The 2019 Do Not Draft List marked a significant moment in consumer privacy, outlining which financial institutions were required to provide opt-out notices under the Gramm-Leach-Bliley Act.
This resource helps readers understand the scope of the list, how it shaped data sharing choices in that year, and what it meant for personal financial control.
| Year | Regulation Reference | Opt-Out Deadline | Scope of Covered Institutions |
|---|---|---|---|
| 2019 | 16 CFR § 681.3 | July 1, 2019 renewal cycle | Banks, credit unions, securities firms sharing nonpublic personal information |
| 2018 | 16 CFR § 681.3 | Annual renewal required | Expanded to include affiliates for marketing purposes |
| 2020 | 16 CFR § 681.3 | Shorter 30-day notice for changes | Increased emphasis on joint marketing opt-outs |
| 2021 | Policy interpretations | Electronic delivery accepted | Third-party service provider disclosures clarified |
Legal Basis and Compliance Requirements for Do Not Draft 2019
Under Regulation P, financial institutions had to honor the 2019 do not draft obligations by providing clear opt-out mechanisms before sharing nonpublic personal information for joint marketing.
Compliance meant maintaining documented procedures, training staff, and ensuring that customers could exercise choices within the prescribed timeframes.
Impact on Consumer Data Sharing in Financial Services
The list influenced how institutions designed privacy notices and consent flows, pushing more transparent disclosures about information sharing practices.
Consumers gained more control over which affiliates could receive their data for marketing, reshaping direct mail and telemarketing campaigns in the sector.
Operational Changes for Financial Institutions in 2019
Many organizations updated their systems to capture customer preferences reliably and to track deadlines for honoring opt-out requests.
These changes affected marketing budgets, vendor selection, and the timing of campaigns tied to the do not draft list requirements.
Customer Rights and Opt-Out Procedures
Individuals could submit opt-out requests in writing or electronically, with institutions required to acknowledge receipt and act within stipulated periods.
Institutions also had to explain how customers could change preferences over time, supporting ongoing control over information use.
Key Takeaways and Recommended Actions
- Understand the 2019 regulatory timeline for joint marketing opt-outs under Regulation P.
- Implement clear customer communication channels for opt-out requests and preference changes.
- Maintain accurate records of consent and delivery confirmations for audit purposes.
- Coordinate marketing plans with compliance deadlines to avoid operational disruptions.
FAQ
Reader questions
What triggers the do not draft notice requirement for 2019?
Sharing nonpublic personal information with unaffiliated third parties for marketing purposes triggers the requirement to provide an opt-out notice before the first such sharing occurs.
Can institutions rely on electronic delivery for the 2019 opt-out notice?
Yes, electronic delivery is permitted if the customer has consented to receiving disclosures electronically and the institution maintains the required records of consent.
How should institutions handle joint marketing opt-outs under the 2019 list? What happens if a financial institution fails to honor a 2019 do not draft request?
Failure to honor a valid opt-out request can result in regulatory enforcement actions, civil penalties, and reputational damage to the institution.