Money, Credit and Financial Data

Financial privacy law in the United States is older than most of the internet. Congress wrote the Fair Credit Reporting Act in 1970 to rein in the credit bureaus, and wrote the privacy and security parts of the Gramm-Leach-Bliley Act in 1999 when it let banks, insurers and securities firms merge. Both laws were built around a simple fact: a file about your money can cost you a loan, a job or an apartment, and a stolen one can be turned into new accounts in your name. This lesson covers what each law requires, the rules that carry them out, the newer state and agency rules on top, and the cases that show what regulators mean by "reasonable." The definitions of "consumer report" and "nonpublic personal information" are in lesson 01; this lesson uses them without repeating them.

The Fair Credit Reporting Act

The FCRA binds three groups. Consumer reporting agencies assemble the files: the three nationwide bureaus, Equifax, Experian and TransUnion, plus a long tail of specialty agencies that screen tenants, check writers, job applicants and insurance customers. Users pull reports to make decisions: lenders, landlords, employers, insurers. Furnishers send data into the files: banks, card issuers, auto lenders, debt collectors. Each group has its own duties, and most of the law's power comes from the way those duties interlock.

Permissible purpose

A bureau may hand over a report only for a reason the statute lists. 15 U.S.C. 1681b(a) allows reports for a court order or certain subpoenas, on the consumer's written instructions, and for a user the bureau has reason to believe intends to use it for a credit transaction (including reviewing or collecting an account), employment, insurance underwriting, a government license or benefit that by law depends on financial responsibility, an investor's or servicer's assessment of an existing loan, or a "legitimate business need" in a transaction the consumer started. Curiosity is not on the list. Neither is checking out a neighbor, an ex or a political opponent.

Employment gets extra rules. Under 1681b(b), an employer must give a clear written disclosure, before it orders the report, "in a document that consists solely of the disclosure," and must get the applicant's written authorization. Lawsuits over job applications that buried the disclosure inside a longer form are a steady part of FCRA litigation. If the employer then plans to act on the report, it owes the applicant a copy of the report and a summary of rights before taking the action.

Prescreened offers, the "you're pre-approved" mail, are allowed under 1681b(c) only if the offer is a firm offer of credit or insurance and you have not opted out. Under 1681b(e), an opt-out made through the bureaus' notification system lasts five years. An opt-out confirmed with a signed form lasts until you revoke it. The bureaus run that system together at OptOutPrescreen.com and at 1-888-567-8688, the FTC says.

Medical information gets its own fence. 1681b(g) bars bureaus from putting medical information in reports for employment or credit decisions without the consumer's specific written consent, and requires affirmative consent for insurance. Medical debts may be reported with codes that hide the provider and the kind of care.

Accuracy and disputes

Under 15 U.S.C. 1681e(b), every bureau must "follow reasonable procedures to assure maximum possible accuracy of the information." When you dispute an item, 15 U.S.C. 1681i starts a clock:

• 30 days from the day the bureau receives your dispute to reinvestigate for free or delete the item.
• Up to 15 more days if you send relevant new information during the first 30.
• 5 business days after it finishes to send you the results in writing.
• If the dispute is not resolved, you may add a brief statement to your file. The bureau may limit it to 100 words if it helps you write a clear summary.

The bureau may stop work on a dispute it reasonably finds "frivolous or irrelevant," for example when you give too little information to investigate, but it must tell you within 5 business days and say what it needs. The bureau also has to forward your dispute to the furnisher, which has its own duty to investigate and correct.

How long bad news can stay

15 U.S.C. 1681c sets the limits. Bankruptcies can be reported for 10 years. Civil suits, judgments and arrest records for 7 years or the statute of limitations, whichever is longer. Paid tax liens, accounts in collection and charged-off accounts for 7 years, with the collection clock starting 180 days after the delinquency that led to it. Criminal convictions have no time limit under federal law. The limits do not apply to reports for credit or life insurance of $150,000 or more, or a job paying $75,000 or more a year, two thresholds Congress has never indexed to inflation.

