The Gramm-Leach-Bliley Act and Skip Tracing
Almost everything written about this statute and locating people gets the first thing wrong, and the mistake is structural rather than careless. The GLBA’s privacy provisions are addressed to financial institutions. They tell a bank what it may not disclose. They do not hand a requester a key. So the phrase you will see advertised – a GLBA permissible purpose – is a phrase the statute never uses; permissible purpose is the architecture of a different Act entirely, the Fair Credit Reporting Act, regulating a different product. What the GLBA does put on a requester is a prohibition, at 15 U.S.C. 6821, and that prohibition comes with a countable set of carve-outs. There are five, we counted them in the enacted text, and exactly one of them is available to a private party – a state-licensed private investigator, collecting an adjudicated child support debt, under a court order. We are not that, and this page explains why that matters more than any promise about accuracy. We research public records and lawfully licensed data under a purpose the law permits. General information, not legal advice.
Read the First Sentence: The Duty Is the Bank’s
Everything downstream follows from noticing who the statute is talking to.
Subchapter I of chapter 94 opens by saying whose obligation this is. 15 U.S.C. 6801(a) states that it is the policy of Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of their nonpublic personal information. Not each data broker. Not each person who asks. The institution.
That framing runs through the whole of the privacy title. Section 6802(a) says a financial institution may not disclose nonpublic personal information to a nonaffiliated third party without notice. Section 6802(b) says it may not disclose without an opt-out opportunity. Section 6802(c) limits what a third party who lawfully received such information may do with it next. Every operative verb has a bank, an insurer or a broker-dealer as its subject.
Why that matters commercially, not just doctrinally
Because it determines what a vendor can honestly sell you. A firm that tells you it holds a GLBA permissible purpose is describing a status the statute does not create. What actually exists is a chain: an institution may disclose within one of the exceptions; a recipient is then bound by 6802(c) on reuse; a licensed data supplier operates under its own contractual and statutory obligations and requires its subscribers to certify a use. When lawful data reaches this firm it reaches it through that chain and under those supplier obligations. It does not reach us because a statute granted us a right, and we do not describe it that way.
The practical test you can run on any vendor takes one question: ask them to name the subsection they are relying on. A statutory entitlement has a number. If the answer comes back as a phrase rather than a citation, the phrase is marketing.
The Eight Exceptions, and Who Each One Is For
Counted from the enacted subdivisions rather than from anyone’s summary.
Section 6802(e) is headed “General exceptions” and it contains eight paragraphs, (e)(1) through (e)(8). We counted the enacted subdivisions rather than repeating a figure, and the lettering is given here so it can be checked in a minute.
- (e)(1) – as necessary to effect, administer or enforce a transaction the consumer requested or authorised, with sub-cases (A) servicing or processing the product, (B) maintaining or servicing the account, and (C) a securitisation or secondary-market sale.
- (e)(2) – with the consumer’s consent or at the consumer’s direction.
- (e)(3) – five sub-cases: (A) protecting the confidentiality or security of records, (B) preventing actual or potential fraud, unauthorised transactions, claims or other liability, (C) required institutional risk control or resolving customer disputes, (D) persons holding a legal or beneficial interest relating to the consumer, and (E) persons acting in a fiduciary or representative capacity for the consumer.
- (e)(4) – insurance rate advisory organisations, guaranty funds, rating agencies, standards assessors, and the institution’s own attorneys, accountants and auditors.
- (e)(5) – law enforcement agencies, including the Bureau of Consumer Financial Protection, a Federal functional regulator, the Secretary of the Treasury, a State insurance authority or the Federal Trade Commission; self-regulatory organizations; or an investigation on a matter related to public safety – in accordance with the Right to Financial Privacy Act of 1978.
- (e)(6) – to a consumer reporting agency under the Fair Credit Reporting Act, or from a consumer report.
- (e)(7) – a proposed or actual sale, merger, transfer or exchange of a business or operating unit.
- (e)(8) – compliance with law; a properly authorised civil, criminal or regulatory investigation, subpoena or summons; or responding to judicial process or a regulator with jurisdiction over the institution.
