands GLBA’s definitional section to include access credentials (username, password, PIN, security answers), financial data aggregator (with explicit carve‑outs), artificial intelligence (by cross‑reference), biometric data, precise geolocation (defined with a 1,750‑foot radius threshold), consent, customer/former customer and customer relationship, and sensitive nonpublic personal information. These new definitions are central: they determine who is covered, what data are 'sensitive', and which actors must follow the new notice, opt‑in/opt‑out and credential rules.
This bill is one of many.
Codify tracks hundreds of bills on Privacy across all five countries.
Explore Privacy in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Consumers (current customers): Gain ongoing opt‑out mechanisms, clearer privacy notices (including AI and cross‑border processing disclosures), and an explicit right to request copies of nonpublic personal information—improving transparency and control over how financial institutions treat their data.
- Former customers: Acquire a statutory deletion right subject to limited exceptions and a formal appeals process, which gives individuals a legal route to remove legacy financial records from a financial institution’s systems where lawful retention is not required.
- Privacy‑conscious financial institutions: Firms that already practice strong data minimization, consent management, and inventory controls will benefit from clearer statutory standards that can limit liability and level the playing field against peers that collect data without documented purposes.
Who Bears the Cost
- Financial institutions (banks, credit unions, broker‑dealers): Must perform data inventories, update notices and consent flows, implement identity‑verification and deletion systems, renegotiate vendor agreements, and absorb compliance and operational costs—particularly for handling former customer deletion requests and appeals.
- Financial data aggregators and nonaffiliated third parties: Must implement pre‑collection disclosure and opt‑out mechanisms, potentially rework business models that rely on credentialed access, and face operational friction and legal risk if consumers exercise blocking rights.
- Regulators and agencies: Must draft updated model notices, issue implementing regulations, monitor appeals and enforcement, and consider small‑institution impacts—entailing significant rulemaking and coordination workload.
Key Issues
The Core Tension
The central dilemma is balancing enhanced consumer control and privacy (data minimization, opt‑in for sensitive fields, deletion rights) against the need to maintain consumer access, competition, and innovation (credential‑based aggregation, CFPB 1033 access). The bill tries to thread that needle by preserving certain access and FCRA exceptions while imposing procedural constraints and consent gates, but doing so elevates compliance complexity and creates zones where reasonable parties will disagree about scope and implementation.
The bill stitches together several existing regimes—CFPB Section 1033, FCRA, and GLBA—while adding new statutory duties. That creates practical and interpretive friction.
For example, the credential‑access provision requires pre‑collection disclosures from aggregators and bars institutions from denying credential‑based requests if the procedural conditions are met, yet it also defers to Section 1033; reconciling the timing and substance of disclosures required under each authority will be an early and thorny regulatory question. Similarly, deletion rights for former customers are meaningful in theory but operationally difficult: institutions will need to trace copies of data held by affiliates, processors, and third parties, and the statute’s exceptions (regulatory retention, FCRA, disputes) will trigger frequent edge‑case disputes.
The bill also delegates significant detail to agencies (model form updates, verification standards, and regulation of financial data aggregators), which means the practical contours of many obligations will depend on forthcoming rulemaking. The definition of a 'financial data aggregator' contains carve‑outs (payment processors, FCRA agencies, fiduciaries), but marketplace firms that sit near the line may face litigation or enforcement until regulators provide clarifying rules.
Finally, the bill requires notices to disclose AI usage and whether data are transferred to 'covered nations' without imposing substantive limits on cross‑border transfers or AI processing; this creates a transparency‑first approach that can expose firms to reputational risk without providing operational guidance on acceptable AI controls or transfer safeguards.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.