The Gramm-Leach-Bliley Act, often called GLBA, is a 1999 federal law that requires any business “significantly engaged” in financial activities to protect the personal data of its customers.1U.S. Government Publishing Office. Public Law 106-102 – Gramm-Leach-Bliley Act Also known as the Financial Services Modernization Act, it tore down longstanding walls between banking, securities, and insurance while building a federal framework for financial privacy. The law rests on three pillars: privacy notices telling consumers what happens with their data, a written security program that protects that data, and a ban on using deception to pry financial records loose from an institution.
Who Has to Follow It
GLBA defines a “financial institution” as any business significantly engaged in activities that are financial in nature, keying that definition off the Bank Holding Company Act.2Office of the Law Revision Counsel. 15 USC 6809 – Definitions The reach is much wider than the word “bank” suggests.
FTC guidance lists mortgage brokers, check-cashing services, payday lenders, tax preparers, financial planners, credit counselors, debt collectors, wire transfer services, and investment advisors as covered entities.3Federal Trade Commission. How To Comply with the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act Storefront or online does not matter. The test is the activity, not the label a company uses for itself.
A few categories sit outside the definition, including entities regulated by the Commodity Futures Trading Commission, Farm Credit System institutions, and certain government-chartered secondary market institutions.2Office of the Law Revision Counsel. 15 USC 6809 – Definitions
The Privacy Rule: Notices and Opt-Outs
GLBA places an ongoing obligation on every covered institution to protect the privacy of its customers and the confidentiality of their nonpublic personal information.4Office of the Law Revision Counsel. 15 USC 6801 – Protection of Nonpublic Personal Information
Institutions must give customers a written privacy notice at the start of the relationship and, in most cases, at least once a year after that. The notice has to spell out what categories of nonpublic personal information the company collects, who it shares that data with, and how it protects the information.5Office of the Law Revision Counsel. 15 USC 6803 – Disclosure of Institution Privacy Policy Nonpublic personal information means data like Social Security numbers, account balances, credit card numbers, payment histories, income, and tax return details collected in connection with a financial product or service. An institution that neither shares data in ways that trigger the opt-out right nor changes its privacy practices year over year can skip the annual notice, a narrower carve-out added by the FAST Act in 2015.
Before sharing a customer’s nonpublic personal information with a nonaffiliated third party, the institution has to give the customer a real chance to say no. That means disclosing that sharing may occur, explaining how to opt out, and waiting for the customer’s decision before releasing anything.6Office of the Law Revision Counsel. 15 USC 6802 – Obligations with Respect to Disclosures of Personal Information
The opt-out does not cover every kind of sharing. Institutions can disclose data without offering an opt-out when doing so is necessary to process a transaction the customer requested, service the account, prevent fraud, respond to a subpoena, comply with other laws, or report to consumer reporting agencies. They can also share with the customer’s consent or in connection with the sale of the business.7Office of the Law Revision Counsel. 15 USC 6802 – Obligations with Respect to Disclosures of Personal Information
The Safeguards Rule: A Written Security Program
The FTC’s Safeguards Rule turns GLBA’s general data-protection mandate into concrete requirements. Every covered financial institution must develop, implement, and maintain a written information security program scaled to the size and complexity of its operations and the sensitivity of the data it handles.8Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know A 2021 overhaul replaced the earlier vague standards with specific obligations.
The rule requires a designated “Qualified Individual” to run the security program. That person can be an employee, an affiliate, or a service provider, but if outsourced, a senior staff member at the institution must direct that individual, and the institution keeps full responsibility for compliance.9eCFR. 16 CFR 314.4 – Elements
The program itself must build in specific safeguards:
- A risk assessment identifying foreseeable internal and external threats to customer data.
- Access controls that authenticate users and limit each person to the information they need.
- Encryption of customer information both in transit over external networks and at rest, with any alternative control approved in writing by the Qualified Individual.
