California residents are directed to a separate California Consumer Privacy Notice that may provide additional rights beyond what this federal GLBA notice covers.
This analysis describes what Bank of America's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
California law provides consumers with rights that may go beyond federal GLBA protections, including rights to know, delete, and limit use of sensitive personal information, but those rights are in a separate document not fully reproduced here.
Interpretive note: The document references a separate California Consumer Privacy Notice without reproducing its contents; the full scope of California rights available is not determinable from this document alone.
If you are a California resident, you may have rights under the CCPA including the right to know what personal information is collected, the right to request deletion, and the right to opt out of certain data uses, but you must consult the separate California Consumer Privacy Notice to understand those rights fully.
How other platforms handle this
Depending on where you are located, you may have certain rights regarding your personal information, including the right to access, correct, delete, or restrict processing of your personal information, the right to data portability, and the right to object to or withdraw consent for certain processi...
Depending on your location, you may have certain rights regarding your personal data, including the right to access, correct, delete, or port your data. EU and UK users may also have the right to object to or restrict certain processing. California residents may have the right to know, delete, corre...
This Privacy Notice contains the following sections: ... 8. Additional Information for California Residents ... 9. Additional U.S. State Privacy Disclosures
Monitoring
Bank of America has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"For California residents: If you are a California resident, you may have additional privacy rights under California law. Please see our California Consumer Privacy Notice for more information.— Excerpt from Bank of America's Bank of America Privacy Notice
REGULATORY LANDSCAPE: California residents are subject to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General. The California Financial Information Privacy Act (CFIPA) may also apply to financial data sharing. GLBA provides limited preemption of state privacy laws but does not fully preempt CCPA for data uses beyond the GLBA's defined exceptions. GOVERNANCE EXPOSURE: High for California-specific compliance. The interaction between GLBA and CCPA is a complex and evolving area of law. If the bank's California-specific notice does not adequately address CCPA rights including the right to know, delete, and limit sensitive personal information use, the bank may face enforcement action from the CPPA or California AG. JURISDICTION FLAGS: This provision applies exclusively to California residents. Compliance teams should ensure that the California Consumer Privacy Notice is current, consistent with this federal notice, and accessible. Any discrepancies between the two notices regarding data practices could create enforcement exposure. CONTRACT AND VENDOR IMPLICATIONS: Vendor agreements should address CCPA-specific data processing obligations for California resident data, including data subject request workflows, deletion obligations, and restrictions on selling or sharing personal information as defined under CCPA. COMPLIANCE CONSIDERATIONS: Legal teams should maintain a current California-specific privacy notice, audit whether all data flows disclosed in the federal GLBA notice are also adequately disclosed under CCPA standards, and ensure that California consumer rights requests (know, delete, correct, limit) are operationally supported and responded to within CCPA-required timeframes.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
California law provides consumers with rights that may go beyond federal GLBA protections, including rights to know, delete, and limit use of sensitive personal information, but those rights are in a separate document not fully reproduced here.
If you are a California resident, you may have rights under the CCPA including the right to know what personal information is collected, the right to request deletion, and the right to opt out of certain data uses, but you must consult the separate California Consumer Privacy Notice to understand those rights fully.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Bank of America.