Fact Sheet 24a:
Financial Privacy:
How to Read Your "Opt-Out" Notices

Send to PrinterSend to Printer
Copyright © 2001-2016
Privacy Rights Clearinghouse
Posted March 2001
Revised July 2016

The Gramm-Leach-Bliley Act (GLB) (also known as the Financial Services Modernization Act) provides you some minimal rights to protect your financial privacy.  However, the burden is on you to assert your rights.  In order to assert your rights, you must understand how to read a privacy notice and the steps you must take to "opt-out," that is limit the sharing of your customer data with other companies.

The law gives you the right to prevent a company you do business with from sharing or selling certain sensitive information to non-affiliated third parties. The term "opt-out" means that unless and until you inform your bank, credit card company, insurance company, or brokerage firm that you do not want them to share or sell your customer data to other companies, they are free to do so.

What is the first step I can take to protect my personal financial information?

Pay attention to the mail you receive from your bank, insurance company, credit card company, and brokerage firm. Look for words such as "Privacy Notice," "Privacy Policy," and "Opt-Out Notice." You might receive such notices via email or the company's website if that is the way you normally do business with them.

Will the notice explain the law and the rights it gives me?

Not in so many words. Some companies may use the notice as a marketing opportunity. Instead of referring to your rights under the law, you may see statements at the beginning of the notice such as these: "Because we respect your privacy" or "In order to provide you with the best services".  However, the rights described in the notices are yours under federal law and companies must give you this notice.

Should I assume the notice is about my rights under GLB?

The notices you receive will actually be a combination of your opt-out rights under two federal laws -- GLB and the Fair Credit Reporting Act (FCRA). The notice may not identify either of these laws by name, so you must be able to identify the words and phrases associated with each law.

An important difference is that GLB allows you to opt-out of information-sharing only with non-affiliated third parties and not with a company's affiliates. The FCRA allows you to opt-out or prevent a company from sharing "creditworthiness" information with its affiliates. 

The following table may help to explain the differences between the opt-out opportunities in the two laws. The terms used in this table are further explained below.

LAW Information Covered Key Words
and Phrases
(sharing and sales) to
Can You Opt-Out? How to
Gramm-Leach-Bliley Act (GLB) Information maintained by a financial institution Personally identifiable financial information, also termed Nonpublic personal information Third-parties Non-Affiliates Yes --Toll-free number
--By mail
      Service providers No  
      Joint marketers No  
      Affiliates No  
    Publicly available information Third-party non-affiliates and/or affiliates No  
Fair Credit Reporting Act (FCRA) Information from consumer reports Transaction and experience information Affiliates No  
    Creditworthiness information Affiliates Yes --Toll-free number
--By mail

I received a privacy notice that said my bank does not sell my information to third-party nonaffiliates. But later in the notice, it says they share information with third-party nonaffiliates "as permitted by law." Can I opt-out or not?

Probably not. The law contains exceptions to your right to opt-out to information sharing with third-party nonaffiliated companies. You cannot opt-out if your company shares information with an outside company that provides services for your company such as check printing. More troubling is the loophole that enables the company to enter into joint marketing agreements with outside companies. Such sharing of information is "permitted by law" and you have no right to opt out.

Will the notice tell me exactly what information the company has about me?

No. The notice need only be general in nature, and an identical notice will be sent to all the company's customers. Do not expect to see anything that applies specifically to you.

You will have to read between the lines. If a notice says that the company collects information from applications you filled out, think about the kinds of information you are required to give on an application for credit or a loan.

Will some information be on all privacy notices?

There are certain key words and phrases that you are likely to see in all notices. You will often see the following words in bold type.

  • Affiliate. Refers to a company that is owned or controlled by the same people or parent company as the one sending the opt-out privacy notice to you. An affiliate is often referred to as a company in the same "corporate family." You cannot opt out of affiliate sharing under GLB. But under the FCRA you can opt-out of having information about your creditworthiness shared with company affiliates. (See Creditworthiness below.)