Adverse action notices

When a lender, landlord, insurer or employer turns you down or charges you more based on a report, 15 U.S.C. 1681m(a) requires a notice. It must name the bureau with its address and phone number (a toll-free number for nationwide bureaus), say the bureau did not make the decision and cannot explain it, give the credit score used if one was used, and tell you that you may get a free copy of the report within 60 days and dispute anything in it. A separate risk-based pricing notice under 1681m(h) goes to people offered worse terms than most customers get. Congress made that subsection enforceable only by agencies, so you cannot sue over a missing risk-based pricing notice.

Free reports

Each nationwide bureau must give you your file once in any 12-month period, free, through the centralized source Congress created, AnnualCreditReport.com, within 15 days of your request (15 U.S.C. 1681j). You also get a free report within 60 days of an adverse action notice, when a fraud alert is on your file, and once a year if you certify that you are unemployed and looking for work within 60 days, on public assistance, or believe fraud has made your file inaccurate. Specialty agencies must offer a streamlined request with at least a toll-free number. Under the 2019 Equifax settlement, all U.S. consumers can get extra free Equifax reports: the FTC's July 22, 2019 announcement says six free reports a year for seven years starting in January 2020, on top of the one free annual report, which the FTC's refund page counts as 7 a year through 2026.

Security freezes and fraud alerts

15 U.S.C. 1681c-1 gives you three tools.

• Security freeze. The bureau must place it "free of charge" within 1 business day of a request by toll-free phone or online, or 3 business days by mail, and must lift it within 1 hour of a phone or online request (3 business days by mail). A freeze stops new creditors from seeing your file, which stops most new-account fraud. It does not affect your score. The CFPB notes that the free federal freeze does not cover reports pulled for employment, tenant screening or insurance. Parents and guardians can freeze the file of a child under 16 or of an incapacitated adult, and the bureau creates a file to freeze if none exists.
• Initial fraud alert. Lasts at least 1 year. You call one bureau and it must tell the other two. A creditor that sees the alert must take reasonable steps to verify your identity before opening an account.
• Extended fraud alert. Lasts 7 years and requires an identity theft report, which you can file at IdentityTheft.gov. Service members can place an active duty alert lasting at least 12 months.

A freeze has to be placed at all three nationwide bureaus separately. People who skip one find out the hard way that a lender pulled the one they forgot. The personal side of this, step by step, is in Money, Credit and Identity in the Home Computer Security course.

Remedies and who enforces

The FCRA is one of the few privacy laws you can enforce yourself. Under 1681n, a willful violation makes the violator liable for actual damages or statutory damages of $100 to $1,000, plus punitive damages and attorney's fees. A person who gets your report under false pretenses or knowingly without a permissible purpose owes you the greater of actual damages or $1,000. Under 1681o, a negligent violation makes the violator liable for actual damages and fees, with no statutory floor. Suits must be filed within 2 years of discovery and no more than 5 years after the violation (1681p).

Government enforcement is split. Under 1681s, the FTC treats violations as unfair or deceptive practices and may seek a civil penalty for a knowing pattern or practice; the statute says $2,500, and the inflation-adjusted figure in 16 CFR 1.98 is $4,983 per violation as of the January 17, 2025 adjustment. The Consumer Financial Protection Bureau writes most FCRA rules (Regulation V) and enforces against the bureaus and large lenders. Bank regulators, the NCUA, the SEC and others cover the firms they supervise. State attorneys general may sue for residents and recover up to $1,000 per willful or negligent violation, after notifying the CFPB and FTC.

Standing: Spokeo and TransUnion

Two Supreme Court cases limit who can collect those statutory damages in federal court. In Spokeo, Inc. v. Robins (May 16, 2016, 6 to 2), the plaintiff said a people-search site published wrong facts about him. The Court sent the case back, holding that Article III requires an injury that is both particularized and concrete, and that "a bare procedural violation" is not enough. Its example: it is hard to see how an incorrect ZIP code, without more, causes concrete harm.

