15 U.S.C. §§ 6801-6809

Gramm-Leach-Bliley Act

Statute — United States Federal

Effective: November 12, 1999 34 platforms tracked 300 provisions indexed Enforced by: Federal Trade Commission (FTC), Consumer Financial Protection Bureau (CFPB), Federal Banking Regulators (OCC, FDIC, Federal Reserve) Last reviewed Apr 22, 2026

Overview

The Gramm-Leach-Bliley Act requires financial institutions to explain their information-sharing practices to customers and to safeguard sensitive data. The Act has three principal components relevant to platform governance: the Financial Privacy Rule, the Safeguards Rule, and pretexting protections.

The Financial Privacy Rule requires financial institutions to provide customers with privacy notices explaining what information is collected, where it is shared, how it is used, and how it is protected. Customers must receive these notices when they first establish a relationship and annually thereafter.

The Safeguards Rule, updated significantly by the FTC in 2023, requires financial institutions to develop, implement, and maintain a comprehensive information security program including risk assessments, access controls, encryption, multi-factor authentication, and incident response plans.

Penalties

Criminal penalties for pretexting: fines up to $100,000 for individuals, $500,000 for institutions, and up to 5 years imprisonment.

Key Articles & Sections

§ 6802 Privacy Notices and Opt-Out Rights

Financial institutions must provide clear privacy notices and allow customers to opt out of information sharing with nonaffiliated third parties.
Read full text →
§ 6801 Protection of Nonpublic Personal Information

Financial institutions have an obligation to respect customer privacy and protect the security of nonpublic personal information.
Read full text →
16 CFR Part 314 Safeguards Rule (FTC)

Requires comprehensive information security programs including risk assessments, access controls, encryption, MFA, and incident response.
Read full text →
§ 6821-6827 Pretexting Protections

Prohibits obtaining customer financial information through false pretenses, fraudulent statements, or impersonation.
Read full text →

Platforms We Track Subject to GLBA

0 relevant provisions

0 relevant provisions

34 relevant provisions

Bank of America

6 relevant provisions

8 relevant provisions

8 relevant provisions

7 relevant provisions

6 relevant provisions

0 relevant provisions

35 relevant provisions

0 relevant provisions

10 relevant provisions

26 relevant provisions

0 relevant provisions

8 relevant provisions

0 relevant provisions

0 relevant provisions

0 relevant provisions

27 relevant provisions

4 relevant provisions

7 relevant provisions

1 relevant provision

17 relevant provisions

0 relevant provisions

12 relevant provisions

11 relevant provisions

27 relevant provisions

0 relevant provisions

0 relevant provisions

19 relevant provisions

Showing 30 of 34 platforms. View all platforms →

Recent Changes Related to GLBA

Apr 20, 2026 Chime Medium

Chime updated the Bancorp Bank privacy notice on April 20, 2026, reverting it to an older 2017 version from the 2025 version. A key change is that The Bancorp now states it does NOT engage in joint m…
View change record →
Apr 19, 2026 Robinhood Low

Robinhood updated their Privacy Policy on April 19, 2026 by adding a single sentence that appears to be a navigation menu listing their product and service offerings. Before this update, this navigat…
View change record →
Apr 19, 2026 Coinbase Low

Coinbase updated their fee schedule on April 19, 2026, adding a customer support chat feature to the page. The page now includes a 'Need more help?' section with a link to start a chat with a virtual…
View change record →
Apr 19, 2026 Coinbase Low

Coinbase made a minor formatting update to their Privacy Policy on April 19, 2026. The only change was the removal of an extra space before the word 'Basic' in a sentence describing data used for Ver…
View change record →
Apr 19, 2026 Google Medium

Google updated its Privacy Policy on April 19, 2026, adding a new section specifically addressing U.S. state privacy law requirements. The new text explicitly states that Google does not sell your pe…
View change record →
Apr 19, 2026 Google High

Google updated its Terms of Service on April 19, 2026, making several notable changes to how it describes its obligations to users. The country version shifted from Cambodia to United States, the war…
View change record →
Apr 18, 2026 Credit Karma Low

Credit Karma updated their privacy policy on April 18, 2026, with a minor change to their navigation menu. The word 'Tax' was replaced with 'Free Credit Karma Tax' in the product listing within the d…
View change record →
Apr 18, 2026 Credit Karma Low

Credit Karma updated their Terms of Service on April 18, 2026, making a small change to their navigation menu. The word 'Tax' was replaced with 'Free Credit Karma Tax' in the product listing area. Th…
View change record →
Apr 18, 2026 Webull Low

On April 18, 2026, Webull made a minor update to the navigation or header section of their Privacy Policy page, adding a 'WEBTRADE' label and removing a 'New Version' tag from the Desktop App listing…
View change record →
Apr 18, 2026 Webull Low

Webull updated their Terms of Service navigation on April 18, 2026, adding a 'WEBTRADE' label and removing the 'New Version' tag from the Desktop App section. The core content of the terms themselves…
View change record →

Official Source

View official regulation text →

Get alerted when platforms change their policies — including GLBA-relevant provisions.

Subscribe to Watcher — $9.99/mo