GLBA (Gramm-Leach-Bliley Act)

The Gramm-Leach-Bliley Act, passed in 1999, is the federal law governing how US financial institutions handle nonpublic personal information about their customers. It applies broadly — to banks, brokerages, insurers, lenders, and many financial technology companies that handle consumer financial data, including account aggregators.

It has two main pieces that affect consumers directly. The Privacy Rule requires institutions to give customers a written notice explaining what personal information is collected, how it is used, and whom it may be shared with — the source of the annual privacy notices banks send. The Safeguards Rule requires them to maintain a written information security program with administrative, technical, and physical protections for that data.

Enforcement is split. The FTC covers many nonbank financial companies. Banking regulators cover banks and credit unions. The CFPB has some overlapping authority. Plumb is a covered entity under GLBA, treats connected-account information as covered data, and follows the Safeguards Rule.