For what it is worth, I found that mailing privacy notices separately was cheaper than stuffing into statements, then locating loan-only, CD-only, dormant-only, and other account holders that are not getting a regular monthly statement and mailing them a separate notice. It was (after taking my peoples' time into account) less expensive and less of a headache to do it separately. The regulators also liked it because I would just say "we mailed to everyone on this day" rather than having to provide details on the statement cycles and afore-mentioned loan/CD/dormant clients.
I figure the big banks came to that same conclusion - Chase, Wells, and Citi all send me my privacy notice in a separate mailing.