Congress Just Proposed to Rewrite GLBA's Privacy Rules. The GUARD Financial Data Act Requires Opt-In Consent, Deletion Rights, and AI Disclosure. Here's the Gap Analysis.

TL;DR

• The GUARD Financial Data Act (H.R. 8398), introduced April 21, 2026, would make the most significant changes to GLBA’s Title V privacy framework since Gramm-Leach-Bliley was enacted in 1999
• Five major changes: opt-in consent for sensitive NPI, deletion rights for former customers, AI disclosure in privacy notices, data minimization limits on collection, and new obligations for financial data aggregators
• The bill was introduced April 21, 2026, and referred to the House Financial Services Committee, with no further action as of October 2026 — its path forward is uncertain, but the direction of travel is clear and the gap between current Regulation P programs and GUARD’s requirements is substantial
• Compliance teams should run a gap assessment now: if GUARD passes in any form close to its current text, most financial institutions have work to do on consent architecture, notice content, deletion processes, and AI inventory

GLBA’s Title V was written in 1999. Regulation P’s privacy notice framework was finalized in 2000. The standard Regulation P opt-out notice — delivered at account opening, annually if you share NPI, in a format designed for readability — was designed for a world where “sharing data” meant a fax to a nonaffiliated insurance company, not a real-time behavioral profile fed into a machine learning model that determines which customers to cross-sell and which to let churn.

The concept of a financial institution using AI to process NPI for underwriting decisions, then sharing model outputs with affiliated analytics companies, while retaining behavioral data indefinitely and using it for purposes unrelated to the original service relationship — none of that was in scope when Regulation P was written.

On April 21, 2026, Republican members of the House Financial Services and Energy & Commerce Committees introduced two companion bills — the SECURE Data Act (H.R. 8413), a broader consumer privacy bill, and the GUARD Financial Data Act (H.R. 8398) for financial institutions — and the two committees announced them jointly the next day. GUARD is the most significant proposed update to GLBA’s privacy framework in 27 years.

It’s not law yet. But if your privacy compliance program is built entirely on Regulation P’s current requirements, you should know exactly where the gap is.

What the GUARD Act Changes

The GUARD Act modernizes GLBA Title V across five major dimensions. Each one represents a meaningful departure from current requirements.

1. Opt-In Consent for Sensitive NPI

Current GLBA and Regulation P operate on an opt-out model: financial institutions can share NPI with nonaffiliated third parties unless the customer affirmatively opts out. The opt-out right is meaningful in theory, but in practice, most customers don’t exercise it, and the default permission benefits the institution.

The GUARD Act flips that default for sensitive nonpublic personal information. Under the bill, financial institutions would need affirmative opt-in consent before collecting sensitive NPI or disclosing it to a nonaffiliated third party, and consumers could revoke that consent at any time. The bill defines sensitive NPI as information revealing racial or ethnic origin, religious belief, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data used to uniquely identify a consumer; and precise geolocation data. For sensitive data, silence no longer means consent.

This is a fundamental change to consent architecture. Financial institutions that collect geolocation data for fraud detection, or biometric data for authentication, would need to build opt-in consent mechanisms — with clear disclosure of purpose — rather than relying on the existing opt-out notice.

2. Data Minimization

The GUARD Act would limit collection and use of NPI to what is “adequate, relevant, and reasonably necessary” for a specified purpose. Current GLBA imposes no data minimization standard. You can collect more data than you need and hold it longer than you need it, and there’s no federal limit on that collection.

Data minimization changes the architecture of data programs, not just the compliance documentation. Financial institutions that have built analytics, personalization, or AI training pipelines on broad NPI collection would need to map each data element to a defined purpose that justifies its collection. Data without a defensible purpose — held “in case we want to analyze it later” — wouldn’t survive that analysis.

3. AI Disclosure in Privacy Notices

This is the provision most compliance teams have missed. The GUARD Act would require privacy notices to describe the categories of the institution’s practices for using artificial intelligence in the collection, processing, and utilization of nonpublic personal information. The same section adds the purposes for collecting and sharing NPI, retention practices, and whether NPI is processed in, retained in, or disclosed to a “covered nation”.

There’s no equivalent requirement in current Regulation P. The annual or initial privacy notice describes categories of NPI collected and shared — it says nothing about how that NPI is processed. If you’re using NPI to train underwriting models, to score customers for cross-sell targeting, or to feed AML transaction monitoring systems, your current privacy notice doesn’t disclose that. Under GUARD, it would have to.

For financial institutions that have deployed AI broadly — which by 2026 is most of them — the AI disclosure requirement requires an inventory of AI models and tools that touch NPI, plain-language descriptions of what those models do with customer data, and updated privacy notice templates that can accommodate that disclosure.

This connects directly to the AI governance work that institutions are building under SR 26-2 and the CSBS AI Supervisory Framework — the same AI use-case inventory that your AI governance committee should be maintaining is the input your privacy team needs for GUARD compliance. We covered the AI governance exception process, including how to document use cases before validation is complete, in AI Governance Exceptions: How to Approve a Use Case With Open Testing Gaps.

4. Former Customer Deletion Rights

Current GLBA and Regulation P don’t give former customers the right to demand deletion of their data. The GUARD Act would.

