Banks can share your account information with third parties in specific situations, but federal law limits when and how they do it

Your bank holds sensitive details: your balance, transaction history, account type, and personal identification. Federal law—primarily the Gramm-Leach-Bliley Act (GLBA) and the Right to Financial Privacy Act (RFPA)—sets boundaries on who can see this information and under what circumstances. Banks can share data with affiliated companies, service providers, and government agencies, but they must follow rules about notice, consent, and purpose.

The key distinction is between affiliated sharing (within the same financial institution or its subsidiaries), third-party sharing (with outside companies), and compelled disclosure (when law enforcement or courts demand it). Each has different rules and different protections for you.

Key Takeaways

  • Banks must give you a privacy notice explaining what information they share and with whom, and you have the right to opt out of some—but not all—sharing.
  • Banks can always share information with their own affiliates, service providers they hire to run your account, and government agencies with a valid subpoena or court order.
  • Banks cannot sell your personal financial information to third parties for marketing without your consent, though they can share it for fraud prevention and account management.
  • If a bank shares your information illegally, you can file a complaint with your bank's regulator—the Federal Reserve, OCC, FDIC, or CFPB depending on the bank's charter.

What your bank's privacy notice actually tells you

When you open an account, your bank must provide a privacy notice describing its information-sharing practices. This notice explains which affiliates and third parties receive your data and for what purpose. Many people discard this document, but it is the legal record of what the bank is permitted to do.

The notice typically covers four categories: affiliates (the bank's own subsidiaries and related companies), service providers (processors, fraud monitors, debt collectors), nonaffiliated third parties (marketing partners, data brokers), and government agencies. For each category, the bank states whether sharing happens and whether you can opt out. Read the section on "nonaffiliated third parties"—that is where you often have a choice.

If you no longer have your privacy notice, you can request one from your bank's customer service or download it from the bank's website. The notice is required by law and must be clear enough that you understand what happens to your data.

Sharing with affiliates and service providers—no opt-out required

Your bank can share your information freely with affiliated companies—subsidiaries, parent companies, and other entities under the same corporate umbrella. If you bank at a large institution, your data may flow to its credit card division, investment arm, insurance subsidiary, or mortgage company without your permission. The bank must disclose this in the privacy notice, but you cannot stop it.

Banks also share information with service providers they hire to operate your account: payment processors, fraud detection services, check printers, customer service vendors, and debt collection agencies. These vendors sign contracts promising to use your data only for the specific service they provide. Again, you cannot opt out because these companies are essential to running your account.

The risk here is limited by contract—service providers are legally bound to protect your data and use it only as instructed. If a service provider breaches that contract and misuses your information, you may have a claim against both the provider and the bank. Report any suspicious activity to your bank immediately.

Marketing and data sales—where you have control

Banks cannot sell your personal financial information to third parties for marketing purposes without your consent. This is the area where federal law gives you real power. If your bank wants to share your name, address, account type, or transaction patterns with a credit card company, insurance broker, or data broker for marketing, it must ask first.

The bank's privacy notice will explain how to opt out of this sharing. Some banks allow you to opt out online through your account settings; others require a phone call or written request. The process varies by institution. If you do not see an opt-out option in your privacy notice, contact your bank and ask how to restrict marketing-related sharing.

Note that opting out of marketing sharing does not stop all data flow. Banks can still share information with affiliates, service providers, and government agencies. Opting out only blocks the sale or sharing of your data to unaffiliated third parties for their own marketing purposes.

When government agencies and law enforcement can access your account

Federal, state, and local law enforcement can obtain your account information through several legal mechanisms. A subpoena (issued by a court or grand jury) requires the bank to produce records related to an investigation. A court order (signed by a judge) is a stronger demand and typically requires the government to show probable cause. A search warrant (also judge-signed) gives law enforcement the broadest access and requires the highest legal standard.

The Right to Financial Privacy Act requires law enforcement to notify you when they obtain your records through a subpoena or court order—though they can sometimes delay notice if an ongoing investigation would be harmed. Search warrants do not trigger the same notification requirement. Banks must comply with these demands; they cannot refuse or warn you in advance.

The IRS can also access your account information without a warrant if it is investigating tax fraud or collecting unpaid taxes. Financial institutions must comply with IRS summonses and levies. If the IRS places a levy on your account, the bank will freeze funds up to the amount owed.

What happens if your bank shares information illegally

If your bank violates the Gramm-Leach-Bliley Act or Right to Financial Privacy Act, you have several options. First, file a complaint with your bank's primary regulator. The regulator depends on the bank's charter: the Federal Reserve oversees state-chartered banks that are Fed members, the OCC (Office of the Comptroller of the Currency) oversees national banks, the FDIC oversees state-chartered banks that are not Fed members, and the CFPB (Consumer Financial Protection Bureau) handles consumer protection violations across all banks.

You can also file a complaint with the CFPB directly at consumerfinance.gov. Describe what information was shared, to whom, and why you believe it violated your privacy rights. The CFPB investigates and can fine the bank or require it to change its practices.

In some cases, you may have a private right to sue the bank under the GLBA or RFPA. Consult an attorney if the unauthorized sharing caused you financial harm—for example, if your information was sold to a scammer or used in identity theft. You may be able to recover damages.

How to limit what your bank shares

Start by reviewing your bank's privacy notice and identifying the opt-out options. Most banks allow you to restrict marketing-related sharing online, by phone, or by mail. Contact your bank's privacy department and request to opt out of nonaffiliated third-party sharing for marketing purposes.

Keep a record of your opt-out request—the date, method (email, phone, mail), and the name of the person who processed it. Banks are required to honor opt-out requests within a reasonable timeframe, typically 30 days. If you do not see the change reflected in future privacy notices, follow up.

You cannot stop all sharing—affiliates, service providers, and government agencies will still access your data. But you can prevent your bank from selling your information to marketers, which is the most common form of third-party disclosure.

Frequently Asked Questions

Can my bank share my information with other banks?

Banks can share your information with other financial institutions if you authorize it (for example, when you apply for a loan and the lender pulls your credit report) or if they are service providers working on your account. Banks cannot share your account details with competitors for marketing without your consent. If you see inquiries from other banks on your credit report that you did not authorize, contact your bank and the other institution to find out why.

What if I see a hard inquiry from a bank I never contacted?

A hard inquiry means a bank pulled your credit report, which typically happens when you apply for credit. If you did not apply, someone may have opened an account in your name (identity theft) or a bank may have pulled your report without authorization. Contact the bank that made the inquiry and ask why. If you did not authorize it, file a complaint with the CFPB and consider placing a fraud alert on your credit file.

Does opting out of marketing sharing protect me from data breaches?

No. Opting out prevents your bank from selling your data to marketers, but it does not protect your information from hackers or data breaches. Your bank is required to maintain security measures regardless of your opt-out status. If your bank suffers a breach, it must notify you and may be liable for damages depending on the cause and your state's laws.

Can my bank share my information with employers or landlords?

Not without your consent. Employers and landlords can request your financial information, but your bank cannot disclose it without your written authorization. If an employer or landlord needs bank details (for direct deposit or verification of funds), you must sign a release form authorizing the bank to share that specific information.

What should I do if my bank cannot explain why it shared my information?

Request a written explanation from your bank's privacy officer. If the bank cannot justify the sharing under its privacy notice or federal law, file a complaint with your bank's regulator and the CFPB. Document everything: the date you discovered the sharing, what information was shared, and all communication with the bank. This record will support your complaint.