This is general information about federal privacy law, not advice about your specific circumstances. Statutes and regulations change; for guidance on your own situation, consult a licensed attorney.
If you searched for a "15 U.S.C. § 6802 dispute letter," here is the short answer: that letter does not exist as a legal mechanism. Section 6802 of the Gramm-Leach-Bliley Act creates no dispute, correction, deletion, or investigation right — it is a rule about when a financial institution may share your information, and the consumer-facing lever it hands you is an opt-out, not a dispute. Below is what § 6802 actually says, how to exercise the right it does give you, and which statute to use if what you really need is a correction.
Is there such a thing as a 15 U.S.C. § 6802 dispute letter?
No. 15 U.S.C. § 6802 is titled "Obligations with respect to disclosures of personal information." Read it end to end and there is no procedure for disputing a fact, demanding an investigation, forcing a correction, or requesting deletion — and no deadline for a company to answer one. The section's core rule is a bar on disclosure: under § 6802(a), a financial institution may not disclose nonpublic personal information to a nonaffiliated third party "unless such financial institution provides or has provided to the consumer a notice that complies with section 6803." Congress framed the statute's purpose the same way in § 6801(a), declaring that "each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information." That is a duty about handling and sharing — not a consumer dispute channel.
What right does § 6802 actually give you?
An opt-out. § 6802(b)(1) sets three conditions an institution must satisfy before sharing with a nonaffiliated third party: it must (A) "clearly and conspicuously disclose[] to the consumer, in writing or in electronic form" that the information may be disclosed; (B) give the consumer "the opportunity, before the time that such information is initially disclosed, to direct that such information not be disclosed"; and (C) provide "an explanation of how the consumer can exercise that nondisclosure option." One prohibition in the section is absolute and requires no opt-out at all: § 6802(d) bars disclosing account numbers or access codes "to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail." Section 6802(c) also limits downstream reuse — a recipient may not pass the information along to another nonaffiliated third party unless the original institution could have done so directly.
How do you exercise the opt-out — and can the bank force you to write a letter?
You can opt out at any time, and the bank cannot make a self-drafted letter your only route. 12 C.F.R. § 1016.7(h) says "a consumer may exercise the right to opt out at any time" — it is not a window that closes after account opening. Regulation P lists reasonable opt-out methods including check-off boxes in a prominent position, a reply form that includes the address to which it should be mailed, an electronic form or website process, or a toll-free telephone number (12 C.F.R. § 1016.7(a)(2)(ii)). And the rule expressly says it is not a reasonable means if "[t]he only means of opting out is for the consumer to write his or her own letter to exercise that opt out right" (§ 1016.7(a)(2)(iii)). Two more mechanics worth knowing: the election does not expire — under § 1016.7(i) it "is effective until the consumer revokes it in writing or, if the consumer agrees, electronically" — and under 12 C.F.R. § 1016.10(c), an institution may allow a partial opt out, letting you select particular categories of information or particular nonaffiliated third parties.
How long does the institution have to honor it?
There is no fixed day-count deadline. 12 C.F.R. § 1016.7(g) requires only that the institution "comply with a consumer's opt out direction as soon as reasonably practicable after you receive it." The 30 days that shows up in Regulation P runs the other direction: § 1016.10(a)(3) illustrates a "reasonable opportunity to opt out" as the consumer being able to opt out by mailing a form, calling a toll-free number, or other reasonable means within 30 days of a mailed notice, or within 30 days after electronic acknowledgment. That is your window, not the company's response clock — do not repurpose it.
What does the opt-out not cover?
More than most people expect. Four carve-outs do nearly all of the work:
- Affiliates are outside it entirely. 15 U.S.C. § 6809(5) defines a "nonaffiliated third party" as an entity "not an affiliate of, or related by common ownership or affiliated by corporate control with, the financial institution." Sharing inside the corporate family is not what § 6802 reaches.
- Service providers and joint marketers are carved out. § 6802(b)(2) and 12 C.F.R. § 1016.13 permit sharing with a third party performing services on the institution's behalf where the institution disclosed the arrangement and has a contract prohibiting the third party from using the information for anything but the disclosed purpose; those services "may include marketing of your own products or services or marketing of financial products or services offered pursuant to joint agreements."
- Eight statutory exceptions are never subject to the notice-and-opt-out rules. § 6802(e) lists them: transactions the consumer requested or authorized; sharing with consent; fraud prevention and dispute resolution; the institution's attorneys, accountants, and auditors; law enforcement and regulators; reporting to a consumer reporting agency under FCRA; a sale or merger of the business; and compliance with law or legal process. 12 C.F.R. § 1016.14 and § 1016.15(a) together carry the same list on the regulatory side.
- Business accounts are outside the coverage line. § 6809(9) defines a "consumer" as an individual obtaining products or services "primarily for personal, family, or household purposes," so business accounts are outside the GLBA privacy notice and opt-out rules.
Can you sue your bank under § 6802?
No. The Congressional Research Service states flatly that "GLBA does not contain a private right of action that would allow affected individuals to sue violators," and that GLBA "does not specify any civil remedies for violations of the Act" (CRS, Data Protection Law: An Overview, R45631, at 10). 15 U.S.C. § 6805(a) assigns enforcement to the federal banking agencies, the NCUA, the SEC, state insurance authorities, the FTC, and the CFPB — nowhere to a private plaintiff. The practical escalation is a regulator complaint: the CFPB says it forwards your complaint directly to the company, that most companies respond within 15 days, and that where a response is still in progress the company provides a final response within 60 days.
