The Gramm-Leach-Bliley Act is the 1999 US law governing how financial institutions handle and protect consumers' nonpublic personal information, including the Privacy Rule and the Safeguards Rule. It is the long-standing privacy and data-security backdrop against which US open banking and the CFPB's 1033 rule operate — the pre-existing obligation that any US financial-data-sharing regime has to work within.
Gramm-Leach-Bliley Act
Statute United States
The Gramm-Leach-Bliley Act (GLBA) is the US financial-privacy law that was governing consumer financial data long before anyone said “open banking.” Its Privacy Rule constrains how institutions share nonpublic personal information, and its Safeguards Rule requires them to secure it — the backdrop the CFPB’s 1033 rule and the whole US data-sharing effort have to operate within.
- The Privacy Rule - Governs when and how a financial institution may disclose a consumer’s nonpublic personal information, and requires privacy notices.
- The Safeguards Rule - Requires a written information-security program to protect that data — the security floor beneath any API that exposes it.
- The pre-existing regime - Unlike the UK or Australia, where open banking arrived into a purpose-built regime, US open banking is layered on top of a twenty-five-year-old privacy law, which shapes how §1033 and the CFPB rule can operate.
GLBA is a useful reminder that the US did not lack financial-privacy law — it lacked an access mandate. The security and privacy obligations were always there; what was missing until the CFPB rule was the requirement to let a consumer port their data through an API. That gap, not a privacy vacuum, is what produced the fragmented US market I scored.
Reaches these HTTP headers
Where a regulation actually touches the wire. Mandated means the law, or a technical standard it makes binding, names this header. Evidentiary means no law names it, but it is the deployed control for an obligation the law does impose. Inferred means it would be good evidence and nothing requires it — interesting to read, never to score.
cache-control
evidentiary
observable at the edge
strict-transport-security
evidentiary
observable at the edge
The FTC's 2021 Safeguards amendments require encryption in transit explicitly.