  • Collect. Tells you what information the company collects about you and where it gets the information.

  • Creditworthiness. Refers to information about how you pay your bills (are you current or overdue?), your credit score, and the risk of giving you credit. You may opt-out of affiliate sharing under the FCRA. (See Affiliate above.)

  • Joint Marketers. Refers to non-affiliated third parties and affiliates that have entered into an agreement with your company to sell you products. An example, would be if your credit card company enters into an agreement with another company to sell you insurance against loss on your credit card account. You cannot opt-out of the sale or sharing of your customer data with Joint Marketers.

  • Non-affiliated Third Party. Refers to all companies, individuals, and organizations that are not affiliates. You can opt-out under GLB.

  • Nonpublic Personal Information. See Personally Identifiable Financial Information.

  • Personally Identifiable Financial Information. Refers to information that may be connected with you and your accounts. For example, information that combines your name with your account balance or income would be personally identifiable information. This phrase comes from GLB and you may choose to opt-out of sharing or sale of this information but only as it pertains to third-party non-affiliates.

  • Publicly Available Information. Refers to information that your financial institution has a reasonable basis to believe is lawfully made available to the general public. For example, your telephone number is public information unless you have an unlisted number. You cannot opt-out.

  • Service Providers. Refers to a company hired to perform a service such as preparing account statements or printing checks for your company. You cannot opt-out.

  • Share, Disclose, or Provide. Tells you what the company does with your personal information. "Share," "disclose," and "provide" will usually be used with the words "affiliate" and/or "non-affiliated third party." When used with the term non-affiliated third party, it is quite likely that your information may be rented, usually on a one-time-use basis. You will seldom see the word "sell" unless the company says it does not sell your information to third party non-affiliates.

  • Transaction and Experience. Refers to information that may include such things as the charges you make on your credit card or the checks you write. This phrase comes from the FCRA. You cannot prevent the company from sharing this information with affiliates under either the FCRA or GLB. However, under GLB you can opt-out of the sharing or sale of this information to a third-party non-affiliate.

    Privacy advocates strongly opposed this loophole in the FCRA because "transaction and experience information" is often highly personal and very sensitive. Think, for example, of the entries in your check register. When you write checks to medical facilities, religious organizations, political candidates, charitable organizations, and so on, you are revealing a great deal of information about yourself. The same can be said of the purchases you make on your credit cards. Your monthly statement can read like a mini-autobiography. Yet, such information can be shared with company affiliates without your permission.

Will the notice tell me what to do if I want to opt-out?

Yes. This is one of the requirements of both GLB and the FCRA. The notice will most likely give you three choices:

  • Send a letter or return an attached form to an address given in the notice.
  • Call a toll-free number given in the notice.
  • Opt-out online if that is the way you normally do business with the company.

 Can I opt-out under the FCRA and GLB at the same time?

It depends. If the company gives you a toll-free number, the same number will likely appear in two places:

  • In connection with your right under GLB to opt-out of information sharing with third-party non-affiliates.
  • In connection with your right under the FCRA to opt-out of sharing your "creditworthiness" information with affiliates.

If you call the toll-free number, an automated system is likely to give you two opt-out choices. Follow the instructions to opt-out under both GLB (non-affiliated third parties) and the FCRA (creditworthiness).

Online, you should be given the same two opt-out choices. If you are familiar with the words that apply to each of the opt-out laws, you should be able to easily follow the online instructions.

Do I have any other opt-out choices?

Although it is not required, the notice may enable you to not receive marketing offers for products or services from that company or its affiliates. Follow the instructions in the notice if you do not want to receive such offers.

Other PRC Financial Privacy Guides:

Financial Privacy in the New Millennium: The Burden Is on You

Credit Reporting Basics: How Private Is My Credit Report?

Content type: 
Copyright © Privacy Rights Clearinghouse. This copyrighted document may be copied and distributed for nonprofit, educational purposes only. For distribution, see our copyright and reprint guidelines. The text of this document may not be altered without express authorization of the Privacy Rights Clearinghouse.