---
title: "12 CFR 1016.8 GLBA: Revised privacy notices"
canonical: "https://dposchool.com/glba/section/1016.8"
source: "https://www.ecfr.gov/current/title-12/section-1016.8"
source_note: "Source: United States Code, title 15, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 12, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR."
text_as_of: "2026-10-29"
language: "en"
publisher: "DPO School"
---

12 CFR 1016.8 GLBA · Part 1016: PRIVACY OF CONSUMER FINANCIAL INFORMATION (REGULATION P) · Subpart A: Privacy and Opt Out Notices

# 12 CFR 1016.8 GLBA: Revised privacy notices

eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.

## Official text

### 12 CFR 1016.8(a)

**(a)** General rule. Except as otherwise authorized in this part, you must not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party other than as described in the initial notice that you provided to that consumer under § 1016.4 of this part, unless:

#### 12 CFR 1016.8(a)(1)

**(1)** You have provided to the consumer a clear and conspicuous revised notice that accurately describes your policies and practices;

#### 12 CFR 1016.8(a)(2)

**(2)** You have provided to the consumer a new opt out notice;

#### 12 CFR 1016.8(a)(3)

**(3)** You have given the consumer a reasonable opportunity, before you disclose the information to the nonaffiliated third party, to opt out of the disclosure; and

#### 12 CFR 1016.8(a)(4)

**(4)** The consumer does not opt out.

### 12 CFR 1016.8(b)

**(b)** Examples. (1) Except as otherwise permitted by §§ 1016.13, 1016.14, and 1016.15 of this part, you must provide a revised notice before you:

##### 12 CFR 1016.8(b)(i)

**(i)** Disclose a new category of nonpublic personal information to any nonaffiliated third party;

##### 12 CFR 1016.8(b)(ii)

**(ii)** Disclose nonpublic personal information to a new category of nonaffiliated third party; or

##### 12 CFR 1016.8(b)(iii)

**(iii)** Disclose nonpublic personal information about a former customer to a nonaffiliated third party, if that former customer has not had the opportunity to exercise an opt out right regarding that disclosure.

#### 12 CFR 1016.8(b)(2)

**(2)** A revised notice is not required if you disclose nonpublic personal information to a new nonaffiliated third party that you adequately described in your prior notice.

### 12 CFR 1016.8(c)

**(c)** Delivery. When you are required to deliver a revised privacy notice by this section, you must deliver it according to § 1016.9 of this part.

## Source

Source: Electronic Code of Federal Regulations (eCFR), title 12, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR.

[12 CFR 1016.8 on eCFR](https://www.ecfr.gov/current/title-12/section-1016.8)

eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026.

This is reference material, not legal advice.

## Navigation

[GLBA Navigator](https://dposchool.com/glba) / 12 CFR 1016.8

Previous: [12 CFR 1016.7 GLBA: Form of opt out notice to consumers; opt out methods](https://dposchool.com/glba/section/1016.7)

Next: [12 CFR 1016.9 GLBA: Delivering privacy and opt out notices](https://dposchool.com/glba/section/1016.9)

## For AI agents

- Machine-readable index: https://dposchool.com/glba/llms.txt
- JSON API: https://dposchool.com/glba/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents