When may a financial institution share consumer information with non-affiliated third parties for marketing purposes?

The Gramm-Leach-Bliley Act (GLBA) Privacy Rule governs how financial institutions handle consumers' nonpublic personal information (NPI). The rule requires institutions to provide customers with a clear and conspicuous privacy notice that describes their information-sharing practices. If the institution intends to share NPI with non-affiliated third parties (outside of certain legal exceptions), it must give consumers a reasonable opportunity to "opt out" of this sharing. The institution cannot share the information until the consumer has been given this notice and opportunity to opt out.

A. The GLBA standard for this type of sharing is opt-out, not opt-in. Opt-in is a higher standard generally not required by GLBA for this purpose.
B. The disclosure must cover all information-sharing practices, not just marketing, and the standard is opt-out, not opt-in.
D. The required disclosure must be about the institution's broader information-sharing practices, not just its marketing practices.

1. Gramm-Leach-Bliley Act, 15 U.S.C. § 6802(b)(1). "Limitation on disclosure of nonpublic personal information to nonaffiliated third parties." This section establishes the notice and opt-out requirement.

2. Federal Trade Commission. (2000). 16 C.F.R. Part 313, "Privacy of Consumer Financial Information" (Privacy Rule). Section 313.10, "Limits on disclosure of nonpublic personal information to nonaffiliated third parties."

3. Langer, M. J. (2001). The Gramm-Leach-Bliley Act. Berkeley Technology Law Journal, 16(1), 195-204. This article discusses the core requirements of the GLBA, including the opt-out provisions for sharing with non-affiliated third parties. (https://doi.org/10.15779/Z383H3B)