- Multi-factor authentication for anyone accessing an information system, unless a written approval allows a reasonably equivalent or stronger alternative.
- Secure disposal of customer information no later than two years after it was last used, absent a legal or legitimate business reason to keep it.
- Secure development practices for in-house applications and evaluation of third-party applications that handle customer data.
Institutions maintaining customer information on fewer than 5,000 consumers get relief from some of the more resource-intensive requirements, including written risk assessments, continuous monitoring, annual penetration testing, and formal board reporting.10eCFR. 16 CFR 314.6 – Exceptions They still need a security program, just with more flexibility in how it is documented and tested.
Breach Notification
Since May 2024, the Safeguards Rule has carried a breach notification obligation. When a covered institution discovers that unencrypted customer information was acquired without authorization and the incident touches at least 500 consumers, it must notify the FTC as soon as possible and no later than 30 days after discovery.11Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect Data is treated as unencrypted if the encryption key was itself accessed by an unauthorized person.12Federal Register. Standards for Safeguarding Customer Information
The clock starts on the first day anyone at the institution, other than the person who caused the breach, knows about it. This is a federal reporting obligation to the FTC and sits alongside state breach notification laws, which typically require direct notice to affected individuals under their own deadlines.
The Pretexting Ban
GLBA makes it a crime to obtain someone’s financial records through deception. The statute prohibits using false statements to a financial institution’s employees or customers and submitting forged or fraudulent documents to access another person’s account information.13Office of the Law Revision Counsel. 15 USC 6821 – Privacy Protection for Customer Information of Financial Institutions It also bars asking someone else to do it. In practice, pretexting shows up as a phone call from someone posing as the account holder, a phishing email aimed at a bank employee, or a fake document dropped at an HR desk.
Anyone who knowingly violates or attempts to violate the pretexting ban faces fines under federal sentencing guidelines and up to five years in prison. When the conduct is part of a pattern of illegal activity involving more than $100,000 in a 12-month period, or occurs alongside another federal crime, the maximum prison term rises to 10 years and the fine can be doubled.14Office of the Law Revision Counsel. 15 USC 6823 – Criminal Penalty
Who Enforces GLBA
No single agency owns enforcement. Authority is divided among the Consumer Financial Protection Bureau, federal banking regulators, the Securities and Exchange Commission, the National Credit Union Administration, state insurance authorities, and the FTC, with each agency covering the institutions already within its jurisdiction.15Office of the Law Revision Counsel. 15 USC 6805 – Enforcement The FTC acts as the catch-all for financial institutions that no other agency supervises, which is why nonbank businesses like mortgage brokers and tax preparers often deal with the FTC directly.
Civil penalties depend on the enforcing agency’s own authority. Banking regulators reach both the institution and its individual officers under existing banking law. The FTC uses its own penalty framework. Because fines accrue per violation, a breach that touches thousands of customers can produce serious exposure, and the criminal pretexting penalties apply on top of anything civil.
GLBA does not give consumers a private right of action. You cannot sue a financial institution directly under GLBA for a privacy or safeguards failure. Enforcement flows through the agencies. Breaches caused by noncompliance still spawn lawsuits under other theories, though, such as state consumer protection statutes or negligence claims.
GLBA and State Privacy Laws
GLBA does not preempt stronger state privacy protections. The statute says it should not be read as superseding any state law except where the state law directly conflicts with GLBA, and then only to the extent of that conflict.16Office of the Law Revision Counsel. 15 USC 6807 – Relation to State Laws A state law that gives consumers more protection stands, with the Consumer Financial Protection Bureau making that determination in consultation with the relevant enforcement agency.
For a business operating in more than one state, GLBA sets a floor. Full compliance with the federal Safeguards Rule and privacy notice requirements can still leave a company short of state data privacy statutes, state breach notification laws, or state insurance regulations. Treating GLBA as the whole picture is one of the more expensive mistakes in this area.