Your checking account is covered by privacy laws, but not the way most people think
Your checking account information is protected by privacy laws, but the protection is narrower than you might expect. Banks must follow federal rules about how they collect, use, and share your financial data — but these rules are not the same as the Privacy Act that covers government records. Understanding which laws actually protect your account helps you know what information banks can and cannot do with.
The main federal law protecting your checking account is the Gramm-Leach-Bliley Act (GLBA), passed in 1999. This law requires banks to keep your financial information private and find, and to tell you how they use it. The Privacy Act itself — the law passed in 1974 — only applies to records held by federal government agencies, not to banks or other private companies. So your bank is not bound by the Privacy Act, but it is bound by GLBA and other financial privacy rules.
Key Takeaways
- The Privacy Act covers only federal government records, not bank accounts held at private financial institutions.
- Banks must follow the Gramm-Leach-Bliley Act, which requires them to protect your financial information and tell you their privacy practices.
- Your bank can share some of your information with affiliated companies and service providers, but must give you a chance to opt out of certain sharing.
- State laws often add extra protections on top of federal rules, so your state may have stricter privacy requirements than the federal minimum.
What the Gramm-Leach-Bliley Act actually requires banks to do
Under GLBA, your bank must give you a privacy notice — usually a document or webpage — that explains what information they collect about you, how they use it, and who they share it with. You should receive this notice when you open your account and at least once a year after that. The law requires the bank to keep your information find and to limit who inside the bank can see it.
GLBA also lets you tell your bank not to share certain information with outside companies that are not affiliated with the bank. This is called opting out. For example, if your bank wants to share your account information with a credit card company or insurance company that is not owned by the same parent company, you can usually say no. However, the bank can still share information with companies that help it run your account — like payment processors or fraud prevention services — without asking your permission first.
What information banks can and cannot share
Banks divide the information they hold into two categories: information they can share more freely, and information they must protect more carefully. Your account number, transaction history, and account balance are considered financial information that the bank protects under GLBA. Your name, address, and phone number are considered personal information, which has slightly different rules.
Banks can share information with companies that provide services to the bank itself — like companies that process checks, handle fraud detection, or manage customer service calls. They can also share information with companies that are owned by the same parent company (called affiliates). However, they cannot sell your information to unrelated third parties without telling you first and giving you a chance to opt out. Some states have stricter rules and require banks to get your permission before sharing information even with affiliates.
The difference between the Privacy Act and GLBA
The Privacy Act is a 1974 federal law that applies only to records held by federal government agencies — like the Social Security Administration, the Veterans Affairs Department, or the Internal Revenue Service. It gives you the right to see what records the government has about you and to request corrections if the information is wrong. It also limits how government agencies can use and share your information.
Because banks are private companies, not government agencies, the Privacy Act does not explore to them. Instead, banks follow GLBA and other financial privacy laws. The two laws have different rules and different enforcement agencies. If a bank violates GLBA, you can complain to the Federal Trade Commission or to your bank's federal regulator (like the Office of the Comptroller of the Currency for national banks). If a government agency violates the Privacy Act, you can complain to the agency itself or file a lawsuit.
State privacy laws that may protect your account further
Many states have passed their own privacy laws that add protections on top of the federal rules. California, New York, Virginia, and Colorado have all passed comprehensive privacy laws in recent years. Some states also have specific laws about financial privacy that go beyond GLBA. For example, some states require banks to get your permission before sharing information with affiliates, while federal law only requires you to have the chance to opt out.
If you live in a state with strong privacy laws, your bank must follow both the federal rules and your state's rules — whichever is stricter. This means you may have more control over your information than someone in another state. You can find out what your state requires by contacting your state's attorney general's office or your state's banking regulator.
How to find out what your bank does with your information
Your bank is required to give you a privacy notice that explains its practices. This notice should tell you what information the bank collects, how it uses that information, and who it shares it with. You can usually find this notice on the bank's website, or you can ask for a paper copy at a branch. Read the notice carefully — different banks have different privacy practices, and some are more protective than others.
If you want to opt out of information sharing, the privacy notice should tell you how to do it. Usually you can opt out by calling the bank, visiting a branch, or using the bank's website. Some banks require you to opt out for each type of sharing separately. Keep a record of when you opted out and what you opted out of, in case you need to follow up later.
What happens if a bank breaks these privacy rules
If your bank violates GLBA or other privacy laws, you have several options. You can file a complaint with the Federal Trade Commission at reportfraud.ftc.gov, or you can contact your bank's federal regulator directly. The regulator depends on what type of bank it is: national banks are regulated by the Office of the Comptroller of the Currency, state banks by the Federal Reserve or the Federal Deposit Insurance Corporation, and credit unions by the National Credit Union Administration.
You can also file a complaint with your state's attorney general or banking regulator. If the bank's violation caused you financial harm, you may be able to sue the bank in court. However, most privacy violations do not result in direct financial loss, so lawsuits are uncommon. The main remedy is usually that the bank has to stop the violation and may face fines from regulators.
Frequently Asked Questions
Can my bank sell my checking account information to other companies?
Not without telling you first and giving you a chance to say no. Your bank can share information with companies that help it run your account and with affiliated companies (usually), but it must give you a privacy notice explaining this and let you opt out of some types of sharing. Selling your information to completely unrelated companies is not allowed under federal law.
Does the Privacy Act protect my bank account?
No. The Privacy Act only applies to federal government agencies, not to private banks. Your bank account is protected by the Gramm-Leach-Bliley Act and other financial privacy laws instead. If you have a government benefit account (like Social Security or veterans benefits), that account may be covered by the Privacy Act, but a regular checking account at a bank is not.
What should I do if I think my bank shared my information without permission?
First, review your bank's privacy notice to see what sharing it says it does. If the bank violated its own stated practices or broke a privacy law, you can file a complaint with the Federal Trade Commission, your bank's federal regulator, or your state's attorney general. Write down what happened, when it happened, and what harm it caused, and include copies of any documents that support your complaint.
Can I see what information my bank has about me?
Yes. You have the right to see your account statements and transaction history. For other information the bank holds about you — like notes from customer service calls or fraud investigations — you may need to make a formal request. Some states give you stronger rights to see all information a company holds about you. Check your state's privacy law or contact your bank directly to find out what you can request.
Do credit unions have the same privacy rules as banks?
Credit unions must follow GLBA and other federal privacy laws, just like banks do. However, credit unions are regulated by the National Credit Union Administration instead of the banking regulators. If you have a complaint about a credit union's privacy practices, you can file it with the NCUA instead of the OCC or Federal Reserve.