The pattern, once you have them side by side
Not one of the eight describes a private locate. The two that get quoted at people are (e)(3)(D), persons holding a legal or beneficial interest relating to the consumer, and (e)(8), legal process. Both are real and neither is a locating tool. (e)(3)(D) is about who the institution may talk to about its own customer’s account – a lienholder, a co-obligor, a beneficiary – and it is permission for the bank, not a right of enquiry. (e)(8) is a subpoena, which is issued by a court or an authorised authority, obtained by a lawyer, and served on the institution. That is the honest answer to “how do people get bank information lawfully”: through process, or not at all. Where a matter genuinely calls for that route, it belongs with counsel, and what we can lawfully do alongside it is set out in our note on what a lawful bank account search can and cannot reach – recorded and filed instruments, not account contents.
The 2010 amendment, and why it tells you this is a live statute
Section 6802 was enacted as section 502 of Public Law 106-102 on 12 November 1999 and appears at 113 Stat. 1437. It was amended once since, by section 1093(2) of the Dodd-Frank Act on 21 July 2010, which inserted the Bureau of Consumer Financial Protection into the list in (e)(5). A single surgical amendment in a quarter of a century is worth knowing when you meet a page confidently describing what the GLBA has “recently changed” about locating people.
The Short Version
The GLBA restrains banks from disclosing and restrains everyone from deceiving; it grants nobody a right to obtain. Section 6801(a) puts an affirmative and continuing obligation on the financial institution. Section 6802(e) then lists eight general exceptions to that institution’s disclosure prohibition – and every one of the eight is addressed to what the institution may do, not to what a requester may demand. Separately, section 6821 makes it a violation for any person to obtain customer information of a financial institution about someone else through a false statement to the institution, a false statement to its customer, or a forged or fraudulently obtained document – and it is equally a violation to ask somebody else to do it for you. Section 6823 backs that with up to five years, and up to ten where the conduct accompanies another federal offence or a pattern of illegal activity involving more than $100,000 in a twelve-month period. The statute contains five non-applicability subsections and exactly one of them reaches a private party: a state-licensed private investigator, collecting child support adjudicated by a court, under a court order. We are not licensed private investigators and we make no claim to that carve-out. We work public records and lawfully licensed data under a purpose the law permits, never by pretexting, and we are not a consumer reporting agency – nothing we produce is a consumer report. This page is general information, not legal advice.
What This Means at Our Intake Desk
Four things that happen before a search runs, all of them downstream of the sections above.
The Purpose Gets Written Down
One sentence, before anything is opened, naming the matter and the interest behind it. Not because a form demands it, but because every lawful source downstream conditions access on it and a purpose invented later is not a purpose.
The Request Gets Scoped Against the Statute
If what is actually wanted is an account balance, an account number, a transaction history or a bank’s internal customer record, the answer is no, and it is no at intake rather than after the invoice. Section 6827 defines customer information broadly – any information maintained by or for the institution, derived from the relationship, identified with the customer.
Sources Are Chosen for What They Permit
Recorded instruments, court files, and licensed data used within the supplier’s own certification. No route that depends on somebody at an institution believing we are someone else, and no route that depends on asking a third party to do that for us.
The Report Names Its Sources
Each finding carries the record and the date behind it, so the file can be checked by somebody who did not run it. Our note on how to verify a skip tracing report sets out what that looks like from the buyer’s side.
Watch: Who the Statute Binds
The bank’s duty, the requester’s prohibition, and the gap people fall into.
Watch Overview
Section 6821 Prohibits Two Things, Not One
The second one is the reason a client cannot lawfully commission what we cannot lawfully do.
Section 6821(a) makes it a violation for any person to obtain, attempt to obtain, or cause to be disclosed, customer information of a financial institution relating to another person by three routes, which the statute lists as (1), (2) and (3):
- by making a false, fictitious or fraudulent statement or representation to an officer, employee or agent of a financial institution;
- by making a false, fictitious or fraudulent statement or representation to a customer of a financial institution;
- by providing any document to an officer, employee or agent of the institution knowing that the document is forged, counterfeit, lost or stolen, was fraudulently obtained, or contains a false statement.
