What banks can share about your account, and when

Banks can share your account information with third parties in specific situations, but they cannot sell your data or hand it over without limits. The main rule is the Gramm-Leach-Bliley Act (GLBA), a federal law that requires banks to protect your financial information and limits who they can tell about your accounts. Within those limits, banks share data with law enforcement when served with a warrant, with the IRS during tax investigations, with other financial institutions to process your transactions, and with companies you explicitly authorize—like when you link your bank account to a budgeting app or give a payment processor permission to pull funds.

Banks also share information internally across their own divisions. If you have a checking account and a credit card at the same bank, that bank's marketing team can see both accounts and may use that information to offer you products. They can also share with affiliated companies—subsidiaries or parent companies owned by the same holding company—unless you have opted out. The key difference is between sharing for business purposes (which is usually allowed) and sharing for marketing purposes (which you can refuse).

Key Takeaways

  • Banks must notify you of their privacy practices when you open an account and annually thereafter, and you have the right to opt out of some types of sharing.
  • Law enforcement, the IRS, and other government agencies can obtain your account information with a warrant, subpoena, or court order without your permission.
  • Banks share transaction data with payment processors, credit bureaus, and other financial institutions as part of normal business operations.
  • You can prevent your bank from sharing your information with non-affiliated third parties for marketing by opting out, usually through your online banking portal or a phone call.
  • Banks cannot share your account details with unaffiliated companies for their own marketing purposes unless you explicitly consent.

Government access to your account information

Law enforcement and tax authorities can access your bank account information without your permission if they follow the legal process. The most common route is a subpoena, which is a court order requiring the bank to produce records. A subpoena can be issued by a prosecutor, a grand jury, or an attorney in a civil lawsuit. The bank must comply, and in many cases the bank is not required to notify you immediately—though you may eventually learn about it through the legal proceeding itself.

The IRS can also obtain your account information during a tax investigation using a summons, which is similar to a subpoena but issued by the IRS directly. Banks comply with these requests as a matter of routine. If you are under criminal investigation or being audited, assume that investigators can and will request your banking records if they believe it is relevant to their case. You do not have to consent, and the bank does not ask for your permission—the legal authority is what matters.

In emergencies, law enforcement can sometimes obtain account information without a warrant through a process called a National Security Letter, though these are restricted to national security investigations and come with legal limits on how the information can be used. For routine criminal investigations, a warrant or subpoena is the standard.

Sharing with payment processors and other financial institutions

When you use your debit card, write a check, or set up an automatic payment, your bank shares transaction details with other financial institutions and payment processors. This is necessary for the transaction to work. Your bank sends information about the payment to the receiving bank, and both banks may share data with payment networks like Visa or Mastercard. This sharing is not optional—it is built into how the payment system functions.

Your bank also shares information with credit reporting agencies (Equifax, Experian, and TransUnion) so they can build your credit report and credit score. This includes your account balance, payment history, and whether you have missed payments. Again, this is standard practice and happens automatically. You cannot opt out of credit reporting without closing your account, though you can dispute inaccurate information on your credit report.

Banks also share data with fraud prevention services and other banks to detect suspicious activity. If you make an unusual transaction, your bank may check with other institutions to see if your information has been compromised elsewhere. This cross-bank sharing helps protect you from identity theft and fraud.

Marketing and affiliate sharing—and how to opt out

Banks can share your information with affiliated companies (companies owned by the same parent company) for marketing purposes unless you opt out. For example, if your bank is owned by a holding company that also owns an insurance company, the insurance company can receive your name and account information for marketing purposes unless you tell them not to. This is different from sharing with unaffiliated third parties, which requires your explicit consent.

To opt out of affiliate sharing, contact your bank directly. Most banks allow you to opt out through your online banking portal, by phone, or by mail. Look for a link labeled "Privacy" or "Opt Out" on your bank's website, or call the customer service number on the back of your debit card. You may need to opt out separately for each type of sharing (marketing, data sales, etc.), and you may need to renew your opt-out periodically—some banks require you to re-confirm every few years.

Unaffiliated third parties—companies that are not owned by your bank's parent company—cannot receive your information for marketing without your permission. However, you may have given permission without realizing it. If you linked your bank account to a budgeting app, a payment service, or a loan marketplace, you authorized that company to access your account information. Review the apps and services connected to your bank account regularly and disconnect any you no longer use.

