← Global Privacy Laws Research Library
15 U.S.C. §§ 6801-6827 (2024 edition)
Gramm-Leach-Bliley Act – Privacy (15 U.S.C. Chapter 94)
Prepared by Shubhank Suman · Last reviewed
CURRENT / IN FORCE
- Legal character
- Statute
- Region
- North America
What it covers
Subchapter I places on every financial institution a continuing duty to respect customer privacy and protect the security and confidentiality of nonpublic personal information. Institutions must give initial and annual privacy notices, must let consumers opt out before nonpublic personal information is disclosed to non-affiliated third parties, and may not share account numbers for marketing. Agencies make rules and enforce. Subchapter II makes it an offence to obtain customer information from a financial institution by false pretences (pretexting).
Why it matters
It is the federal baseline for privacy and security in US financial services and the source of the Privacy Rule and Safeguards Rule.
Refer to it when
Use it for privacy notices, information sharing or security programmes of banks, lenders, insurers and other financial institutions.
AI, privacy and cybersecurity relevance
- AI: Low
- Privacy: Very High
- Cyber: High
AI
LOW RELEVANCE
No AI-specific provisions.
Privacy
VERY HIGH RELEVANCE
Core US financial privacy law.
Cybersecurity
HIGH RELEVANCE
Basis of the Safeguards Rule.
Applicability
Financial institutions and those who receive nonpublic personal information from them.
Current validity
CURRENT. Enacted 1999 (Public Law 106-102), as amended. Read the official PDF on this page for the operative text.
Read first
Section 6809 (definitions) → 6801 → 6802 → 6803 → 6821.
Provisions / sections covered
Section 6801 – Protection of nonpublic personal information
Privacy obligation and security safeguards standards.
Section 6802 – Disclosure obligations
Notice and opt-out before sharing with non-affiliated third parties; exceptions.
Section 6803 – Privacy policy disclosure
Content and timing of privacy notices.
Section 6805 – Enforcement
Agency-by-agency enforcement.
Section 6807 – Relation to State laws
Greater State protection is not pre-empted.
Section 6821 – Pretexting
Ban on obtaining customer information by false pretences.
Subject-matter tags
- Security
- Enforcement and penalties
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
- HIPAA: United StatesLaw · Current (amended)Same jurisdiction; assess applicability separately.
- NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0)Framework · Voluntary / non-bindingSame jurisdiction; assess applicability separately.
- Stored Communications Act – 18 U.S.C. Chapter 121Law · CurrentSame jurisdiction; assess applicability separately.
- Video Privacy Protection Act – 18 U.S.C. § 2710Law · CurrentSame jurisdiction; assess applicability separately.
- Cybersecurity Information Sharing Act of 2015Law · CurrentSame jurisdiction; assess applicability separately.
- Federal Information Security Modernization Act of 2014 (FISMA)Law · CurrentSame jurisdiction; assess applicability separately.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.