Banks can share your account data, but only with specific parties and under specific rules

Your bank shares information about your account and transactions with third parties regularly — but not freely. Federal law sets strict limits on what banks can disclose, to whom, and under what circumstances. The main rule: banks can share information with companies that help them run your account (like payment processors), with government agencies that have a legal right to it, and with other financial institutions if you authorize them. They cannot sell your personal information to marketers or data brokers without your consent, though they can share certain non-personal transaction data.

The specific rules depend on which law applies to your situation. The Gramm-Leach-Bliley Act (GLBA) is the federal baseline — it requires banks to tell you what they share and give you the right to opt out of certain sharing. State laws sometimes add stronger protections. Understanding what your bank can and cannot do protects you from unwanted disclosures and helps you spot unauthorized access.

Key Takeaways

  • Banks must give you a privacy notice explaining what information they share and with whom, usually at account opening or in your online portal.
  • Banks can share account information with service providers (payment networks, fraud investigators), government agencies with a subpoena or warrant, and other financial institutions you authorize.
  • You can opt out of some sharing — typically the sharing of information with non-affiliated third parties for marketing — by contacting your bank in writing or through your online account settings.
  • Banks cannot sell your personal information to data brokers or marketers without your consent, but they can share transaction patterns and non-identifying data with affiliated companies.
  • If your bank shares information without authorization or violates its own privacy policy, you can file a complaint with your bank's regulator (the OCC, Federal Reserve, or FDIC depending on the bank's charter).

What information banks share and why

Banks share account information in several categories, each with different rules. Service providers — payment processors, fraud detection companies, check clearing houses, and customer service vendors — get access to transaction data and account details because they help the bank operate. You cannot opt out of this sharing because these companies are essential to running your account.

Banks also share with affiliated companies under the same corporate parent. If your bank is owned by a larger financial holding company, that parent company and its other subsidiaries (insurance companies, investment firms, mortgage lenders) may receive information about your accounts and creditworthiness. You can usually opt out of this sharing, though opting out may limit the services available to you.

Government agencies receive information when they have a legal right to it: a subpoena, warrant, tax summons, or court order. Banks must comply with these requests and typically cannot tell you in advance. Some agencies (like the IRS) have standing authority to request certain information without a warrant.

Non-affiliated third parties — companies outside your bank's corporate family — receive information only if you authorize it or if the bank has a legitimate business reason (like a debt collector pursuing a judgment against you). Banks cannot share your personal information with marketers, data brokers, or other unrelated companies without your consent.

How to find your bank's privacy policy and what it says

Your bank is required by law to give you a privacy notice that explains what information it collects, how it uses it, and with whom it shares it. This notice is usually provided at account opening, but you can request it anytime. Most banks post their full privacy policy on their website — look for a link at the bottom of the homepage labeled "Privacy Policy," "Privacy Notice," or "Your Privacy Rights."

The privacy notice will list categories of information (account balances, transaction history, credit information) and categories of recipients (service providers, affiliated companies, government agencies). It will also explain your right to opt out of certain sharing. Read the section on "non-affiliated third parties" or "marketing" carefully — this is where you learn whether the bank shares your information with outside companies and how to stop it.

If you cannot find the policy online, call your bank's customer service line and ask them to mail or email you a copy. Banks must provide it within a reasonable time, usually within 10 business days. Keep a copy for your records.

Opting out of information sharing

Federal law gives you the right to opt out of certain sharing, but not all. You can typically opt out of the sharing of information with non-affiliated third parties for marketing purposes. You usually cannot opt out of sharing with service providers, affiliated companies, or government agencies — these are considered necessary to the operation of your account or required by law.

To opt out, look for an opt-out form or link in your bank's privacy notice. Many banks allow you to opt out online through your account settings, by phone, or by mailing a signed form. The process varies by bank. Some banks require you to opt out separately for each type of sharing (marketing, affiliate sharing, etc.), while others have a single opt-out option.

Opting out of affiliate sharing may have consequences: your bank may limit your access to certain products or services, charge higher fees, or reduce the rewards on your account. Ask your bank what happens if you opt out before you do it. Opting out of marketing sharing typically has no downside — it just means you will receive fewer solicitations.

Keep a record of when and how you opted out. If you continue to receive unwanted sharing or solicitations after opting out, contact your bank in writing and reference your opt-out request. If the bank does not honor your opt-out, you can file a complaint with your bank's regulator.