What your bank must tell you about sharing

Banks are required by law to give you a privacy notice that explains what information they collect, who they share it with, and what choices you have. You should receive this notice when you open an account and at least once per year thereafter. The privacy notice is often included in your welcome packet or sent by mail, though some banks post it on their website instead.

The privacy notice will list categories of third parties your bank shares with—such as "service providers," "affiliated companies," "credit reporting agencies," and "law enforcement." It will also explain your opt-out rights. Read this notice carefully, because it is the official statement of what your bank does with your data. If you cannot find your bank's privacy notice, request it by phone or through your online banking portal.

Banks are also required to tell you if there is a data breach that exposes your personal information. If your bank discovers that your account information has been compromised, they must notify you within a reasonable time frame (usually 30 to 60 days). The notification will explain what information was exposed and what steps you should take to protect yourself.

Third-party apps and services connected to your account

When you connect a third-party app or service to your bank account—such as a budgeting tool, a bill payment service, or a peer-to-peer payment app—you are giving that company permission to access your account. The company can see your transaction history, account balance, and other details depending on what permissions you grant. This is not the bank sharing your information; it is you authorizing the third party to access it.

Before you connect an app to your bank account, review what permissions it is asking for. Does it need to see your full transaction history, or just your balance? Does it need to initiate transfers, or only read your account? Grant only the permissions the app actually needs to function. If an app asks for more access than seems necessary, consider whether you really need it.

You can revoke access at any time by disconnecting the app from your bank account. Log into your online banking portal, find the section for connected apps or third-party access (often under "Security" or "Settings"), and remove the app. The app will no longer be able to see your account information, though it may retain data it collected before you disconnected it.

What happens if your information is shared without permission

If your bank shares your information in violation of the GLBA or other privacy laws, you may have grounds to file a complaint or pursue legal action. Start by contacting your bank's privacy officer or compliance department and explaining what happened. If the bank does not respond or refuses to address the problem, you can file a complaint with your bank's federal regulator.

The regulator depends on the type of bank. National banks are regulated by the Office of the Comptroller of the Currency (OCC). State banks are regulated by the Federal Deposit Insurance Corporation (FDIC) or your state's banking authority. Credit unions are regulated by the National Credit Union Administration (NCUA). You can file a complaint online through each agency's website, and they will investigate whether the bank violated privacy laws.

If you suffer financial harm because of unauthorized sharing—for example, if your information was sold to a scammer who then defrauded you—you may be able to sue the bank. However, you will need to prove that the bank's violation directly caused your loss. Consult with an attorney who specializes in consumer protection or financial law if you believe you have a case.

Frequently Asked Questions

Can my bank sell my information to other companies?

Banks cannot sell your personal information to unaffiliated companies for marketing purposes without your consent. They can share with affiliated companies (owned by the same parent) unless you opt out. Banks do share transaction data with payment processors and credit bureaus as part of normal operations, but this is not a "sale" in the traditional sense—it is necessary for the financial system to function.

What if I do not want my bank to share my information with affiliated companies?

Contact your bank and request to opt out of affiliate sharing. Most banks allow you to do this online, by phone, or by mail. You may need to opt out for each type of sharing separately, and you may need to renew your opt-out every few years. Keep a record of when you opted out in case you need to dispute a sharing later.

Can my bank share my information with the IRS without a warrant?

Yes. The IRS can obtain your banking records using a summons, which does not require a warrant or court approval in the same way a criminal warrant does. Banks comply with IRS summonses as a matter of routine. If you are under audit or investigation, assume the IRS can access your account information.

If I disconnect an app from my bank account, does it delete the data the app already collected?

No. Disconnecting the app stops it from accessing your account going forward, but the app retains any data it collected before you disconnected it. If you want the app to delete your data, contact the app's customer service and request deletion. Some apps will comply; others may retain data for legal or business reasons.

How do I know if my bank has shared my information without permission?

You may not know unless you discover fraudulent activity or receive a notice from your bank about a data breach. Review your bank statements and credit reports regularly for suspicious activity. If you see unauthorized transactions or accounts opened in your name, contact your bank and the credit bureaus immediately. You can also request your bank's privacy notice to see who they share with and verify that you have not unknowingly authorized any third-party access.