TransUnion LLC v. Ramirez (June 25, 2021, 5 to 4, opinion by Justice Kavanaugh) applied that rule to a class of 8,185 people whose TransUnion files carried an alert wrongly flagging them as possible matches to a Treasury Department list of terrorists, drug traffickers and other criminals. The Court held that the 1,853 class members whose reports were actually sent to businesses had standing, because a misleading report sent to a third party resembles defamation. The other 6,332, whose flawed files sat unread, did not. The opinion's line: "No concrete harm, no standing." The practical result is that FCRA class actions over files that were never shared now usually belong in state court or nowhere.

FACTA: Red Flags and Disposal

The Fair and Accurate Credit Transactions Act of 2003 amended the FCRA to add free annual reports, fraud alerts and two rules businesses still trip over.

The Red Flags Rule (16 CFR Part 681) applies to financial institutions and creditors that offer "covered accounts": consumer accounts that allow multiple payments, such as credit cards, mortgages, auto loans, cell phone, utility, checking and savings accounts, plus any account with a foreseeable risk of identity theft. These businesses need a written Identity Theft Prevention Program that identifies the red flags relevant to them, detects them, responds to them and gets updated. The board, or a board committee, must approve the first version. Card issuers have a separate duty under 681.2: if a request for a replacement card follows an address change within at least 30 days, the issuer must validate the change before mailing the card.

The Disposal Rule (16 CFR Part 682), in effect since June 1, 2005, reaches anyone who keeps consumer report information for a business purpose: a landlord who ran a tenant check, a car dealer, an employer. Disposal must use "reasonable measures to protect against unauthorized access." The rule's examples are burning, pulverizing or shredding paper so it cannot be read or rebuilt, destroying or erasing electronic media to the same standard, and hiring a document destruction company after checking it out. Selling an old office computer counts as disposal.

Gramm-Leach-Bliley: who it covers

GLBA reaches every "financial institution," which 15 U.S.C. 6809(3) defines as any institution whose business is engaging in financial activities as described in 12 U.S.C. 1843(k), the Bank Holding Company Act list. That list is far wider than banks. The FTC's guidance names mortgage lenders and brokers, payday lenders, finance companies, account servicers, check cashers, wire transferors, collection agencies, tax preparation firms, some investment advisors and, since the 2021 amendments, "finders" that bring buyers and sellers together. A one-person tax preparer in a strip mall is a financial institution under GLBA.

The data protected is nonpublic personal information: personally identifiable financial information a consumer gives the institution, that results from a transaction, or that the institution otherwise gets, minus publicly available information. A list of customers derived from that information counts too. GLBA also distinguishes a consumer (anyone who gets a financial product or service for personal, family or household purposes) from a customer (a consumer with a continuing relationship). Customers get annual notices; one-time consumers get notice only if their data will be shared.

Privacy notices and the opt-out

Under 15 U.S.C. 6802 and the CFPB's Regulation P (12 CFR Part 1016), an institution must give customers a privacy notice no later than when the relationship starts, and then at least once in every 12 months. Under 1016.5(e), the annual notice is not required when the institution shares only under the standard exceptions and its policies have not changed. Before sharing with a nonaffiliated third party, it must tell you and give you a reasonable chance to say no.

The opt-out is narrower than it looks. 6802(b)(2) lets the institution share without your consent with service providers that work for it, including companies that market its own products, and with partners in joint marketing of financial products, as long as a contract requires them to keep the data confidential. 6802(e) adds exceptions for processing your transactions, fraud prevention, legal compliance and more. What you can usually stop is sharing with outside companies for their own marketing. Two firm limits apply no matter what: a recipient may not pass the data on to anyone the institution itself could not have given it to (6802(c)), and an institution may not give your account number or access code to an outside company for telemarketing, direct mail or email marketing (6802(d)).

