We recently acquired some affiliates and had to update our privacy notice. Our notice permits customers to opt-out of information sharing by calling a toll-free number. Can we also accept opt-outs on our website or in person, even though those methods are not listed in our privacy notice?

Yes, we believe that you may accept opt-outs by any method, even if those methods are not listed in your privacy notice.

Regulation P requires financial institutions to provide and disclose to customers “a reasonable means” to opt out of information sharing, and Regulation V requires “a reasonable and simple method to opt out.” Neither regulation limits financial institutions from accepting opt outs by other means if they so choose. Financial institutions are permitted to “choose not to honor opt out elections communicated to the institution through alternative means,” but this is not required.

For resources related to our guidance, please see:

Regulation P, 12 CFR 1016.7(a)(1) (“Form of opt out notice. If you are required to provide an opt out notice under § 1016.10(a), you must provide a clear and conspicuous notice to each of your consumers that accurately explains the right to opt out under that section. The notice must state: . . . (iii) A reasonable means by which the consumer may exercise the opt out right.”)
Regulation P, 12 CFR 1016.7(a)(2)(ii)(“You provide a reasonable means to exercise an opt out right if you: (A) Designate check-off boxes in a prominent position on the relevant forms with the opt out notice; (B) Include a reply form together with the opt out notice that, in the case of financial institutions described in § 1016.3(l)(3) of this part, includes the address to which the form should be mailed; (C) Provide an electronic means to opt out, such as a form that can be sent via electronic mail or a process at your Web site, if the consumer agrees to the electronic delivery of information; or (D) Provide a toll-free telephone number that consumers may call to opt out.”)
Regulation V, 12 CFR 1022.25(a)(1) (“A notice must be clear, conspicuous, and concise, and must accurately disclose: . . . (vii) A reasonable and simple method for the consumer to opt out. ”)
Regulation V, 12 CFR 1022.25(b) (“Reasonable and simple methods for exercising the opt-out right include: (i) Designating a check-off box in a prominent position on the opt-out form; (ii) Including a reply form and a self-addressed envelope together with the opt-out notice; (iii) Providing an electronic means to opt out, such as a form that can be electronically mailed or processed at a Web site, if the consumer agrees to the electronic delivery of information; (iv) Providing a toll-free telephone number that consumers may call to opt out; or (v) Allowing consumers to exercise all of their opt-out rights described in a consolidated opt-out notice that includes the privacy opt-out under the Gramm-Leach-Bliley Act, 15 U.S.C. 6801et seq., the affiliate sharing opt-out under the Act, and the affiliate marketing opt-out under the Act, by a single method, such as by calling a single toll-free telephone number.”)
Final Rule, Regulation P, Supplementary Information, 65 Fed. Reg. 35161, 35177 (June 1, 2000) (“Another issue addressed by many commenters concerned the means by which consumers may opt out. Several suggested that a financial institution, after having provided reasonable means of opting out, should be able to require consumers to use those means exclusively. The Agencies agree with this suggestion, recognizing that a financial institution may not have trained personnel or systems in place to handle opt out elections at each point of contact between a consumer and financial institution. Assuming a financial institution offers one or more of the opt out means provided in the examples in the final rule or a means of opting out that is comparably convenient for a consumer, the institution may require consumers to opt out in accordance with those means and choose not to honor opt out elections communicated to the institution through alternative means.”)