Regulation P: Consumer vs. Customer

The Gramm-Leach-Bliley Act privacy rules use “consumer” and “customer” as separate terms. An individual who applies for a mortgage may be a consumer even if the loan never closes. A customer usually has an ongoing relationship with the institution, such as an established loan account. The exact status depends on the product and Regulation P’s definitions.

Consumer: obtaining a financial product

A consumer is generally an individual who obtains or has obtained a financial product or service from a financial institution for personal, family, or household purposes, or whose information the institution obtains in connection with providing a financial product or service. Regulation P includes detailed examples and exclusions. A company acting in a business capacity is not itself an individual consumer under this definition.

Customer: a continuing relationship

A customer is a consumer who has a customer relationship with the institution. For a lender, an individual who receives a mortgage may become a customer because the institution maintains the loan relationship. A one-time transaction can make someone a consumer without creating the continuing relationship that defines customer status; exceptions and product-specific examples can change the result.

Why the distinction affects notices

Regulation P generally requires a financial institution to provide an initial privacy notice to customers when the relationship is established, subject to timing exceptions, and to provide an annual notice unless an exception applies. A consumer who does not become a customer may not receive the same recurring notices, but the institution still must apply other privacy rules, including limits on disclosure and any required opt-out opportunity for certain sharing with nonaffiliated third parties.

Apply the terms to the fact pattern

1. Identify the individual and the financial product or service.
2. Determine whether the purpose is personal, family, or household, and whether an exclusion applies.
3. Ask whether the individual has an ongoing relationship with the institution or only a one-time interaction.
4. Apply the correct notice and information-sharing rule; do not assume “consumer” and “customer” are interchangeable.

Key takeaway

Every customer is a consumer, but not every consumer is a customer. Consumer status is broader; customer status adds a continuing relationship and often triggers recurring privacy-notice duties.

Consumer is the broader term

Regulation P generally defines a consumer as an individual who obtains or has obtained a financial product or service for personal, family, or household purposes, or whose nonpublic personal information is obtained in connection with a financial product or service. A mortgage applicant may be a consumer even if the application is denied or never closes, depending on the facts and rule.

Customer adds a continuing relationship

A customer is a consumer with a customer relationship: a continuing relationship in which the institution provides one or more financial products or services. A person who receives and maintains a mortgage with a lender may be a customer. Certain one-time transactions can create consumer status without the continuing relationship. Apply the examples in §1016.3 to the exact product and institution.

Why the distinction affects notices

Regulation P generally requires an initial privacy notice to customers at specified times and annual notices to customers unless an exception applies. Some institutions that meet the rule’s conditions—such as not sharing information in ways that trigger opt-out rights and not changing policies—may not need to send an annual notice. Consumer status alone does not automatically create the same recurring notice schedule.

Other privacy duties still matter

Not being a customer does not mean the institution can freely disclose information. Regulation P’s disclosure limits, exceptions, and opt-out provisions may apply to consumers. A creditor must identify what information is shared, with whom, under which exception, and whether the consumer can opt out. Notice timing and sharing rules are related but distinct.

Example: application denied

An individual applies for a mortgage and the creditor obtains a consumer report and application data, but the loan is denied and no ongoing account is established. The applicant may be a consumer for privacy purposes without becoming a customer for annual-notice analysis. The institution still must apply relevant information-sharing restrictions and notice rules.

Example: mortgage account opened

A borrower closes and the institution maintains the mortgage relationship. The borrower generally becomes a customer. Determine the initial privacy-notice timing and whether annual notice requirements or an exception apply. If servicing is transferred, identify which institution has the relationship and what data may be disclosed under the applicable rules.

Annual notice exception is separate from customer status

A person can be a customer and still fall within an exception to annual privacy notices if the institution meets Regulation P’s conditions. The institution should verify its sharing practices and policy changes against §1016.5(e). Do not tell a customer no notice is needed solely because the account is a mortgage or because notices are inconvenient.

Use the institution relationship, not just the account name

The definition asks whether the financial institution has a continuing relationship with the consumer. If a servicer, originator, or affiliate is involved, determine which legal entity provides the product or service and whose privacy notice applies. One brand may include multiple institutions with separate roles.

Additional compliance detail

When there are multiple affiliated entities, do not assume a customer relationship with one automatically creates the same relationship with every affiliate. Regulation P contains rules for affiliated institutions and service providers. Identify the entity that provides the product and review the applicable notice and information-sharing framework.