Sharing with affiliates, other companies under the same corporate parent, is not covered by the GLBA opt-out. The FCRA fills part of that gap: under 15 U.S.C. 1681s-3, an affiliate may not use your eligibility information to market to you unless you got notice and a chance to opt out, and that opt-out lasts at least 5 years. That is why many bank notices have more than one box.

Pretexting

GLBA also made it a federal crime to trick a bank into revealing someone else's account data. 15 U.S.C. 6821 bars obtaining customer information from a financial institution by false statements to the institution or its customer, or by forged or stolen documents, and bars asking someone else to do it knowing they will. Under 6823, a knowing violation carries up to 5 years in prison. That doubles to 10 years with a doubled fine when the violation happens while breaking another federal law or as part of a pattern involving more than $100,000 in a year.

Who enforces GLBA

15 U.S.C. 6805 splits enforcement by type of institution: the federal banking agencies for banks and savings associations, the NCUA for credit unions, the SEC for brokers, dealers, funds and advisers, state insurance regulators for insurers, and the FTC for everyone else. The statute lists no private lawsuit. Consumers who sue after a bank breach usually plead negligence, contract or state law claims instead.

The FTC Safeguards Rule

The Safeguards Rule (16 CFR Part 314) is GLBA's security half for the institutions the FTC oversees: the tax preparers, auto dealers that arrange financing, mortgage brokers, collection agencies, check cashers and similar firms. The FTC rewrote it in 2021 to replace general language with specific elements. Under 314.4, an institution must:

1. Name a Qualified Individual to run the program. It can be an employee or an outside provider, but the institution keeps responsibility and must assign a senior staff member to oversee an outsider.
2. Base the program on a written risk assessment with criteria for rating risks and deciding how each will be handled, and repeat it periodically.
3. Put in eight named safeguards: access controls limited to what each user needs; an inventory of data, devices, systems and people; encryption of customer information in transit over external networks and at rest; secure development practices; multi-factor authentication for anyone accessing an information system; disposal of customer information no later than two years after it was last used (with exceptions); change management; and logging of user activity.
4. Test the safeguards: continuous monitoring, or else annual penetration testing and vulnerability scans at least every six months.
5. Train staff, and oversee service providers by contract and periodic review.
6. Keep a written incident response plan.
7. Have the Qualified Individual report in writing at least once a year to the board, or to a senior officer if there is no board.

Institutions that keep information on fewer than 5,000 consumers are exempt from the written risk assessment, the penetration testing schedule, the written incident plan and the annual report (314.6). They still need the rest, including MFA and encryption.

The 30-day FTC breach notice

Since May 13, 2024 (314.5), 314.4(j) has required an institution to notify the FTC electronically "as soon as possible, and no later than 30 days after discovery" of a notification event involving at least 500 consumers. A notification event is the acquisition of unencrypted customer information without the consumer's authorization. Data counts as unencrypted if the encryption key was accessed by an unauthorized person (314.2(m)), and unauthorized access is presumed to be acquisition unless the institution has reliable evidence it was not. Discovery is the first day anyone at the company other than the wrongdoer knew. The notice must give the institution's name and contact, the kinds of data, the dates if known, the number of consumers and a general description. A law enforcement delay of up to 30 days, extendable by 60 more, is allowed on a written request.

Two things surprise people. The FTC rule notifies the FTC, not the customers; customer letters still come from state breach laws, covered in lesson 09. And the FTC's guidance warns that "your report may be made public," through a public listing or a Freedom of Information Act request. The business side of building this program is covered in Federal Laws That Reach Your Business in course 73.

