American Express (NYSE: AXP), operating primarily through American Express National Bank (AENB) and American Express Travel Related Services Company, is a global charge/credit card issuer and payments network regulated as a bank holding company. Its GLBA consumer privacy notice discloses standard financial-sector data collection (SSN, income, transaction/account/credit history) and shares broadly for everyday-business and marketing purposes with no opt-out on those categories, though unlike some peers it states it does not share personal information with nonaffiliates for their own marketing. Its online privacy statement discloses third-party cookies and 'Advertising Partners' used for Targeted Advertising, with an opt-out via a CCPA 'Do Not Sell or Share My Personal Information' link and the Digital Advertising Alliance program; the Amex Mobile App Store privacy label, by contrast, declares only Identifiers/Usage/Diagnostics data and keeps its Third-Party Advertising identifiers in the 'Not Linked to You' category. Ownership is fully traceable via SEC filings: American Express Company is a Federal Reserve-supervised bank holding company whose bank subsidiary AENB is OCC/FDIC-regulated. Track record includes a July 2023 OCC $15 million civil money penalty against AENB for failing to govern and oversee a third-party affiliate handling small-business customer retention calls and for related recordkeeping/Customer Identification Program violations — a finalized governance/oversight order, not a data breach or an adjudicated deceptive-marketing finding.
TRACK RECORD
1 ENFORCEMENT ACTION
[2023-07-25]
The OCC's July 25, 2023 news release states it assessed a $15 million civil money penalty against American Express National Bank for failing to govern and oversee a third-party affiliate and for violations of regulations relating to certain efforts to retain small business customers, including inadequate call-monitoring and complaint-tracking controls and Customer Identification Program recordkeeping failures. Note: the launch-roster brief described this as a 'CFPB' order, but the fetched primary source shows it was issued by the OCC, not the CFPB; cited accordingly.
American Express's GLBA U.S. consumer privacy notice states the types of personal information it collects and shares depend on the product or service, and can include Social Security number and income, transaction history and account history, and insurance claim history and credit history.
American Express's Online Privacy Statement states that it (or its Service Providers/Advertising Partners) may collect Online Information about the device, operating system and browser used, IP address and general geographic location, and browsing history on Amex websites and apps including search terms, pages viewed, and time spent.
American Express Company's Annual Report on Form 10-K for fiscal year 2025 (filed with the SEC on February 6, 2026) discloses that the Company is a bank holding company under the Bank Holding Company Act supervised by the Federal Reserve, and that its bank subsidiary, American Express National Bank (AENB), is supervised, regulated and examined by the OCC and, with respect to certain matters, by the FDIC.
American Express's GLBA notice sharing table answers 'Yes' with no opt-out for sharing for everyday-business purposes, own marketing purposes, and joint marketing with other financial companies, but answers 'No' to sharing personal information with nonaffiliates so they can market to the consumer (though aggregated/de-identified data may still be shared).
American Express's Online Privacy Statement discloses sharing Personal Information with Advertising Partners for Targeted Advertising, and directs users to a 'Do Not Sell or Share My Personal Information' link (a CCPA self-declared sale/share disclosure) plus the DAA program to opt out.
The OCC's July 25, 2023 news release states it assessed a $15 million civil money penalty against American Express National Bank for failing to govern and oversee a third-party affiliate and for violations of regulations relating to certain efforts to retain small business customers, including inadequate call-monitoring and complaint-tracking controls and Customer Identification Program recordkeeping failures. Note: the launch-roster brief described this as a 'CFPB' order, but the fetched primary source shows it was issued by the OCC, not the CFPB; cited accordingly.
American Express's Online Privacy Statement discloses that certain companies it works with may set cookies and use related tracking technologies, such as clear GIFs, throughout its online services or communications to support online behavioral advertising (OBA) efforts, with opt-out via the Digital Advertising Alliance's youradchoices.com program.
The Amex Mobile App Store privacy label discloses a 'Third-Party Advertising' purpose using Identifiers (User ID) and the developer's own Advertising or Marketing Identifiers, categorized under 'Data Not Linked to You' rather than data linked to the user's identity.