Sponsors (7)
The bill creates a stronger, uniform federal privacy floor and tighter protections for sensitive financial data—giving consumers more control and security—while increasing compliance costs, creating service frictions, and limiting states' ability to set stricter protections.
Consumers (customers and former customers) gain stronger privacy rights and control: easier access to copies of nonpublic personal information, lists of parties with whom their data was shared, deletion rights (with narrow exceptions), data‑minimization limits on collection, and clearer disclosures (including AI use, retention, and cross‑border processing).
Sensitive data and account security are better protected: access credentials, biometric identifiers, and precise geolocation are explicitly treated as nonpublic or sensitive, and aggregators face limits on credential use and must provide opt‑outs, reducing risk of account takeover and identity misuse.
A single federal privacy standard for financial‑sector nonpublic personal information reduces variation across states and clarifies rights for consumers nationwide.
Banks, credit unions, financial data aggregators, and other covered firms will face substantial new compliance costs (updating disclosures, verification, deletion processes, consent flows, model forms, legal review), costs that may be passed on to customers or reduce available services.
Tighter retention, deletion, and sensitive‑data restrictions plus limits on credential use could impede fraud prevention, onboarding, regulatory recordkeeping, and interoperable third‑party financial services, potentially slowing legitimate services or forcing business‑model changes.
Federal preemption of state law prevents states from enacting stronger consumer privacy protections, which could reduce protections for consumers in states that previously had higher standards.
Based on analysis of 4 sections of legislative text.
Strengthens GLBA by adding data‑minimization, deletion/disclosure rights, opt‑in for sensitive data, limits on access credentials, expanded definitions, and federal preemption of state privacy rules.
Official title: To make improvements to title V of the Gramm-Leach-Bliley Act, and for other purposes.
Introduced April 21, 2026 by Bill Huizenga · Last progress April 21, 2026
Creates stronger federal financial privacy rules by amending the Gramm‑Leach‑Bliley Act to add data‑minimization duties, new consumer disclosure and deletion rights, stricter limits on sharing and on use of consumer access credentials, mandatory opt‑in for "sensitive" financial data, and expanded definitions (including adding financial data aggregators, biometric and precise geolocation data). It also directs agencies to consider small‑institution burdens when writing rules and establishes explicit federal preemption of state consumer privacy or security laws for covered nonpublic personal information. The bill phases in changes over 1–2 years (shorter delay for access/opt‑in rules, longer for deletion/disclosure and data‑minimization), requires agencies to update model forms and provide a safe harbor period, and ties new definitions to other statutes (AI, covered nation, SRO definitions).