What about the annual privacy notice you stopped receiving?
Not getting one is not automatically a violation. 15 U.S.C. § 6803(a) requires a clear and conspicuous privacy disclosure at the time a customer relationship is established and "not less than annually" after that, and 12 C.F.R. § 1016.5(a)(2) defines "annually" as at least once in any 12 consecutive months. But since the FAST Act, § 6803(f) and § 1016.5(e)(1) excuse the annual notice where the institution shares only under the standard exceptions and has "not changed [its] policies and practices." If the exception stops applying because policies changed, the annual notice must go out with the opt out notice the institution is then required to send (12 C.F.R. § 1016.5(e)(2)(i)) or, where no opt out notice is required, within 100 days of the change (§ 1016.5(e)(2)(ii)). Delivery still has teeth: under 12 C.F.R. § 1016.9, notices must reach each consumer so they "can reasonably be expected to receive actual notice in writing" — a sign in a branch or an advertisement is not enough, and "[y]ou may not provide any notice required by this part solely by orally explaining the notice."
If § 6802 is the wrong statute, which one do you need?
Match the problem to the law that actually carries a procedure. If the real issue is inaccurate information on a credit report, that is FCRA: 15 U.S.C. § 1681i requires a consumer reporting agency to reinvestigate before the end of the 30-day period beginning when it receives your notice (extendable by 15 days), delete inaccurate or unverifiable items, and notify you of the results not later than 5 business days after completion. If the issue is affiliate marketing, the hook is 15 U.S.C. § 1681a(d)(2)(A)(iii) plus 15 U.S.C. § 1681s-3, which conditions an affiliate's use of shared information for marketing on notice and a simple method of opting out — and under § 1681s-3(a)(3)(A) that election "shall be effective for at least 5 years." A prescreen opt-out made through the consumer reporting agencies' notification system is effective for the 5-year period beginning 5 business days after the election (15 U.S.C. § 1681b(e)(4)(B)(i)), while an election made on the signed notice of election form continues until the consumer revokes it (§ 1681b(e)(4)(B)(ii)–(C)). And state law may be stronger — 15 U.S.C. § 6807 provides that GLBA does not supersede a state statute affording greater protection, so the state where you bank can impose tighter limits than § 6802 does. California's financial-privacy rules are codified at Cal. Fin. Code § 4053; read that section's text directly before assuming the federal opt-out is the only lever you have.
Write the letter that matches the right, not the search term
Nothing in § 6802 requires certified mail, a notarized signature, or any "magic language," so a clear dated letter stating the direction you are giving works — but send it as an opt-out direction under § 6802(b)(1)(B), not as a "dispute," and use the bank's own opt-out channel alongside it, since 12 C.F.R. § 1016.7(a)(2) requires the institution to offer one and forbids making your own letter the only route.
You arrived looking for a § 6802 dispute letter. Our free letter-template library will not give you one — that instrument does not exist — but it will give you the letter that does carry a procedure. If the real problem turns out to be inaccurate information on your credit report rather than sharing, start with the credit report dispute letter, which is built on the 15 U.S.C. § 1681i reinvestigation clock instead of a statute that has no clock at all.
One footnote worth knowing: GLBA does carry criminal teeth, just not for you to wield. Obtaining another person's financial-institution customer information by false pretenses is a federal crime under 15 U.S.C. §§ 6821 and 6823, punishable by fine "or imprisoned for not more than 5 years, or both" — rising to 10 years where the violation involves another federal crime or a pattern of illegal activity exceeding $100,000 in a 12-month period.
Frequently asked questions
Is there such a thing as a 15 U.S.C. § 6802 dispute letter? No. Section 6802 is titled "Obligations with respect to disclosures of personal information" and contains no dispute, correction, deletion, or investigation procedure. What it gives you is an opt-out right against sharing with nonaffiliated third parties.
How long does a bank have to honor my GLBA opt-out? There is no fixed deadline — 12 C.F.R. § 1016.7(g) requires only that the institution comply "as soon as reasonably practicable" after receiving it. The 30 days in § 1016.10(a)(3) is the consumer's opportunity window, not the company's response clock.
Can I sue my bank under 15 U.S.C. § 6802? No. CRS states that GLBA "does not contain a private right of action that would allow affected individuals to sue violators" (R45631, at 10), and 15 U.S.C. § 6805(a) assigns enforcement to federal and state regulators.
Does opting out stop my bank from sharing my data with its affiliates? No. The opt-out reaches only nonaffiliated third parties, defined at 15 U.S.C. § 6809(5) as entities not related by common ownership or corporate control. Affiliate sharing runs through FCRA, at 15 U.S.C. § 1681a(d)(2)(A)(iii).
My bank says the only way to opt out is to write my own letter. Is that allowed? No. 12 C.F.R. § 1016.7(a)(2)(iii) says it is not a reasonable opt-out means if the only method is for the consumer to write his or her own letter; the institution must also offer a check-off box, reply form, website process, or toll-free number.
Does a GLBA opt-out expire? No. Under 12 C.F.R. § 1016.7(i), the direction "is effective until the consumer revokes it in writing or, if the consumer agrees, electronically" — and under § 1016.7(h) you may exercise it at any time.