Law / United States

Regulation P: limits on disclosure to nonaffiliated third parties and the opt out

12 CFR 1016.7 and 1016.10 to 1016.15

In force since 30 Dec 2011.

A data subject rights rule binding private bodies.

Obligation class

Data subject rights, Prohibition

Audit expectation

none

As of 25 October 2026.

What it requires

• If you are a financial institution that Regulation P covers, then, except as otherwise authorized in this part, do not, directly or through an affiliate, disclose nonpublic personal information about a consumer to a nonaffiliated third party unless you have given the consumer the initial notice and an opt out notice, have given the consumer a reasonable opportunity to opt out before the disclosure, and the consumer does not opt out; this applies whether or not the consumer is your customer.
• Give each consumer a clear and conspicuous opt out notice stating that you disclose or reserve the right to disclose nonpublic personal information about the consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means to do so, such as check-off boxes, a reply form, an electronic means or a toll-free telephone number; requiring the consumer to write his or her own letter is not a reasonable means.
• Allow a reasonable opportunity to opt out, such as 30 days from the date you mailed the notices or, for an online account, 30 days after the customer acknowledges receipt of the notices.
• Honor an opt out for all nonpublic personal information you have collected about the consumer, whether you collected it before or after the direction to opt out.
• Comply with a consumer's opt out direction as soon as reasonably practicable after you receive it; let a consumer opt out at any time; treat the direction as effective until the consumer revokes it in writing or, if the consumer agrees, electronically; after a customer relationship ends, the direction continues to apply to the information you collected during or related to that relationship, but it does not apply to a new customer relationship.
• Do not disclose an account number or similar access number or access code for a consumer's credit card, deposit, share or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, other than to a consumer reporting agency. This does not bar disclosure to your agent or service provider solely to perform marketing for your own products or services if it is not authorized to initiate charges to the account, or to a participant in a private label credit card program or an affinity or similar program where the participants are identified to the customer when the customer enters the program. A number or code in encrypted form is not an account number if you give the recipient no means to decode it.
• To provide nonpublic personal information to a nonaffiliated third party that performs services or functions on your behalf without an opt out, give the initial notice and enter into a contract that prohibits the third party from disclosing or using the information other than to carry out the purposes for which you disclosed it.
• The notice to a consumer who is not a customer under section 1016.4(a)(2), the opt out requirements of sections 1016.7 and 1016.10, and the service provider and joint marketing requirements of section 1016.13 do not apply when you disclose nonpublic personal information as necessary to effect, administer or enforce a transaction a consumer requests or authorizes, or in connection with servicing or processing a requested financial product or service, maintaining or servicing the consumer's account, or a proposed or actual securitization or secondary market sale (section 1016.14(a)); the notice you owe a customer under section 1016.4(a)(1) still applies.
• The same three requirements (the initial notice requirement in section 1016.4(a)(2), the opt out requirements of sections 1016.7 and 1016.10, and the service provider and joint marketing requirements of section 1016.13) also do not apply to a disclosure made with the consumer's consent or at the consumer's direction (until revoked); to protect the confidentiality or security of your records or against fraud; for required institutional risk control or to resolve consumer disputes or inquiries; to persons holding a legal or beneficial interest relating to the consumer or acting in a fiduciary or representative capacity for the consumer; to insurance rate advisory organizations, guaranty funds or agencies, agencies rating you, persons assessing your compliance with industry standards, and your attorneys, accountants and auditors; to law enforcement agencies, self-regulatory organizations and for an investigation on a matter related to public safety, to the extent specifically permitted or required under other provisions of law and in accordance with the Right to Financial Privacy Act of 1978; to a consumer reporting agency under the Fair Credit Reporting Act; in connection with a sale, merger, transfer or exchange of a business or operating unit that concerns solely its consumers; or to comply with law, a properly authorized investigation, subpoena or summons, or judicial process (section 1016.15(a)).
• If you receive nonpublic personal information from a nonaffiliated financial institution under an exception, disclose and use it only as section 1016.11 permits: to that institution's affiliates, to your affiliates (which may use it only as you may), and under an exception to carry out the activity covered by the exception under which you received it.
• If you receive nonpublic personal information from a nonaffiliated financial institution outside an exception, disclose it only to that institution's affiliates, to your affiliates (which may disclose it only as you may), and to any other person if the disclosure would be lawful if made directly to that person by the institution that gave it to you.
• The rule reaches a financial institution, meaning an institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as section 4(k) of the Bank Holding Company Act describes; it covers only information about individuals who obtain financial products or services primarily for personal, family, or household purposes. The rule also reaches third parties that are not financial institutions but that receive nonpublic personal information from financial institutions with whom they are not affiliated.
• The rule does not apply to certain motor vehicle dealers described in section 1029(a) of the Consumer Financial Protection Act, a financial institution or other person subject to the jurisdiction of the Commodity Futures Trading Commission under 7 U.S.C. 7b-2, a registered broker or dealer, a registered investment adviser with respect to its investment advisory activities, a registered investment company, or an insurance company with respect to its insurance activities that a state insurance regulator supervises.

These lines are LexLint's reading of the law's text, as of 25 October 2026.

Who enforces it

When LexLint raises it

When your app profile says your app is a bank, is a lender or is a payment provider.

Back to the example  ·  Lint your app