Your checking account is protected by multiple privacy laws, but not by the Privacy Act itself

The federal Privacy Act of 1974 does not cover checking accounts held at banks or credit unions. The Privacy Act only applies to records kept by federal government agencies — it protects your Social Security file, your Veterans Administration records, your tax returns held by the IRS. A private bank is not a government agency, so your checking account statements and transaction history fall outside the Privacy Act's reach.

That does not mean your checking account has no privacy protection. Banks and credit unions are regulated under different federal laws that set their own privacy rules. These laws often provide stronger protections than the Privacy Act does, but they work differently and cover different things. Understanding which law protects which part of your account matters if something goes wrong or if you want to know what information a bank can share about you.

Key Takeaways

  • The Privacy Act protects government records only, so it does not cover your bank account, even though banks must follow other federal privacy laws.
  • The Gramm-Leach-Bliley Act (GLBA) is the main federal law that controls how banks handle your financial information and what they can share with third parties.
  • Banks must give you a privacy notice when you open an account, and you have the right to opt out of some information sharing, though not all.
  • The Fair Credit Reporting Act (FCRA) limits how banks can use your information for credit decisions and requires them to tell you if they deny you credit based on a report.
  • State laws sometimes provide stronger privacy protections than federal law, particularly in California, which has its own comprehensive privacy statute.

The Gramm-Leach-Bliley Act is what actually protects your bank information

The Gramm-Leach-Bliley Act (GLBA), passed in 1999, is the federal law that governs how banks, credit unions, and other financial institutions handle your personal and financial information. It requires banks to keep your information secure, to tell you how they use it, and to limit who they share it with. This is the law that actually matters for your checking account privacy.

Under the GLBA, your bank must provide you with a privacy notice that explains what information they collect, how they use it, and who they share it with. You receive this notice when you open an account and at least once a year after that. The law divides information sharing into two categories: sharing with affiliates (other companies owned by the same parent company) and sharing with unaffiliated third parties (companies with no ownership connection to your bank).

For unaffiliated third parties, the GLBA gives you the right to opt out of certain kinds of sharing. Your bank cannot share information for marketing purposes without letting you refuse first. However, banks can share information with unaffiliated companies that help them run their business — like payment processors, fraud detection services, or companies that print your statements — without your permission, as long as those companies agree to keep the information confidential.

What information banks can and cannot share without your permission

Banks distinguish between information they can share freely and information that requires your consent or gives you an opt-out right. Transaction information — the fact that you made a deposit, the amount, the date — can be shared with service providers your bank uses. Information about your creditworthiness or payment history can be shared with credit reporting agencies and with other lenders if you apply for credit.

Information that banks cannot share without your permission includes your Social Security number, your account numbers, and your passwords or PINs. Banks also cannot sell your name and address to marketing companies without giving you the chance to opt out first. If your bank is part of a larger financial company, they can share information between their own divisions (for example, between the bank and the insurance subsidiary) unless you opt out, though some states require opt-in instead.

The key distinction is between information sharing for business purposes (which banks can do) and information sharing for marketing purposes (which requires your consent or an opt-out right). If you want to restrict how your bank shares your information, you should look for the opt-out instructions in your privacy notice or contact your bank directly to ask how to opt out.

The Fair Credit Reporting Act protects you when banks use your information for credit decisions

The Fair Credit Reporting Act (FCRA) is a separate federal law that controls how banks and credit reporting agencies use your information when making credit decisions. If your bank denies you a loan, a credit card, or an overdraft line based partly on information in a credit report, the FCRA requires the bank to tell you that a report was used and to give you the name and contact information of the credit reporting agency.

Under the FCRA, you have the right to request a free copy of your credit report from each of the three major credit reporting agencies (Equifax, Experian, and TransUnion) once per year through AnnualCreditReport.com. You can also dispute information in your credit report if you believe it is wrong. The FCRA does not prevent banks from using credit reports to make decisions, but it requires transparency and gives you a way to correct errors.

State privacy laws sometimes offer stronger protections than federal law

California's Consumer Privacy Act (CCPA) and similar state laws in other states impose stricter requirements on how companies, including banks, handle personal information. California residents have the right to know what personal information a bank collects, to delete information in some cases, and to opt out of the sale of their information. Some other states have passed their own privacy laws with similar protections.

If you live in a state with a strong privacy law, your bank must follow that law even if federal law is less restrictive. This means California residents, for example, have more control over their information than residents of states without comprehensive privacy laws. If you want to know what protections apply in your state, you can contact your state's attorney general's office or look up your state's privacy statute.

What to do if you believe a bank violated your privacy

If you think your bank shared your information without permission or violated the GLBA, you can file a complaint with the Consumer Financial Protection Bureau (CFPB) at ConsumerFinance.gov. The CFPB investigates complaints about banks and other financial institutions and can take action if a violation occurred. You can also file a complaint with your state's attorney general or with the Federal Trade Commission (FTC) at ReportFraud.ftc.gov.

If a bank used incorrect information from a credit report to deny you credit, you can dispute the information directly with the credit reporting agency or file a complaint with the CFPB or FTC. Keep copies of any privacy notices your bank sent you, any opt-out requests you made, and any correspondence about the issue. These documents help prove what happened if you need to file a formal complaint.

Frequently Asked Questions

Can a bank share my checking account information with other companies?

Yes, banks can share information with companies that help them operate — like payment processors or fraud detection services — without your permission. They can also share with credit reporting agencies and with other lenders if you apply for credit. However, they cannot share your information for marketing purposes without giving you a chance to opt out first.

What is the difference between the Privacy Act and the GLBA?

The Privacy Act only covers government agencies and their records. The GLBA covers banks and other financial institutions. Since banks are private companies, the Privacy Act does not apply to them. The GLBA is the law that actually protects your bank account information.

Do I have to opt out of information sharing, or do I have to opt in?

Federal law requires banks to let you opt out of marketing-related information sharing. For other types of sharing, banks can share information without your permission as long as they follow GLBA rules. Some states require opt-in instead, meaning the bank cannot share unless you say yes first. Check your privacy notice or contact your bank to find out what applies to you.

Can a bank sell my name and address to telemarketers?

No. Banks cannot sell your name and address to marketing companies without giving you the chance to opt out first. Your privacy notice should explain how to opt out. If your bank is selling your information to marketers without your permission, you can file a complaint with the CFPB or the FTC.

What should I do if I think my bank violated my privacy?

File a complaint with the Consumer Financial Protection Bureau at ConsumerFinance.gov, with your state's attorney general, or with the Federal Trade Commission at ReportFraud.ftc.gov. Keep copies of your privacy notices and any correspondence about the issue. The CFPB can investigate and take action if a violation occurred.