What happens when a bank shares information without authorization

If your bank shares your information in violation of its privacy policy or without your consent, you have several options. First, contact the bank directly in writing. Explain what information was shared, to whom, and why you believe it was unauthorized. Ask the bank to investigate and provide a written response within 30 days. Many banks will correct the problem if you can show they violated their own policy.

If the bank does not respond or refuses to correct the problem, file a complaint with your bank's federal regulator. The regulator depends on the bank's charter type: the Office of the Comptroller of the Currency (OCC) oversees national banks, the Federal Reserve oversees state-chartered banks that are Fed members, and the Federal Deposit Insurance Corporation (FDIC) oversees state-chartered banks that are not Fed members. You can find your bank's regulator on the FDIC's website or by calling the bank and asking.

File your complaint in writing with the regulator, including copies of your bank's privacy notice, your opt-out request (if you made one), and any correspondence with the bank. The regulator will investigate and may require the bank to correct the problem or pay damages. This process typically takes several months.

In some cases, you may have a private right to sue. If the bank's sharing violated the GLBA or your state's privacy law, you may be able to file a lawsuit seeking damages. Consult a lawyer to determine whether you have a case — many privacy violations result in small damages per person, so class action lawsuits are more common than individual suits.

Information sharing when you authorize it

When you authorize a third party to access your account — for example, by linking your bank account to a budgeting app, a bill payment service, or a peer-to-peer payment platform — you are giving that company permission to see your account information. Read the authorization carefully before you grant it. Many apps ask for broader access than they actually need.

Once you authorize a third party, your bank will share information with them, and the bank is not liable for how that third party uses the information. The third party's privacy practices are governed by their own privacy policy, not your bank's. If you want to stop the sharing, you must revoke the authorization through the third party's app or website, not through your bank. Revoking the authorization tells the third party to stop requesting information, but it does not may provide they delete information they already received.

Be cautious about which apps and services you authorize. Stick to well-known companies with clear privacy policies. Avoid apps that ask for access to your full account history or that require you to give them your login credentials — legitimate apps use secure authorization protocols that do not require you to share your password.

State privacy laws and stronger protections

Some states have privacy laws that go beyond the federal baseline. California, New York, and a growing number of other states have passed laws that give residents stronger rights to know what information is collected, to delete it, and to opt out of sharing. If you live in one of these states, your bank must comply with both federal and state law — whichever is stricter.

Check your state's attorney general website or your bank's privacy notice to see whether your state has additional privacy rights. If it does, your bank's privacy notice should explain how to exercise those rights. State laws often require banks to respond to data access and deletion requests within 30 to 45 days.

Frequently Asked Questions

Can my bank sell my information to other companies?

No, not without your consent. Banks cannot sell personal information about you to data brokers, marketers, or other unrelated companies. They can share information with service providers and affiliated companies, but that is not the same as selling it. You can opt out of sharing with non-affiliated third parties by requesting an opt-out through your bank's privacy notice.

Does my bank share my information with the IRS?

Yes, the IRS has standing authority to request certain information from banks without a warrant, including account balances and transaction history. Banks must comply with these requests. You will not be notified in advance. If you believe the IRS request was improper, you can challenge it through the tax dispute process, but the bank itself cannot refuse to comply.

What if I link my bank account to a budgeting app — what can that app see?

The app can see whatever information you authorize it to access. Most budgeting apps ask for read-only access to your account history and balances so they can categorize your spending. Some ask for broader access. Before you authorize an app, read what permissions it is requesting and consider whether it actually needs that much information. You can revoke access anytime through the app's settings.

Can I sue my bank if they share my information without permission?

You may be able to, depending on whether the sharing violated the Gramm-Leach-Bliley Act, your state's privacy law, or your bank's own privacy policy. Consult a lawyer to determine whether you have a case. Many privacy violations result in small damages per person, so class action lawsuits are more common than individual suits. You can also file a complaint with your bank's federal regulator at no cost.

What is the difference between sharing information and selling it?

Sharing means giving information to another company for a specific purpose — like sharing with a payment processor to clear a check. Selling means transferring information in exchange for money. Banks can share information with service providers and affiliated companies, but they cannot sell personal information to data brokers or marketers without your consent. The distinction matters because you have stronger rights to opt out of selling than out of sharing.