Law or rule	Who it binds	Your main rights	Main duties	Enforcer	Penalties
FCRA, 15 U.S.C. 1681	Credit bureaus and specialty agencies, users of reports, furnishers	Free annual report, disputes in 30 days, freezes, fraud alerts, adverse action notice	Permissible purpose, accuracy procedures, time limits on old data	CFPB, FTC, bank regulators, state AGs, private suits	$100 to $1,000 per willful violation plus punitive damages; FTC up to $4,983 per violation
FACTA Red Flags Rule, 16 CFR 681	Financial institutions and creditors with covered accounts	None directly	Written identity theft program approved by the board	FTC and other FCRA agencies	Through FCRA enforcement
Disposal Rule, 16 CFR 682	Anyone holding consumer report data for business	None directly	Shred, burn or wipe so data cannot be rebuilt	FTC	Through FCRA enforcement
GLBA privacy, 15 U.S.C. 6801 to 6809; Regulation P	Financial institutions of every kind	Privacy notice; opt out of sharing with nonaffiliated third parties	Notices, honor opt-outs, no account numbers for marketing	Bank regulators, NCUA, SEC, state insurance regulators, FTC	Agency orders; no private suit
FTC Safeguards Rule, 16 CFR 314	Non-bank financial institutions under FTC jurisdiction	None directly	Written program, MFA, encryption, testing, FTC notice for 500 or more in 30 days	FTC	Consent orders, often 20 years; civil penalties for order violations
GLBA pretexting, 15 U.S.C. 6821	Everyone	None directly	Do not lie to get someone's bank data	Federal prosecutors and agencies	Up to 5 years in prison; 10 if aggravated

SEC Regulation S-P

Brokers, dealers, investment companies, registered investment advisers, funding portals and transfer agents follow the SEC's version of the GLBA rules. In 2024 the SEC amended Regulation S-P (published June 3, 2024, effective August 2, 2024) to add:

• A written incident response program to detect, respond to and recover from unauthorized access to customer information.
• Customer notice "as soon as reasonably practicable" and no later than 30 days after the firm becomes aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. A firm may skip notice only if a reasonable investigation shows the information has not been and is not reasonably likely to be used in a way that causes substantial harm or inconvenience, and it must keep a record of that finding.
• Service provider oversight, including a requirement that providers tell the firm within 72 hours of a breach in their systems.
• Coverage of transfer agents and written records of compliance.

Larger entities had to comply by December 3, 2025, and smaller entities, including advisers with less than $1.5 billion under management, by June 3, 2026. As of October 2026 both dates have passed. The SEC's separate public company cyber disclosure rule (Form 8-K Item 1.05) is covered in lesson 07.

New York's Part 500

New York's Department of Financial Services wrote the most detailed state cybersecurity rule for financial firms. 23 NYCRR Part 500, first issued March 1, 2017, binds any person or business licensed or chartered under New York's Banking, Insurance or Financial Services Laws, which pulls in many out-of-state insurers, lenders and money transmitters. Under 500.17, a covered entity must report a cybersecurity incident "as promptly as possible but in no event later than 72 hours" after determining it happened, report any ransom or extortion payment within 24 hours, explain the payment in writing within 30 days, and file an annual compliance certification by April 15. It matters outside New York because a single Idaho insurance agency licensed in New York is covered, and because other states copy it.

Open banking: the CFPB's Section 1033 rule

Section 1033 of the Dodd-Frank Act gives consumers a right to get their own account data from banks and card issuers. The CFPB finalized a Personal Financial Data Rights rule in late 2024, effective January 17, 2025, requiring large institutions to give consumers and their authorized apps free access to account data through standard interfaces, with the biggest firms originally due to comply starting April 1, 2026 (the court later pushed the first deadline to June 30, 2026 in earlier orders, according to the Moore and Van Allen summary linked below). Bank groups sued in Forcht Bank, N.A. v. CFPB in the Eastern District of Kentucky. In 2025 the CFPB said it would reconsider the rule, the court paused the case, and the Bureau published an advance notice of proposed rulemaking on August 22, 2025. On October 29, 2025 the court barred the CFPB from enforcing the rule until it finishes reconsidering, finding the banks likely to succeed on claims that the Bureau exceeded its authority. As of the latest reporting checked for this lesson (August 2026), the CFPB had said it planned a proposed rule but had not issued one. The 2024 rule is on the books and cannot be enforced.