Route (2) is the one that surprises people. Deceiving the account holder – the person whose information it is – is a violation in exactly the same terms as deceiving the bank. So a call to a subject pretending to be a delivery service, an old classmate or a benefits administrator is not a clever workaround. It is the same offence wearing a different costume.
Asking is itself the violation
Then subsection (b), which is the part that transfers risk to whoever commissions the work: it is a violation of the subchapter to request a person to obtain customer information of a financial institution, knowing that the person will obtain or attempt to obtain it in any manner described in subsection (a). Read that against the way locate work is bought. A creditor who tells a vendor to get the bank details “however you have to” is not insulated by the vendor’s conduct; the request is its own violation. This is why a firm declining a request at intake is doing the client a service and not being difficult, and it is the concrete mechanism behind the exposure described on our page about avoiding liability in skip tracing.
What “customer information” and “document” actually mean
Section 6827 defines the terms, and both definitions are wider than the intuitive reading. Customer information of a financial institution means any information maintained by or for the institution which is derived from the relationship between the institution and a customer and is identified with the customer – which reaches well past a balance to things like a current mailing address on file. Document means any information in any form. There is no paper requirement; a fabricated email or a screenshot is a document for these purposes.
The Five Carve-Outs, and Which One Could Ever Be Yours
Subsections (c) through (g) of section 6821, in order, with the one private-party route in the last row.
| Subsection | Who it exempts | On what terms |
|---|---|---|
| 6821(c) | Law enforcement agencies, and their officers, employees and agents | Acting in connection with the performance of the agency’s official duties. Not available by hiring one, and not available by working alongside one. |
| 6821(d) | The financial institution itself, and its officers, employees and agents | Three listed circumstances only: testing its own security procedures, investigating misconduct or negligence by its own people, and recovering information already taken under (a) or (b). |
| 6821(e) | An insurance institution, its officers, employees or agency | Investigating criminal activity, fraud, material misrepresentation or material nondisclosure, where that investigation is authorised for the institution under State law, regulation, interpretation or order. |
| 6821(f) | Anyone | Only for customer information that is otherwise available as a public record filed under the securities laws. A narrow window onto material already public by filing. |
| 6821(g) | A State-licensed private investigator, or that investigator’s officers, employees or agents The only private route | Three conditions stacked: reasonably necessary to collect child support from a person adjudged delinquent by a Federal or State court; not unlawful under any other Federal or State law or regulation; and authorised by an order or judgment of a court of competent jurisdiction. |
What the Last Row Means About Us, Specifically
The boundary this firm holds is not a house style. It is where subsection (g) stops.
Line the five up and the shape is unmistakable. Congress exempted the police, the bank itself, an insurer investigating fraud under state authority, and material already public through a securities filing. Then it wrote exactly one door for a private party, and it made that door narrow enough to be almost architectural: you must hold a state investigator’s licence, the debt must be child support, the delinquency must already have been adjudicated by a court, and a court must have authorised the action by order or judgment.
We do not hold that licence. This is a skip tracing and public-records research firm and not a licensed private investigation agency, so subsection (g) is not a route available to us and we do not gesture at it. Nor is it a gap in our service – it is a route into account information at a financial institution, which is not the product. What we do is locate people and research recorded and filed holdings: deeds, mortgages, liens, judgments, court files, business registrations, and lawfully licensed identity and address data used within the supplier’s own permitted-use terms. When somebody asks whether we can confirm where a person banks or what is in the account, the answer is that section 6821 is why the answer is no, and section 6821(g) is why it stays no even for the firms that could theoretically ask.
The penalty, since the ranking set never quotes it
Section 6823 is short. Knowingly and intentionally violating section 6821, or attempting to, carries a fine under title 18 or imprisonment for not more than five years, or both. Subsection (b) doubles the fine under 18 U.S.C. 3571 and raises the term to not more than ten years where the violation happens while violating another federal law, or as part of a pattern of illegal activity involving more than $100,000 in a twelve-month period. Note the word “attempts” in subsection (a): the offence does not require the information to have been obtained. The call is enough.
