Sector privacy rules, on top of everything else
A lead form on a lender or advisor site collects information that is regulated by name. Federal financial privacy rules sit alongside state privacy law, and in California there is a state financial privacy statute that applies regardless of size.
Why people arrive here
Often a compliance review before an examination, or a partner bank asking what the website collects and where it goes. Sometimes a licensing question: a disclosure that has to appear and does not, or appears on one page and not another.
What bites hardest
These are the same obligations every business website carries. In this sector they are the ones that produce letters first.
CCPA and CPRA
California privacy law gives consumers rights over personal information a business collects about them, and imposes duties on businesses that meet one of three thresholds. It is enforced by the California Privacy Protection Agency and the Attorney General.
ADA web accessibility
Title III of the Americans with Disabilities Act requires places of public accommodation to be accessible to people with disabilities. The Department of Justice takes the position that this reaches the websites of businesses open to the public, and has published guidance saying so.
Breach notification
A legal duty to tell affected people, and often a regulator, after personal information you hold has been acquired by somebody who should not have it. Every US state has such a law, and so do the EU and UK under the GDPR.
Data requests
A data subject request, or consumer request, is somebody exercising a legal right over the personal information you hold about them: to know what you have, to get a copy, to correct it, to delete it, or to opt out of its sale or sharing.
Sector rules to watch
These reach this sector specifically and have no page in the library yet. Each one is a question for a lawyer who knows your business.
- Gramm-Leach-Bliley Act and the Safeguards Rule
Financial institutions, defined broadly enough to cover many lenders, brokers and advisors, must provide privacy notices and maintain an information security program. The Federal Trade Commission Safeguards Rule sets what that program has to contain, and a web form collecting customer financial information is inside it.
FTC Safeguards Rule: What Your Business Needs to KnowUS Federal Trade Commission
- California Financial Information Privacy Act
California imposes its own notice and consent requirements on financial institutions doing business in the state, separate from the CCPA. It applies without the revenue and volume thresholds the CCPA uses, so a small firm can be outside the CCPA and inside this.
California Financial Information Privacy Act, Financial Code division 1.2California Legislative Information
- Licensing disclosure on marketing pages
State licensing regimes generally require license identifiers to appear in advertising, and a website is advertising. The specific requirement, and where it must appear, comes from your regulator rather than from any general web rule.
Advertising rules for licenseesNMLS Consumer Access
What WebSpark does
- Forms that collect financial information route directly to your system rather than through a general automation service, so the data path is short and describable.
- Licensing identifiers and required disclosures are content fields with their own validation, so a page cannot publish without them.
- Every page tested against WCAG 2.2 AA before it publishes, with a dated record of what was found.
- Consent that matches the region a visitor is in, with nothing third-party loading before a grant.
- Data requests logged with their arrival date and tracked against the statutory deadline.
- A monthly operations record you can hand to a customer, an insurer or a funder.
What stays yours
- Your information security program under the Safeguards Rule, which covers far more than the website.
- What your regulator requires in advertising, and confirming the identifiers on the site are current.
- Any decision about whether a particular form should collect a given field at all.
WebSpark describes obligations and evidences what a site does. It does not provide legal advice, and this page is not a substitute for a lawyer who knows your business and your state.