How Does The Gramm-Leach-Bliley Act Define A Customer?

What’s Happening

This law kicks in when someone opens a checking account, applies for a mortgage, or signs up for investment services for personal reasons. It doesn’t touch relationships formed for business purposes—like a company taking out a commercial loan. GLBA also forces institutions to spell out how they gather, use, and share nonpublic personal information (NPI) with customers. The Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB) keep refining these definitions, most recently in 2025.

Step-by-Step Solution

1. Identify the relationship type – Flip through GLBA §13 (15 U.S.C. §6809(4)) and the CFPB’s Exam Manual (updated 2025) to separate “customers” from “consumers.”
2. Verify NPI collection – Double-check that the person handed over sensitive data (think Social Security number, account details) during a personal financial transaction. If the data was gathered for a business, GLBA doesn’t apply.
3. Exclude inapplicable entities – GLBA skips legal entities like corporations, partnerships with six or more members, and solo proprietorships without personal data ties. The IRS’s entity classification guide can help confirm this.
4. Issue and document privacy notices – Get the privacy notice out within 30 days of account opening, then every year after that. Make sure the “Do Not Share My Information” opt-out link is live in your online portal and log customer acknowledgments in your CRM.

If This Didn’t Work

• Reclassify the relationship – If the person only poked around (say, checking mortgage rates but never applying), log them as a “consumer” under GLBA. Update your internal tracking system to match.
• Review state privacy laws – States like California (CCPA), Virginia (CDPA), and Colorado (CPA) have tighter rules that might overlap with GLBA. The IAPP’s compliance tool can help you figure out what you need to do.
• Consult regulatory guidance – Run your scenario by the CFPB’s Ask CFPB forum for clarification on tricky cases. You’ll usually get a response from GLBA specialists within 48 hours.

Prevention Tips

Add a quick checkbox to your account application asking customers to confirm their relationship is for personal use. Make sure your team knows how to handle digital-only accounts—the CFPB spelled this out in 2025. Run audits using the CFPB’s checklist to ensure privacy notices go out on time. Keep all GLBA-related interactions locked down in encrypted systems like Salesforce Financial Services Cloud or a similarly compliant CRM to meet retention and security rules.