A) To the Creditor/Collector/Furnisher (Primary Letter)
[Your Full Name]
[Your Current Address]
[City, State ZIP]
[Email] | [Phone]
[Date]
[Creditor/Collector/Furnisher Name]
[Attn: Compliance/Privacy Office]
[Mailing Address]
[City, State ZIP]
RE: Privacy & Disclosure Demand under the Gramm–Leach–Bliley Act (15 U.S.C. §§ 6801–6802)
Account: [Account Number/Reference] | Last 4 SSN: [XXXX]
To Whom It May Concern:
I am asserting my rights under the Gramm–Leach–Bliley Act (GLBA), 15 U.S.C. §§ 6801–6802, and applicable privacy regulations. This is a formal demand regarding your collection, use, and disclosure of my nonpublic personal information (NPI).
1) REQUIRED WRITTEN ATTESTATION OF COMPLIANCE
Provide a written certification within 30 days that:
• You maintain and enforce information-security standards as required by 15 U.S.C. §6801(b) and the Safeguards Rule; and
• Any sharing/disclosure of my NPI complies with 15 U.S.C. §6802, including notice, permissible purpose, and opt-out where applicable.
2) FULL ACCOUNTING OF DISCLOSURES
Provide a complete list (dates, recipients, and purposes) of all disclosures of my NPI in the last 24 months, including to consumer reporting agencies, affiliates, service providers, and any third parties. Identify the statutory or contractual basis for each disclosure.
3) OPT-OUT / CEASE NON-ESSENTIAL SHARING
Effective immediately, I **opt out** of any non-affiliated third-party sharing that is not strictly required by law or to service/maintain the account. Cease any marketing or ancillary sharing under 15 U.S.C. §6802(b)–(c) except as legally mandated.
4) VERIFICATION OF PERMISSIBLE PURPOSE
If you are furnishing or have furnished information about me to any consumer reporting agency, identify the asserted permissible purpose(s) and the specific contractual or statutory authority relied upon.
5) DATA MINIMIZATION & CORRECTION
If you maintain inaccurate or unnecessary NPI (including outdated personal identifiers, prior addresses, or employer data), restrict use and correct/delete such data. Confirm corrections in writing.
NOTICE: Failure to provide the above, or any continued non-compliant sharing of my NPI, may result in complaints to the CFPB, FTC, state AG, and any relevant prudential regulator. This letter is not a refusal to pay; it is a good-faith privacy and compliance demand.
Please respond in writing to the address above within 30 days of receipt.
Sincerely,
[Your Signature]
[Your Printed Name]
Enclosures: [Copy of ID, recent proof of address]
B) FYI Copy to the Credit Bureaus (Optional “Record & Restrict” Notice)
Send the same day to Experian, Equifax, TransUnion. This isn’t a dispute—it’s a privacy notice so the CRAs are aware of your opt-out stance and can log it.
[Your Full Name]
[Your Current Address]
[City, State ZIP]
[Email] | [Phone]
[Date]
[CRA Name: Experian/Equifax/TransUnion]
[CRA Mailing Address]
RE: Consumer Privacy Notice – GLBA Acknowledgment and Record Notation
To Whom It May Concern:
This is to place your agency on notice that I have issued a GLBA privacy and disclosure demand and opt-out notice to [Furnisher Name] concerning my nonpublic personal information (NPI). Please notate my file that I object to any non-essential sharing of my NPI and request that you apply data-minimization and accuracy safeguards consistent with the FCRA and GLBA framework.
This letter is not a dispute of specific tradelines (though I reserve all rights); it is a privacy notice. Please confirm receipt.
Sincerely,
[Your Signature]
[Your Printed Name]
When & How to Use These
- Use with any creditor/collector/furnisher that’s sharing your data beyond what’s necessary to service the account, or where you want a paper trail of their GLBA compliance.
- Mailing: Certified Mail + Return Receipt. Keep copies of everything.
- Enclosures: Clear ID + recent proof of address to prevent “can’t locate consumer” excuses.
- Follow-up: If ignored or non-responsive after ~30 days, file a CFPB complaint referencing GLBA §§6801–6802 and attach your letter + proof of delivery.
Pro Tips (keep your leverage)
- Pair this with your FCRA disputes (609/611 to bureaus; 623 to furnisher) if there are inaccuracies. The GLBA angle pressures their compliance teams while your FCRA letters attack accuracy/verifiability.
- In responses, look for: vague boilerplate, no disclosure log, or refusal to identify recipients. Those gaps strengthen escalation.
I’m