Do Credit Card Companies Sell Your Data? Opt-Out Rights and State Laws

Credit card companies do not sell your data in the way most people picture it. Federal law bars them from handing your account number to outside marketers, and they generally don’t sell lists with your name attached. What they do is share information freely with their corporate affiliates, pass data to non-affiliate marketing partners (which you can block), and sell anonymized spending trends to businesses. The Gramm-Leach-Bliley Act gives you the right to opt out of most sharing with unaffiliated companies, and the request takes a few minutes through your issuer’s website, phone line, or a mailed form.

What “Selling” Actually Looks Like

The word “sell” gets used loosely, and the reality has several layers, each with different rules.

Affiliate sharing is the most common path. Large financial companies like JPMorgan Chase or Citigroup own banking, insurance, and brokerage divisions under one corporate umbrella, and your issuer can share your information freely with those sibling companies to cross-sell products. Federal law does not give you the right to block this basic affiliate sharing.¹

Non-affiliate marketing is where opt-out rights kick in. When an issuer wants to share your information with an unrelated company for marketing purposes, it must give you advance notice and a chance to say no.¹ This is the category most people have in mind when they worry about their data being sold.

Anonymized and aggregated data is a separate business. Payment networks and issuers strip out names and account numbers, then package spending trends by ZIP code, age group, or merchant category and sell those datasets to retailers, hedge funds, and market research firms. Visa ran an advertising data business built on anonymized cardholder segments before shutting it down, and other networks continue to offer similar analytics products. Because no individual is identifiable in these datasets, opt-out rights generally do not apply.

One protection matters here: federal law flatly prohibits your issuer from sharing your actual account number or access code with any unaffiliated company for telemarketing, direct mail, or email marketing.¹ Even when spending categories or names move, your card number does not.

What You Can Block and What You Cannot

The Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6809) is the main federal law governing how financial institutions handle your personal information. It requires every credit card issuer to send you a privacy notice when you open your account and, in most cases, annually after that.¹ Before sharing your nonpublic personal information with an unaffiliated third party, the issuer must clearly explain the sharing, give you a chance to say no, and tell you how to exercise that choice. The issuer must give you at least 30 days to respond before sharing begins.²

The GLBA also carves out broad exceptions where sharing happens regardless of your preferences. Issuers can share your data without offering an opt-out when it is necessary to process a transaction you requested, service your account, prevent fraud, respond to a subpoena, report to credit bureaus, or comply with other federal and state laws.³

Several categories of data movement are baked into how credit cards work, and no opt-out will stop them:

Credit bureau reporting. Your issuer reports payment history, balance, credit limit, and account status to the major bureaus. Negative information like late payments stays on your credit report for up to seven years, and bankruptcies for up to ten.⁴
Payment processing. Every swipe or tap sends transaction details from the merchant to the payment network and then to your issuer. This exchange authorizes purchases and settles funds.
Fraud detection. Real-time spending data goes to monitoring systems that flag suspicious activity, one of the GLBA’s explicit exceptions.³
Government and law enforcement. Issuers must comply with subpoenas, court orders, and regulatory investigations. Under the Bank Secrecy Act, they must also file a Suspicious Activity Report for any transaction of $5,000 or more that shows signs of illegal activity, and a Currency Transaction Report for cash transactions exceeding $10,000.⁵

Opting out narrows the marketing pipeline. It does not make your financial activity invisible to the system.

How to Opt Out of Your Issuer’s Data Sharing

Start with the privacy notice from your credit card issuer. If you can’t find the mailed copy, log into your online banking portal and look under account disclosures or privacy settings. The notice lists each category of sharing the company engages in and which categories you can restrict.

Most issuers accept opt-outs three ways:

Online, through a privacy settings or data sharing preferences page in your account dashboard. Some issuers let you toggle off non-affiliate sharing with one click.
By phone, using the toll-free number in your privacy notice. Most have automated prompts specifically for privacy elections.
By mail, using the signed form in the privacy notice. This creates a paper trail if there’s a dispute later.

Once the issuer receives your request, it must honor it as soon as reasonably practicable.² Your opt-out stays in effect until you revoke it in writing. You don’t need to renew it annually. Even if you close the account, the opt-out continues to cover information the issuer collected during your relationship.⁶ If you later open a new account with the same company, you’ll need to opt out again for the new relationship.

A separate federal rule handles affiliate marketing. Even when you can’t stop your issuer from sharing data with affiliates, you can stop those affiliates from using the information to send you marketing solicitations. This affiliate marketing opt-out lasts for at least five years. Exceptions apply if you already have a business relationship with the affiliate, if you initiated the contact, or if you specifically authorized the solicitations.⁷

How to Stop Prescreened Credit Card Offers

Unsolicited credit card offers come through a different pipeline than issuer data sharing. Under the Fair Credit Reporting Act, credit bureaus can include your name on lists sold to creditors and insurers for prescreened offers.⁸ Two options shut this off:

Five-year opt-out. Visit OptOutPrescreen.com or call 1-888-5-OPT-OUT (1-888-567-8688). You’ll need to provide your name, address, Social Security number, and date of birth.
Permanent opt-out. Start at the same website or phone number, then sign and return the Permanent Opt-Out Election form you receive. Until that signed form is submitted, you only get the five-year version.

This is separate from your GLBA opt-out with your card issuer. Stopping prescreened offers prevents credit bureaus from distributing your information for new solicitations; the GLBA opt-out limits how your existing issuer shares your data with outside marketers.⁹ Doing both gives you the most complete protection.

State Laws That Go Further

Several states have enacted privacy laws that exceed the federal baseline. California’s Consumer Privacy Act is the most prominent example, giving residents the right to know what personal information a business has collected, request deletion of that data, and direct businesses not to sell or share it.¹⁰

Any business that sells personal information must display a “Do Not Sell or Share My Personal Information” link on its website. You don’t need to create an account or verify your identity to submit the request. Once you opt out, the business must wait at least 12 months before asking you to opt back in.¹⁰ The CCPA’s broad definition of “sale” captures data transfers that the GLBA might classify as mere “sharing,” and it applies to credit card issuers operating in California. A growing number of other states have passed comparable laws, with specifics varying by jurisdiction.

If Your Opt-Out Is Ignored

The GLBA does not give you the right to sue your credit card company directly for a privacy violation. Enforcement falls to federal regulators, primarily the CFPB and the FTC, along with federal banking agencies like the OCC and the FDIC. If you believe your issuer is ignoring your opt-out or mishandling your data, filing a complaint with the CFPB is the most direct way to get a regulator’s attention.

State law may add recourse. Under the CCPA, California residents can bring private lawsuits for certain data breaches involving unencrypted personal information, and other state privacy laws are opening similar avenues. What’s available depends on where you live and which law was violated.

1
Office of the Law Revision Counsel. 15 USC Chapter 94, Subchapter I – Disclosure of Nonpublic Personal Information
2
eCFR. 12 CFR Part 1016 – Privacy of Consumer Financial Information (Regulation P)
3
Office of the Law Revision Counsel. 15 USC 6802 – Obligations With Respect to Disclosures of Personal Information
4
Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act
5
Internal Revenue Service. Bank Secrecy Act
6
eCFR. 17 CFR Part 160 – Privacy of Consumer Financial Information Under Title V of the Gramm-Leach-Bliley Act
7
eCFR. 17 CFR 248.121 – Affiliate Marketing Opt Out and Exceptions
8
OptOutPrescreen.com. OptOutPrescreen.com
9
Federal Trade Commission. What To Know About Prescreened Offers for Credit and Insurance
10
State of California Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)