Law / United States

Regulation P: privacy notices to customers and consumers

Also known as Regulation P.

12 CFR 1016.4 to 1016.6, 1016.8 and 1016.9

In force since 30 Dec 2011.

A privacy notice rule binding private bodies.

Obligation class

Disclosure

Audit expectation

none

As of 25 October 2026.

What it requires

• If you are a financial institution that Regulation P covers, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and give a consumer who is not a customer that notice before you disclose any nonpublic personal information about the consumer to a nonaffiliated third party, other than as sections 1016.14 and 1016.15 authorize.
• You may give a customer the initial notice within a reasonable time after you establish the customer relationship if establishing it is not at the customer's election, or if giving it earlier would substantially delay the customer's transaction and the customer agrees to receive it later.
• Give each customer the notice again at least once in any period of 12 consecutive months during the customer relationship, unless you provide nonpublic personal information to nonaffiliated third parties only as sections 1016.13, 1016.14 or 1016.15 allow and have not changed the disclosure policies and practices in your most recent notice.
• If you lose the annual notice exception, give an annual notice: when you were required to give a revised notice, on the annual schedule treating the revised notice as an initial notice; otherwise within 100 days of the change in your policies or practices.
• Except as otherwise authorized in the rule, do not disclose nonpublic personal information about a consumer to a nonaffiliated third party other than as described in your initial notice unless you have given a clear and conspicuous revised notice that accurately describes your policies and practices and a new opt out notice, have given a reasonable opportunity to opt out, and the consumer does not opt out; give a revised notice before you disclose a new category of information, disclose to a new category of nonaffiliated third party, or disclose information about a former customer who has not had the chance to opt out. A revised notice is not required for a new nonaffiliated third party that your prior notice adequately described.
• State in each notice the categories of nonpublic personal information you collect and disclose; the categories of affiliates and nonaffiliated third parties to which you disclose it; the categories of information about former customers you disclose and the parties you disclose it to; a separate statement of the categories of information and of third parties under contract where you disclose to a service provider or joint marketing partner without an opt out; the consumer's right to opt out and how to exercise it; any notice about opting out of affiliate sharing under the Fair Credit Reporting Act; and your policies and practices for protecting the confidentiality and security of the information. Where you disclose to third parties as sections 1016.14 and 1016.15 authorize, you need not list those exceptions; it is enough to say that you disclose to other nonaffiliated companies for your everyday business purposes, or as permitted by law.
• Deliver each notice so that each consumer can reasonably be expected to receive actual notice in writing or, if the consumer agrees, electronically; an oral explanation alone does not meet the rule. For customers, provide the initial, annual and revised notices so that the customer can retain them or obtain them later in writing or, if the customer agrees, electronically.
• The rule reaches a financial institution, meaning an institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as section 4(k) of the Bank Holding Company Act describes; it covers only information about individuals who obtain financial products or services primarily for personal, family, or household purposes.
• The rule does not apply to certain motor vehicle dealers described in section 1029(a) of the Consumer Financial Protection Act, a financial institution or other person subject to the jurisdiction of the Commodity Futures Trading Commission under 7 U.S.C. 7b-2, a registered broker or dealer, a registered investment adviser with respect to its investment advisory activities, a registered investment company, or an insurance company with respect to its insurance activities that a state insurance regulator supervises.

These lines are LexLint's reading of the law's text, as of 25 October 2026.

Who enforces it

When LexLint raises it

When your app profile says your app is a bank, is a lender or is a payment provider.

Back to the example  ·  Lint your app