A Large-Scale Evaluation of U.S. Financial Institutions’ Standardized Privacy Notices

Although large-scale comparisons of privacy practices acrossan industry have the potential to illuminate the state ofconsumer privacy and to uncover egregious practices, thefreeform legalese of most privacy policies makes comparisonstime-consuming and expensive. Financial institutions in theUnited States are required by the Gramm-Leach-Bliley Actto provide annual privacy notices. In 2009, eight federalagencies jointly released a model privacy form for these dis-closures. While use of the model privacy form is not re-quired, it has been widely adopted. With so many insti-tutions’ policies available in a standard format, large-scalecomparisons are now more readily achievable.We built an automated web crawler and document parserfor the model privacy form and automatically evaluated 6,191U.S. financial institutions’ privacy notices. We found largevariance in stated practices, even among institutions of thesame type. While thousands of financial institutions sharepersonal information without providing the opportunity forconsumers to opt out, some institutions’ practices are moreprivacy-protective. Statistical analyses show that large insti-tutions and those geographically located in northeastern re-gions share consumers’ personal information at higher ratesthan all other institutions.Furthermore, we uncovered institutions failing to allowconsumers to limit data sharing when legally required to doso, as well as institutions making self-contradictory state-ments. We discuss implications for privacy in the financialindustry, issues with the design and use of the model privacyform, and future directions for standardized privacy notices.