GLBA

Overview

The GLBA requires financial institutions to explain their information-sharing practices and provide customers with the right to opt out of sharing with non-affiliated third parties. The updated Safeguards Rule (effective June 2023) mandates comprehensive information security programs including encryption, MFA, and incident response plans.

What This Means for Your Website

• If you are a financial institution, privacy notices explaining information-sharing practices are required
• Customers must have an opt-out mechanism for sharing with non-affiliated third parties
• A comprehensive written information security program is mandatory under the Safeguards Rule
• Most US state privacy laws exempt GLBA-regulated entities from their requirements
• A CMP serving financial institution websites must account for GLBA opt-out requirements

Key Requirements

Multiple regulators enforce GLBA: FTC, federal banking regulators, SEC, and state insurance regulators. Criminal penalties include up to $100,000 per institution and $10,000 per individual plus 5 years imprisonment. The Safeguards Rule requires a designated qualified individual overseeing the security program, risk assessments, and incident response planning.

How ConsentStack Handles This

ConsentStack supports financial institution websites by implementing the opt-out model required by GLBA alongside any applicable state law requirements.