United States

Gramm-Leach-Bliley Act (GLBA) privacy and safeguards rules

Federal law for businesses that provide financial products or services, such as lending, mortgage brokering, tax prep and dealer financing.

Status
In effect since July 1, 2001
Citation
15 U.S.C. § 6801; 16 C.F.R. Parts 313–314
Official text
Read the law(opens in a new tab)

Who it covers

Financial institutions in a broad sense, including mortgage brokers, lenders, settlement services and dealers that arrange financing.

What it asks of your website

  • Give customers a privacy notice explaining what financial data you share and their right to opt out.
  • Run a written information security program (FTC Safeguards Rule).
  • Report certain data breaches to the FTC.

Who counts as a financial institution

The Gramm-Leach-Bliley Act covers any business significantly engaged in financial activities, which is broader than banks. The FTC’s examples include mortgage brokers, tax preparers, payday lenders, finders, auto lessors and many auto dealers. The FTC enforces the rules for financial institutions not overseen by another regulator.

It protects “nonpublic personal information” about consumers. For websites, one detail matters: the CFPB’s Regulation P lists information collected through an internet cookie as an example.

Privacy notices and the opt-out

  • Give customers a privacy notice when the relationship starts, and every 12 months after that, unless you share data only in the limited ways the rules allow and haven’t changed your practices.
  • Let consumers opt out before you share their information with most unaffiliated third parties.
  • Using the government’s model privacy form counts as meeting the notice content rules.

The Safeguards Rule

The FTC’s Safeguards Rule requires a written information security program, including:

  • A qualified individual in charge, reporting in writing at least once a year.
  • A written risk assessment.
  • Encryption of customer information in transit and at rest, and multi-factor authentication for anyone accessing your systems.
  • Disposal within two years of last use, activity logging, yearly penetration tests and vulnerability scans every six months.

Institutions with fewer than 5,000 consumers are exempt from some of these, such as the written risk assessment and testing.

Breach reporting and enforcement

Since May 13, 2024, you must tell the FTC within 30 days of discovering that unencrypted information of 500 or more consumers was acquired without authorization.

The FTC enforces the rules; FTC Act civil penalties are up to $53,088 per violation in 2026. In 2023 the FTC warned tax preparers against using pixels, cookies and similar tracking technologies with consumers’ data without express consent.

Most state privacy laws exempt GLBA financial institutions or GLBA data, though some newer ones exempt only the data.

Where GoConsent helps

Privacy Policy builder

A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.

Opt-outs and requests

Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.

A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.

FAQ

Questions, answered

Does GLBA apply to my business?

If you’re significantly engaged in financial activities, such as lending, mortgage brokering or tax preparation, it can.

Do cookies count under GLBA?

Regulation P lists information collected through a cookie as an example of protected personal information.

When must I report a breach to the FTC?

Within 30 days of discovering one involving unencrypted information of 500 or more consumers.

Sources

Check your site against this law

GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.

Get GoConsent free See Pro plans