Banks can share your account information, but only under specific circumstances and with legal limits

Your bank holds information about your money, your spending patterns, and your financial relationships. Federal law allows banks to share some of this information with third parties, but it does not allow them to sell your data freely or share it without reason. The rules depend on what information, who is asking for it, and whether you have consented.

The main law controlling this is the Gramm-Leach-Bliley Act (GLBA), passed in 1999. It requires banks to tell you what they do with your information and gives you the right to limit some sharing. But the law has exceptions—law enforcement can get your information without asking your permission, and so can some other parties under specific conditions.

Key Takeaways

  • Banks must give you a privacy notice explaining what information they share and with whom, and you have the right to limit some of that sharing.
  • Law enforcement can obtain your account information with a subpoena, court order, or warrant without your knowledge or consent.
  • Banks can share information with their own affiliates and with service providers who help them run your account, without asking your permission first.
  • Banks cannot sell your personal information to marketers or data brokers, though they can share it with companies that offer financial products.
  • If you believe a bank shared your information illegally, you can file a complaint with your bank's regulator or the Consumer Financial Protection Bureau.

What information banks can share without your permission

Banks share information in two main categories without needing your consent. The first is service providers—companies the bank hires to process transactions, handle customer service, or manage accounts. Your bank can give these vendors your name, account number, and transaction history because they need it to do their job. These vendors are supposed to keep the information confidential and use it only for the service they provide.

The second category is affiliated companies. If your bank is part of a larger financial group—say, the same company owns both a bank and an insurance division—the bank can share your information between those divisions. However, you have the right to opt out of this sharing. Your bank must tell you how to do this in their privacy notice, usually by calling a number or checking a box online.

Banks can also share information when required by law. This includes tax authorities (the IRS), regulators examining the bank's safety, and law enforcement with a valid legal process.

What law enforcement can access and how

Police, federal agents, and prosecutors can obtain your account information without your permission or knowledge. They do this through three legal routes: a subpoena (a court order requiring the bank to produce records), a warrant (issued by a judge based on probable cause that a crime occurred), or a court order (issued in civil cases).

A subpoena is the easiest route and does not require a judge to find probable cause—a prosecutor or grand jury can issue one. A warrant is harder to get because a judge must find reason to believe a crime happened. The bank is usually required to notify you when law enforcement requests your information, but there are exceptions. If the government asks the bank to keep the request secret (called a "gag order"), the bank cannot tell you, at least not when ready.

The bank cannot refuse a valid subpoena or warrant. If you believe the request was improper, you would need to challenge it in court yourself, not ask the bank to do so.

What banks cannot share

Banks cannot sell your personal information to data brokers, marketing companies, or other businesses that want to use it for their own purposes. They cannot share your Social Security number, account passwords, or PIN with anyone outside the bank except when legally required. They also cannot share information about your account with merchants or retailers, even if you use a debit card at their store.

Banks also cannot share information based on your race, ethnicity, religion, or other protected characteristics for the purpose of marketing or pricing. If a bank shares information in a way that violates fair lending laws, that is illegal even if the GLBA would otherwise allow it.

How to limit information sharing

Your bank must provide a privacy notice, usually in writing when you open the account and annually after that. This notice explains what information the bank collects, who it shares with, and what you can do to limit sharing. Read the section on "opt-out" rights—this is where you learn how to stop certain kinds of sharing.

Most banks allow you to opt out of sharing with affiliated companies. Some allow you to opt out of sharing with service providers, though this is less common and may limit the services you can use. To opt out, follow the instructions in the privacy notice—this might mean calling a phone number, visiting a website, or returning a form.

Opting out does not stop the bank from sharing information when required by law or to prevent fraud. It only stops voluntary sharing with affiliates and, in some cases, service providers.

What happens when a bank shares information improperly

If a bank shares your information in violation of the GLBA or other privacy laws, you have several options. First, contact the bank directly and ask them to explain why they shared the information. Request a written explanation and ask them to correct any errors.

If the bank does not respond or you believe the violation is serious, file a complaint with the bank's federal regulator. The regulator depends on the bank's charter: the Office of the Comptroller of the Currency (OCC) oversees national banks, the Federal Reserve oversees state-chartered banks that are Fed members, and the Federal Deposit Insurance Corporation (FDIC) oversees state-chartered banks that are not Fed members. You can also file a complaint with the Consumer Financial Protection Bureau (CFPB), which handles consumer complaints about all banks.

In some cases, you may be able to sue the bank for damages if the violation caused you harm. However, the GLBA does not create a private right to sue—you would need to show a violation of another law, such as the Fair Credit Reporting Act or state privacy laws.

How data breaches differ from authorized sharing

When a bank shares information with your permission or as required by law, that is authorized sharing. When a hacker or employee steals your information without authorization, that is a data breach. The rules are different.

If your bank experiences a data breach, federal law requires them to notify you without unreasonable delay. The bank must also notify law enforcement and, in some cases, credit reporting agencies. You have the right to place a fraud alert on your credit report and to monitor your accounts for unauthorized activity.

Data breaches are not the same as privacy violations. A bank can follow all the privacy rules correctly and still suffer a breach. Conversely, a bank can violate privacy rules without a breach occurring—for example, by sharing information with a third party in a way the GLBA does not allow.

Frequently Asked Questions

Can my bank share my information with credit card companies or other lenders?

Yes, if those companies are affiliates of your bank's parent company. Your bank can also share information with service providers that help manage your account. However, your bank cannot share information with unaffiliated lenders for marketing purposes without your consent. You can opt out of sharing with affiliates by following the instructions in your privacy notice.

Does my bank need my permission to share information with the IRS?

No. Banks must comply with IRS requests for account information without your permission. The IRS can obtain information through a summons or court order, and the bank is required to provide it. You may receive notice from the IRS separately, but the bank does not need your consent.

What if I see a charge from my bank selling my information?

Banks do not charge customers for sharing information—that would be a separate fee, and it would be disclosed in your account agreement. If you see an unexplained charge, contact your bank when ready. It may be fraud, a fee for a service you did not authorize, or a misunderstanding about what the charge represents.

Can I stop my bank from sharing information with service providers?

In most cases, no. Service providers are necessary for the bank to operate—they process transactions, handle customer service, and manage security. You cannot opt out of sharing with them without closing your account. However, you can ask your bank which service providers have access to your information and what they do with it.

How do I know what information my bank is sharing?

Your bank's privacy notice explains this. Request a copy if you do not have one, or look for it on the bank's website. The notice must describe what information the bank collects, who it shares with, what you can do to limit sharing, and how to contact the bank with questions. If the notice is unclear, call the bank and ask for clarification.