One more line, which is ours rather than the statute’s
Section 6821 draws a boundary around a method. We hold a second one around a purpose, and it is not written in this chapter. We decline requests whose object is to find somebody who moved in order to be safe – matters connected with domestic violence, sexual assault, stalking, trafficking, protective orders and no-contact orders – and we decline them when the pattern says so even where the stated reason sounds routine, such as a requester who will not name the interest they hold, or an unexplained urgency about a person who recently moved without leaving word. A confidential address programme, usually run out of the secretary of state’s office, exists for exactly this situation. Somebody in that position is better served by that route and by an advocate who works these cases than by anything a records firm can supply, and we would rather say so than take the money. Turning away a legitimate file is the cheaper mistake.
Six Ways This Statute Gets Misread
Each of these appears somewhere in the pages currently ranking for it.
Calling It a Permissible Purpose
That architecture belongs to the FCRA at 15 U.S.C. 1681b and governs consumer reports. The phrase does not appear in the GLBA’s privacy title.
Treating 6802(e) as a Right to Ask
Those eight exceptions tell a bank when it may disclose. Naming one does not create standing to request anything from anyone.
Thinking Pretexting Means Lying to the Bank
Route (2) of 6821(a) covers a false statement made to the institution’s customer. Deceiving the subject is the same violation.
Assuming Only the Searcher Is Exposed
Subsection (b) makes the request itself a violation where the requester knows how it will be carried out.
Reading the PI Carve-Out as General
Subsection (g) needs a state licence, an adjudicated child support delinquency and a court order, all three at once.
Believing the Statute Recently Changed
Section 6802 has been amended once since 1999, by Dodd-Frank in 2010, to add the CFPB to the list in (e)(5).
Who Asks Us About This Statute
Usually because somebody offered them something the statute does not allow.
Counsel Vetting a Vendor
Wanting the subsection cited, not the adjective
Judgment Creditors
Told a balance was obtainable, and checking
Compliance Reviewers
Documenting what a locating supplier may and may not do
Servers and Recovery Firms
Whose own request could be the violation under 6821(b)
Estate and Probate Practitioners
Where the lawful route to an account is process, not enquiry
Buyers Comparing Quotes
Where one bid promises what four others decline
What We Will Not Do, in the Statute’s Own Terms
We will not make a false statement to an officer, employee or agent of a financial institution. We will not make one to that institution’s customer. We will not present a document we know to be forged, counterfeit, lost, stolen, fraudulently obtained or false. We will not ask anybody else to do those things on a file of ours, because section 6821(b) makes the asking its own violation and because a report built that way is worthless the moment anyone examines it. We do not claim the subsection (g) carve-out, because it belongs to state-licensed private investigators collecting adjudicated child support under a court order and we are none of those things. Where the honest answer to a request is that the lawful route runs through a subpoena and a lawyer, that is the answer you get, at intake, before any work is billed. Every figure and every subsection number on this page was read in the enacted text and can be checked against it in a few minutes, which is the only kind of compliance claim worth making.
GLBA Questions
Does the Gramm-Leach-Bliley Act give a skip tracer a permissible purpose?
No, and the phrase is a category error worth unpicking because it is everywhere. Permissible purpose is the Fair Credit Reporting Act’s architecture, at 15 U.S.C. 1681b, and it governs who may receive a consumer report. The GLBA’s privacy title works the other way round: 15 U.S.C. 6801(a) places an affirmative and continuing obligation on the financial institution, and 15 U.S.C. 6802(e) lists eight exceptions to that institution’s prohibition on disclosing. Every one of the eight describes what the institution may do. None creates a status a requester can hold. If a vendor says it has a GLBA permissible purpose, ask which subsection it is relying on; a statutory entitlement has a number.
What exactly does the GLBA prohibit a skip tracer from doing?
Section 6821(a) makes it a violation for any person to obtain, attempt to obtain, or cause to be disclosed, customer information of a financial institution about another person by three named routes: a false, fictitious or fraudulent statement to an officer, employee or agent of the institution; the same to a customer of the institution; or providing a document to the institution’s people knowing it is forged, counterfeit, lost, stolen, fraudulently obtained, or contains a false statement. Section 6827 defines document as any information in any form, so there is no paper requirement. Note that the second route covers deceiving the account holder rather than the bank, which is the route people assume is a grey area.