Under the bill, former customers could request deletion of their nonpublic personal information, with a 45-day response clock (extendable once by 45 days), identity verification, and an appeal process. The exceptions matter: deletion isn’t required where data must be retained for a continuing purpose under a section 502(e) exception, where a consumer reporting agency holds it solely for FCRA-covered activities, where it’s needed to respond to an FCRA dispute, or where retention is “otherwise required by law.” That last bucket is where your record-keeping obligations — BSA records, for example — would override a deletion request for the data they cover.

But not all retained data is legally required. Behavioral analytics, marketing preferences, product usage patterns, and derived data — the NPI that financial institutions collect beyond their legal record-keeping obligations — would be subject to deletion requests from former customers. The conflict between federal records retention requirements and deletion rights is one we’ve already analyzed in detail for current state law obligations in Your Customer Wants Their Data Deleted. Federal Law Says You Can’t. GUARD would create the same conflict at the federal level.

5. Financial Data Aggregator Obligations

The GUARD Act introduces a new regulatory category: financial data aggregators. The bill defines them as businesses whose primary purpose is accessing, aggregating, collecting, processing, selling, or otherwise disclosing NPI, and adds them to GLBA’s definition of financial institution. Before an aggregator or other nonaffiliated third party uses a consumer’s login credentials to pull data from a financial institution, it would have to give a clear disclosure of how it will use the credentials and the privacy and security risks, plus a chance to say no. Once the consumer has received that notice and opt-out opportunity, the financial institution could not deny the credential-based request.

For financial institutions that serve as data sources for aggregators (which is most of them), this creates an upstream question: when aggregators accessing your customers’ NPI become subject to their own GUARD obligations, what does that mean for the data-sharing agreements and API terms your institution maintains with those aggregators?

Current vs. GUARD: The Gap at a Glance

What Compliance Teams Should Do Now

The GUARD Act is not law. It may not pass in its current form, or at all. But the direction of federal privacy legislation for financial institutions is visible from this bill, and the gap between where most privacy programs are and where GUARD would require them to be is large enough that waiting for enactment before starting the work is not a good strategy.

Gap assessment against GUARD’s five changes. Work through each of the five dimensions — consent architecture, data minimization, AI disclosure, deletion processes, and aggregator obligations — and document where your current program would need to change. This analysis is useful regardless of whether GUARD passes, because it maps exactly where state privacy laws like CCPA, Connecticut’s data privacy act, and others (which partially or fully apply to your non-GLBA data) already require similar things.

AI inventory. If GUARD passes, the AI disclosure requirement lands on your privacy notice update cycle — the bill gives institutions that use the current model form a two-year safe harbor after regulators finalize an updated one, but that’s a deadline, not a reason to wait. The input for that disclosure is an AI model inventory — which models process NPI, for what purpose, and with what data inputs. If your AI governance program doesn’t already maintain this inventory, the GUARD AI disclosure requirement is a second reason (after examiner expectations under SR 26-2) to build it now.

Consent architecture review. Identify what sensitive NPI your institution currently collects and the basis on which it’s collected. Under GUARD, collecting precise geolocation, identifying biometric data, or the other sensitive categories would require opt-in consent. Designing opt-in consent mechanisms — not just updating a notice, but building actual consent flows that work at account opening and for existing customers — takes time. The institutions that wait for enactment to start that design work will be behind.

Former customer data audit. For a deletion right to work operationally, you need to know what data you hold for former customers and which of it is legally required vs. retained for other purposes. Most data inventories aren’t organized by customer relationship status. Building that categorization before you’re obligated to respond to deletion requests is materially easier than building it in response to an actual request.

The Regulation S-P compliance gap work we covered in Your Reg S-P Compliance Deadline Passed in June shows what happens when privacy-adjacent requirements arrive faster than compliance programs are ready for them. GUARD is the same type of risk, at larger scale.

So What?

GLBA’s privacy framework has been essentially unchanged for 27 years. The GUARD Financial Data Act is the first serious congressional attempt to modernize it for the actual data landscape financial institutions operate in today — AI-processed NPI, behavioral analytics, account aggregation platforms, and geolocation-based fraud scoring were not part of the 1999 design.

The bill hasn’t moved past committee referral. Its preemption provisions would, if enacted, displace the increasingly complex state privacy law compliance patchwork that multi-state financial institutions currently manage. But the federal standard it would establish is meaningfully more demanding than current Regulation P in four of five dimensions.

The compliance work GUARD would require — consent architecture for sensitive data, AI disclosure in privacy notices, deletion processes for former customers, data minimization — is directionally aligned with where state privacy law requirements are already heading. The Reg P annual notice revision cycle, the AI governance inventory, the consumer request handling workflow you’re building for California and Connecticut: those aren’t wasted effort if GUARD doesn’t pass. They’re the same work that GUARD would require at the federal level.

The gap assessment starts with knowing where you are. The Data Privacy Compliance Kit covers your current GLBA and state privacy law obligations — the Regulation P and Safeguards Rule checklist, applicability analysis for all 23 state comprehensive privacy laws, data inventory and retention schedule, and consumer request tracker. Running that assessment now gives you the baseline you’ll need when federal privacy requirements shift.