← GLBA · Privacy Rule (Reg P)
Reg P 1016.7-1016.10 — Opt-out of sharing with nonaffiliated third parties
Requirement
Before disclosing nonpublic personal information to a nonaffiliated third party outside the statutory exceptions, the institution gives the consumer notice and a reasonable opportunity to opt out (for example 30 days and a toll-free number or online form), and honours opt-outs promptly.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| CCPA/CPRA | 1798.120 | Right to opt out of sale and sharing | opt-out-of-sale consent |
| CCPA/CPRA | Regs 7025 | Honour opt-out preference signals (Global Privacy Control) | opt-out-of-sale consent |
| COPPA | 312.5(a)(2) | Separate consent before disclosing children's data to third parties | consent third-party |
| GDPR | Art.6 | Lawful basis for processing | consent |
| GDPR | Art.7 | Conditions for consent | consent |
| GDPR | Art.8 | Conditions for a child's consent to online services | consent |
| GDPR | Art.14 | Information when data is not obtained from the data subject | third-party |
| GDPR | Art.19 | Notifying recipients of rectification, erasure or restriction | third-party |