Can you get me someone’s bank balance or account number?
No. That is customer information of a financial institution as section 6827 defines it – any information maintained by or for the institution, derived from the relationship with the customer and identified with them – and there is no lawful route by which a locating firm obtains it by asking. The lawful routes run through the institution’s own permitted disclosures under 6802(e), which include compliance with a properly authorised subpoena or judicial process at (e)(8). That is a matter for your lawyer and a court, not for a research vendor. What we can do is research what is recorded and filed – deeds, mortgages, liens, judgments, business registrations, court files – which is a different question about a different kind of asset.
Is there any exception that would let a private firm ask a bank?
One, and it is narrow enough to be worth quoting. Section 6821(g) says no provision of the section prevents a State-licensed private investigator, or that investigator’s officers, employees or agents, from obtaining customer information of a financial institution to the extent reasonably necessary to collect child support from a person adjudged delinquent by a Federal or State court, to the extent the action is not unlawful under any other Federal or State law or regulation, and where it has been authorised by an order or judgment of a court of competent jurisdiction. Three conditions stacked on a licence we do not hold. The other four non-applicability subsections cover law enforcement, the institution itself, an insurance institution investigating fraud under state authority, and information already public through a securities filing.
If I ask a vendor to get it anyway, am I exposed or are they?
Both, and this is the subsection that gets left out of the vendor explainers. Section 6821(b) makes it a violation of the subchapter to request a person to obtain customer information of a financial institution knowing that the person will obtain, or attempt to obtain, it in any of the ways described in subsection (a). The request is the violation. So a client who tells a supplier to get the details however they have to is not standing behind the supplier’s conduct; the instruction is separately unlawful. That is why a firm that declines at intake is protecting the file as well as itself, and it is the concrete mechanism behind most of the exposure discussed on our liability page.
What are the penalties?
Section 6823(a) provides that whoever knowingly and intentionally violates, or knowingly and intentionally attempts to violate, section 6821 shall be fined in accordance with title 18 or imprisoned for not more than five years, or both. Section 6823(b) raises that where the violation occurs while violating another law of the United States, or as part of a pattern of any illegal activity involving more than $100,000 in a twelve-month period: the fine doubles under 18 U.S.C. 3571(b)(3) or (c)(3) and imprisonment rises to not more than ten years. The word attempts in subsection (a) is load-bearing – the offence does not require that any information was actually obtained.
How can I tell whether a locating firm is working inside this statute?
Ask three questions and listen for numbers rather than adjectives. First, which subsection do you rely on when you receive lawfully licensed data, and what use do you certify to your supplier? Second, what happens at intake when a request asks for account information – is it declined, or repriced? Third, what does your report attribute a finding to? A firm working inside the statute will describe a chain: an institution’s permitted disclosure, a supplier’s contractual and statutory obligations, a certified use, a record that can be named and dated. A firm outside it tends to answer with a percentage. Our note on what happens before a search starts is on the page about the information a locate actually needs.
Is this page legal advice about my situation?
It is not, and the section numbers are here precisely so that you do not have to take our word for any of it. Everything above is a description of a statute, offered as general information; nobody here is a lawyer and reading this creates no professional relationship of any kind. Two things were deliberately left off the page because they could not be settled at primary source in the session that built it. First, no figure appears for how many states run their own pretexting statutes, because that set was never enumerated. Second, no position is taken on where credit-header data falls, because that is an FCRA question and this page is about a different Act. Both omissions are recorded in the research file behind the page rather than papered over with a hedge. Take the citations to your own counsel and read them there.
A Locate That Stays Inside the Statute
Tell us the name, the identifiers already in your hands, the last address anybody put on paper, and the lawful reason behind the request. Where what is actually wanted is account information, you will hear that at intake, together with the observation that the route to it runs through a subpoena and your own counsel rather than through any research firm. Where what is wanted is a person, an address, or what somebody has recorded and filed, that is ordinary records work and every line of it will name the source it came from. The method sits on the skip tracing services hub, the mechanics on how skip tracing works, and the broader question on is skip tracing legal. Workable requests typically get a first read back within 24 hours. Contact us to open one.
Start Your Request →