Cases that show the standard

Regulators rarely define "reasonable security" in the abstract. They define it case by case. These are the cases most often cited.

Case	What happened	Legal hook	Outcome
Equifax (breach 2017; settlement July 22, 2019)	Equifax failed to patch a critical vulnerability affecting its ACIS database after an alert in March 2017; attackers found administrative credentials stored in plain text. About 147 million people exposed.	FTC Act, GLBA Safeguards Rule, state laws, CFPB	At least $575 million and up to $700 million: $300 million consumer fund (up to $125 million more), $175 million to 48 states, D.C. and Puerto Rico, $100 million CFPB penalty
Capital One (breach 2019; OCC action August 2020)	An outsider took data from credit card applications filed from 2005 to 2019; about 100 million U.S. and 6 million Canadian customers affected, per Capital One.	OCC safety and soundness rules and the interagency security guidelines (12 CFR Part 30, Appendix B)	$80 million civil money penalty and a cease and desist order
TaxSlayer (FTC, August 29, 2017)	Hackers took over nearly 9,000 accounts in late 2015 and filed fake returns.	GLBA Privacy Rule and Safeguards Rule	Order barring violations for 20 years with third-party assessments every two years for 10 years
DealerBuilt (FTC, June 12, 2019)	An unsecured backup connection left data on about 12.5 million consumers of 130 auto dealers exposed for 18 months; an attacker downloaded data on more than 69,000.	FTC Act unfairness and the Safeguards Rule	Consent order requiring a security program and assessments
Ascension Data and Analytics (FTC, final order December 22, 2021)	A vendor stored mortgage documents with Social Security numbers on an unprotected cloud server that was accessed dozens of times.	Safeguards Rule duty to oversee vendors	Order requiring a stronger program and vendor oversight

The pattern is plain. Equifax came down to a missing patch, and the OCC tied Capital One to cloud risk management it never did. TaxSlayer lacked a written program and strong passwords. DealerBuilt never ran a vulnerability scan. Ascension trusted a vendor without checking. Each failure maps to a line in the 2021 Safeguards Rule, which is no accident: the FTC wrote the rule partly from its case files.

PCI DSS is a contract, not a law

Any business that takes card payments signs up, through its bank or processor, to follow the Payment Card Industry Data Security Standard written by the card brands' PCI Security Standards Council. Violations bring contract penalties, higher fees or loss of the right to take cards, not fines from a government. A few states refer to PCI in their laws, but no federal statute requires it. The practical rules for a small shop are in Payment Cards, Customer Data and Records in course 72.

Questions and answers

A landlord ran my credit without asking. Was that legal?

Probably. A rental application is a transaction you started, so the landlord usually has a "legitimate business need" under 1681b(a)(3)(F). The FCRA does not require written consent for tenant screening the way it does for employment. If the landlord turns you down because of the report, though, it owes you an adverse action notice naming the screening company, and you may get a free copy from that company within 60 days.

Does a freeze stop my current bank or card issuer from seeing my report?

No. Existing creditors reviewing your account, collection agencies working for them, and some government agencies can still get access. A freeze blocks new creditors, which is where identity thieves open fake accounts. The CFPB also notes that the free federal freeze does not cover employment, tenant screening or insurance reports.

How long can an old debt stay on my report?

Seven years for most negative items, counted for collection accounts from 180 days after the delinquency that started the trouble. Bankruptcies can stay 10 years. The limits do not apply when the report is for a loan or life insurance policy of $150,000 or more, or a job paying $75,000 or more.

My tax preparer had a breach. Who is supposed to tell me?

