Consumer Protection Laws

Financial privacy is a fundamental concern for clients, and CFP professionals must understand the legal framework that protects client information. The primary federal privacy law affecting financial services is the Gramm-Leach-Bliley Act (GLBA), which establishes requirements for how financial institutions collect, use, and share consumer information. For SEC-registered entities, Regulation S-P implements these requirements with specific compliance obligations.

The Gramm-Leach-Bliley Act (GLBA)

Congress enacted the Gramm-Leach-Bliley Act in 1999 to modernize the financial services industry by allowing banks, securities firms, and insurance companies to affiliate. Along with this deregulation came new privacy requirements to protect consumers.

GLBA's Three Key Components:

The GLBA applies broadly to "financial institutions," defined as any company significantly engaged in financial activities. This includes not only banks and securities firms but also:

• Mortgage lenders and brokers
• Tax preparation firms
• Financial advisers and planners
• Check cashing services
• Wire transfer services
• Collection agencies
• Credit counselors

What Is Nonpublic Personal Information (NPI)?

GLBA protections center on Nonpublic Personal Information (NPI)—personally identifiable financial information that a consumer provides to obtain a financial product or service. NPI includes:

• Information provided by the consumer: Account applications, income data, Social Security numbers
• Information from transactions: Account balances, payment history, credit card purchases
• Information obtained from providing services: Data gathered through serving the client's account

NPI does not include publicly available information such as telephone numbers listed in public directories, information from public government records, or information widely distributed through media.

The Privacy Notice Framework

GLBA requires financial institutions to provide clear, conspicuous notices explaining their information-sharing practices. The framework includes two types of notices:

Initial Privacy Notice:

Financial institutions must provide an initial privacy notice at the time a customer relationship is established. This notice must describe:

• Categories of NPI collected
• Categories of NPI disclosed to third parties
• Categories of affiliates and nonaffiliates with whom information is shared
• The institution's policies regarding former customers
• How the institution protects NPI confidentiality and security
• The consumer's right to opt out of certain disclosures

Annual Privacy Notice:

Historically, institutions were required to provide annual privacy notices to customers. However, the FAST Act of 2015 created an exception: institutions that meet specific conditions do not need to provide annual notices if:

1. They share NPI only in ways that don't require opt-out rights
2. Their privacy policies have not changed since the last notice
3. They post their privacy notice on their website (if they maintain one)

Exam Tip: The annual notice requirement was modified in 2015. Know that institutions meeting certain conditions (no changes to privacy policy, no opt-out-triggering sharing) may qualify for the annual notice exception.

Opt-Out Rights

One of GLBA's most important consumer protections is the right to opt out of having NPI shared with nonaffiliated third parties. When an institution wants to share information beyond what's permitted by GLBA exceptions, it must:

1. Clearly describe the categories of information that may be disclosed
2. Describe the categories of third parties to whom disclosure may be made
3. Provide a reasonable means for the consumer to opt out
4. Wait a reasonable period (typically 30 days) before sharing information

Opt-Out Methods Must Be Reasonable:

• Toll-free telephone number
• Return mail form
• Electronic opt-out (for customers who conduct business electronically)

Institutions cannot require consumers to write their own letter or take unreasonable steps to exercise opt-out rights.

Exceptions to Opt-Out Requirements

GLBA provides several exceptions where institutions may share NPI without offering opt-out rights:

The joint marketing exception is particularly important for financial services. Institutions may share NPI with nonaffiliated third parties under a joint marketing agreement if the agreement includes restrictions on the third party's use and disclosure of the information.

GLBA Enforcement and State Law Developments

GLBA is enforced by multiple regulators depending on the type of institution:

2025 State Law Developments:

The relationship between GLBA and state privacy laws is evolving. In 2025, Montana and Connecticut amended their state privacy laws to remove broad exemptions for GLBA-covered financial institutions. This means financial institutions in those states must now comply with both federal GLBA requirements and additional state privacy obligations for data not covered by GLBA.

California's Consumer Privacy Act (CCPA) has always applied a narrower "data-level" exemption—only GLBA-covered data is exempt, not the entire institution. This trend suggests financial institutions should prepare for overlapping federal and state privacy compliance.

GLBA Modernization Discussions

Congress and the CFPB are examining whether GLBA's privacy framework needs updating for the digital age. In early 2025, the CFPB sought public comment on potential modernization of the Privacy Rule (Regulation P), including:

• Strengthening opt-out rights (potentially a "global" one-click opt-out)
• Clarifying exceptions for joint marketing and service provider sharing
• Extending protections to digital wallet and fintech payment platforms
• Considering opt-in requirements for sensitive data

CFP professionals should monitor these developments as changes could significantly affect how financial planning firms handle client information.

For CFP Professionals

Understanding consumer protection laws helps CFP professionals:

• Maintain compliance with privacy notice and opt-out requirements
• Protect client trust by properly safeguarding personal information
• Recognize disclosure obligations before sharing client data with third parties
• Navigate dual-registration requirements as state privacy laws evolve
• Prepare for regulatory changes as GLBA modernization discussions continue