Congress expands financial privacy rights while erasing state protections
H.R. 8398 — Guidelines for Use, Access, and Responsible Disclosure of Financial Data Act · Filed by Bill Huizenga (R-MI) · 6 cosponsors · Introduced Apr 21, 2026 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill strengthens consumer privacy protections in the Gramm-Leach-Bliley Act by requiring financial institutions to collect only necessary data, give consumers ongoing opt-out rights, restrict how third parties use login credentials, and allow customers to request disclosure or deletion of their personal information. It also preempts state privacy laws with a federal standard and provides regulatory relief for small banks (under $15 billion in assets).
Why we flagged it
The bill's core function is to expand consumer privacy rights and restrict financial institutions' data collection and sharing practices. While it includes regulatory relief for small banks, the primary mechanism is privacy-protective, not deregulatory.
What the text implies
- Preemption of state privacy laws (Section 301) eliminates patchwork state protections but also prevents states from imposing stricter standards; consumers in privacy-protective states lose those advantages.
- The $15 billion asset threshold for small-bank regulatory consideration (Section 201) may create compliance gaps if smaller institutions lack resources to implement privacy controls, potentially leaving their customers less protected.
The full analysis lists 5 implications of this text.
Who stands to gain
Community banks and regional financial institutions (regulatory relief); Fintech and financial data aggregators (clarified rules, potential market expansion); Consumer reporting agencies (carve-outs from deletion requirements)