Your state's breach notice law tells the preparer to notify you. If 500 or more consumers were hit and the data was unencrypted, the Safeguards Rule also requires a notice to the FTC within 30 days. The FTC case against TaxSlayer shows the agency treats tax preparation as a financial activity under GLBA.

Can I sue my bank for sharing my information?

Not under GLBA, which leaves enforcement to agencies. You can complain to the bank's regulator, or to the CFPB, and you may have state law claims. If the sharing involved credit report information, the FCRA's private remedies may apply.

Is my investment adviser covered by the same breach rules as my bank?

Different rule, similar idea. SEC-registered advisers follow Regulation S-P, which since June 3, 2026 for smaller firms requires customer notice within 30 days of learning of a breach of sensitive customer information. State-registered advisers fall under state securities rules instead.

What is the difference between a freeze and a "credit lock"?

A freeze is a legal right with deadlines and no fee. A lock is a product a bureau sells or bundles, governed by its terms of service. Locks can be faster to toggle, but the federal deadlines and the free-of-charge rule apply only to freezes.

Does the Safeguards Rule apply to a nonprofit credit counselor or a campaign that takes donations?

A nonprofit that does financial activities may still be a financial institution under GLBA, though the FTC's jurisdiction over nonprofits is limited by the FTC Act. A campaign that takes card donations is not a financial institution; its card duties come from PCI DSS and its processor contract, and its breach duties come from state law. Donor data rules for campaigns and nonprofits are in lesson 11.

Hard questions

Should the FCRA's statutory damages survive TransUnion?

The majority in TransUnion held that Congress cannot create standing just by creating a right to sue; there has to be a real-world harm with a traditional analog, like defamation. That view protects defendants from large class awards for errors no one saw. Justice Thomas's dissent argued that Congress gave consumers a private right to accurate files and that violating it is itself the injury, which courts have long recognized for private rights such as trespass. Consumer advocates say the decision leaves people with flawed files and no federal remedy until the damage is done. Industry groups say it stopped suits seeking billions over harmless technical errors. Both sides agree the result pushes some FCRA cases into state courts, which are not bound by Article III.

Should GLBA have a private right of action?

Supporters point to the FCRA, where private suits have enforced the law for decades, and to the limits of agency budgets: the FTC brings a handful of Safeguards cases a year against thousands of covered businesses. Opponents argue that breach victims already sue under negligence and state law, that a federal private right would bring class actions over every incident regardless of harm, and that agencies can set consistent standards courts cannot. Congress has not changed the 1999 design.

Is an opt-out enough for financial data?

GLBA's opt-out puts the burden on the consumer to read a notice and act. Several state consumer privacy laws treat financial account data as sensitive and require opt-in consent, though most exempt data already covered by GLBA (lesson 08). Banks argue that opt-in would break routine services and that the GLBA exceptions already cover what customers expect. Privacy advocates answer that few people read the notices and that the exceptions for joint marketing swallow much of the rule.

Is open banking a privacy gain or a privacy risk?

The 1033 rule would have given consumers a legal right to move their own data to apps they choose, with limits on what those apps could do with it. Fintech firms and many consumer groups saw it as ending "screen scraping," where apps log in with the customer's bank password. The banks that sued argued that the CFPB exceeded its authority, ignored the security cost of more data access, and barred them from charging fees for building interfaces. The Kentucky court found the banks likely to win on authority and on data security analysis. Either way, apps already pull bank data today, so the question is whether federal rules or private contracts set the terms.

Should the FTC's small-business exemption be wider or narrower?

The 5,000-consumer line exempts small firms from four paperwork-heavy elements while keeping MFA and encryption. Small business groups argued during the 2021 rulemaking that even the remaining elements cost too much for a tax office with a few staff. The FTC's answer was that the cheapest controls, MFA and encryption, prevent the most harm, and that criminals target small firms precisely because they are less protected. The TaxSlayer and DealerBuilt cases both involved basic controls that would have been required even under the exemption.