Congress expands financial privacy rights while erasing state protections

What it does

This bill strengthens consumer privacy protections in the Gramm-Leach-Bliley Act by requiring financial institutions to collect only necessary data, give consumers ongoing opt-out rights, restrict how third parties use login credentials, and allow customers to request disclosure or deletion of their personal information. It also preempts state privacy laws with a federal standard and provides regulatory relief for small banks (under $15 billion in assets).

Why we flagged it

The bill's core function is to expand consumer privacy rights and restrict financial institutions' data collection and sharing practices. While it includes regulatory relief for small banks, the primary mechanism is privacy-protective, not deregulatory.

What the text implies

• Preemption of state privacy laws (Section 301) eliminates patchwork state protections but also prevents states from imposing stricter standards; consumers in privacy-protective states lose those advantages.
• The $15 billion asset threshold for small-bank regulatory consideration (Section 201) may create compliance gaps if smaller institutions lack resources to implement privacy controls, potentially leaving their customers less protected.
• Deletion rights for former customers (Section 503A) have broad exceptions for legal retention requirements, which may limit practical utility if financial institutions retain data under compliance or dispute-resolution rules.
• The bill defines 'sensitive nonpublic personal information' to include biometric and geolocation data, but only when used 'while engaging in financial activities'—the scope of this carve-out is unclear and may allow broader collection outside that context.
• Financial data aggregators face new credential-use restrictions, but the bill's exceptions for CFPB Section 1033 compliance may preserve aggregator access if regulators interpret that provision broadly.

Who it affects

Ordinary consumers gain meaningful privacy rights—ongoing opt-out authority, data minimization requirements, credential protection, and the ability to request deletion of their data. These protections reduce unauthorized data sharing and give individuals more control over sensitive financial information. The preemption of state laws is a trade-off, but the federal floor appears substantive enough to constitute a net public benefit.

Who stands to gain

• Community banks and regional financial institutions (regulatory relief)
• Fintech and financial data aggregators (clarified rules, potential market expansion)
• Consumer reporting agencies (carve-outs from deletion requirements)

Named in the bill

Gramm-Leach-Bliley Act, Consumer Financial Protection Act (CFPB), Fair Credit Reporting Act, Federal Reserve, OCC, FDIC (functional regulators), Financial data aggregators, Consumer reporting agencies, State insurance authorities, Bank Holding Company Act of 1956, National Artificial Intelligence Initiative Act of 2020, Securities Exchange Act of 1934, Commodity Futures Trading Commission

Where it stands

6 cosponsors: 6 Republicans.

• Apr 21, 2026 — Introduced · Congress.gov: “Introduced in House”
• Apr 21, 2026 — Referred to House Committee on Financial Services · Congress.gov: “Referred to the House Committee on Financial Services”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

26 lobbying clients named this bill on 27 disclosure filings across 1 quarter, Jun 2026 to Jun 2026. Those filings disclosed $13,224,000 in lobbying spend. A filing names 15 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 97% of bills with at least one filing.

Bill Huizenga, the sponsor, reported $1,647,709 in PAC receipts in the 2026 cycle. $23,500 of that came from 3 PACs tied to these lobbying clients.

• American Property Casualty Insurance Association — $2,140,000 on 1 filing
• Securities Industry and Financial Markets Association — $1,930,000 on 1 filing
• The Northwestern Mutual Life Insurance Company — $1,260,000 on 1 filing
• Investment Company Institute — $1,190,000 on 1 filing
• Chubb Ina Holdings Inc. — $750,000 on 1 filing

Lobbying Disclosure Act filings through Jul 23, 2026. A filing shows who paid to lobby on a bill it names, not what changed.