Ally (Ally Financial Inc., NYSE: ALLY) is a U.S. digital-only bank holding company whose principal subsidiary, Ally Bank, is a Utah-chartered commercial bank supervised by the Federal Reserve, Utah's UDFI, the FDIC, and the CFPB. Ally's Online Privacy Notice discloses a broad standard-for-banking collection list (SSN, income, employment, geolocation, mobile carrier/ISP) plus Zelle-linked contact-list access in its mobile app, and states it shares personal information with affiliates and nonaffiliates for marketing and market research, offering only a narrow opt-out scoped to targeted-advertising sharing (honored via Global Privacy Control and a cookie banner). The Ally Mobile App Store privacy label independently confirms Financial Info, Contact Info, User Content, Identifiers, Usage Data, and Diagnostics are collected and linked to identity, with Analytics purposes tied to persistent identifiers (User ID, Device ID). Ownership is fully traceable through SEC filings. No regulator enforcement action or confirmed large-scale data breach was found in Ally's FY2025 10-K, EDGAR full-text search, the CFPB enforcement-actions listing, or the California AG's data breach registry as of this draft; the 10-K itself states no cybersecurity incident has been identified as materially affecting the company, while separately noting (without specifics) that Ally has been subject to litigation in the past in connection with data breaches.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
7 ON FILE
COLLECTION
The Ally Bank & Auto Invest App Store privacy label (self-reported by developer Ally Financial Inc.) lists Financial Info, Contact Info (physical address, email, name, phone number), User Content, and Identifiers as data categories collected and linked to the user's identity, in addition to Usage Data and Diagnostics used for Analytics and App Functionality.
Ally's Online Privacy Notice lists the personal information it collects from site/app visitors, including Social Security number, income, residence/employment information, IP address and geo-location of the device, and mobile carrier/ISP, and separately discloses that the Ally Mobile app may access a user's contact-list names, emails, and phone numbers to facilitate Zelle transfers.
Ally Financial Inc.'s Form 10-K for fiscal year 2025 discloses that Ally is a bank holding company and financial holding company, and that IB Finance, a Delaware LLC and direct subsidiary of Ally, is the direct parent of Ally Bank, a Utah-chartered, FDIC-insured commercial bank supervised by the Federal Reserve, Utah's UDFI, the FDIC, and the CFPB.
Ally's Online Privacy Notice states Ally may share collected personal information with its affiliates and with nonaffiliates for analysis, market research, and marketing purposes as allowed by law, while the opt-out it offers is scoped specifically to sharing for targeted-advertising purposes rather than to this broader affiliate/nonaffiliate marketing sharing.
Ally Financial Inc.'s Form 10-K states the company has not identified risks from cybersecurity threats or any previous cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, Ally or its business strategy or results of operations, while separately noting (without specifics) that Ally has been subject to litigation in the past in connection with data breaches at its third-party service providers.
Ally's Online Privacy Notice states it uses a variety of tracking technologies including cookies to collect information about online and mobile activity, and separately describes Online Behavioral Advertising (OBA) on third-party sites, with opt-out available via Ally's own 'Your Privacy Choices' control or by honoring browser-based Opt-Out Preference Signals such as Global Privacy Control.
The Ally Bank & Auto Invest App Store privacy label discloses an Analytics purpose using Identifiers (User ID, Device ID), Usage Data (Product Interaction), and Diagnostics (Crash Data) collected and linked to the user's identity.