Does the on-line Privacy Notice need to be in the same (two page) format that became effective in January 2011, or is the requirement simply that it be consistent with the written Policy provided to customers? Thanks.

What regulation requires an "on-line" privacy notice?

Randy, I believe the original poster was asking if they can modify the annual privacy disclosure (Reg P) and opt out form that they provide those customer who have agreed to receive information electronically under E-SIGN.

You should provide the same disclosure to all customers whether they have consented to receive them electronically or by paper. For these type of disclosures, I have found that converting them to a PDF file and either attaching them to an E-Statement, or including a link on their E-Statement directing them to the disclosure is the best way to go.

Actually, the Website Compliance Review in the BOL Tools led me to the need for the disclosure:

SECTION 4 – On Line Privacy Protection (GLBA) Gramm-Leach-Bliley Act.

 1. Privacy notice must be conspicuous and easy to find on web page.


 2. It should match your paper copy (in the branch and loan centers).

 3. Generally financial institutions may not disclose non-public personal information about a consumer to a non-affiliated third party without an opt-out. Does the notice include Opt-Out Verbiage under GLBA and FCRA?

Is this not correct?

The referenced "tool" is an old document and this section of that document appears to have been written during the time between enactment of GLBA and Reg. P. The relevant section of GLBA provides that- "The Federal banking agencies...shall each prescribe...such regulations as may be necessary to carry out the purposes of this subchapter." Since it became effective, Reg. P contains all the rules that apply to your privacy disclosures. Importantly, Reg. P ALLOWS but does not REQUIRE electronic privacy notices.

Thank you for the clarification.

Privacy notices online go way back and predate E-Sign compliance requirements. It is a low cost delivery alternative, if accepted by your customers.

Prior to GLBA there were various guidelines and other optional privacy disclosure practices. Reg. P supersedes all of these things.

Thanks again. Would anyone have a current Compliance/Audit for websites that they'd be willing to share?