Bank of America Corporation (NYSE: BAC) is a Delaware-incorporated bank holding company and financial holding company, one of the largest U.S. financial institutions. Its U.S. Online Privacy Notice discloses broad behavioral data collection (device identifiers, geolocation, keystrokes/mouse movements, search and voice queries) used for personalization, analytics, and advertising, while its GLBA U.S. Consumer Privacy Notice shares personal information with affiliates and nonaffiliates for everyday business, marketing, and joint-marketing purposes with no opt-out for those categories, though it does offer an opt-out for affiliate creditworthiness sharing and for two nonaffiliate-marketing categories, and states it does not share for a third (non-credit-card, non-sponsored) nonaffiliate category. Ownership is fully traceable through SEC filings as a Federal Reserve-supervised bank holding company whose bank subsidiaries are OCC/FDIC-regulated. Track record includes a July 2023 OCC consent order assessing a $60 million civil money penalty against Bank of America, N.A. for unfair practices (Section 5 FTC Act) related to double-dipping overdraft/NSF fees on resubmitted transactions, announced the same day as a coordinated CFPB action over the same conduct plus credit-card rewards and fake-account allegations.
TRACK RECORD
1 ENFORCEMENT ACTION
[2023-07-11]
The OCC's July 11, 2023 news release states the agency assessed a $60 million civil money penalty against Bank of America, N.A. for violations of law relating to the bank's practice of assessing multiple overdraft and insufficient-funds fees against customers for a single resubmitted transaction, in violation of Section 5 of the FTC Act; this was announced the same day as a coordinated CFPB enforcement action over related credit-card-rewards and account-opening conduct.
Bank of America MOVEit data breach settlement; claims due Oct. 8, 2026
You may be eligible if you are a living person in the United States whose personal information, provided by Bank of America to Ernst & Young, was in the files affected by the May 2023 MOVEit security incident (typically you received a notice from EY).
The Bank of America Mobile Banking App Store privacy label (self-reported by the developer) lists data linked to the user's identity — including Usage Data, Product Interaction, Advertising Data, Identifiers, and Diagnostics — used across purposes including Third-Party Advertising, Analytics, Product Personalization, and App Functionality.
As assessed by PrivacySpy on 2021-01-05 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
As assessed by PrivacySpy on 2021-01-05 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
Bank of America Corporation's Form 10-K for fiscal year 2025 (filed with the SEC February 25, 2026) discloses that the Corporation is a Delaware bank holding company and financial holding company subject to supervision by the Federal Reserve, and that its U.S. bank subsidiaries are subject to regulation, supervision, and examination by the OCC, the FDIC, and the Federal Reserve.
As assessed by PrivacySpy on 2021-01-05 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
As assessed by PrivacySpy on 2021-01-05 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy require users to be notified in case of a data breach? — Yes, eventually.
The OCC's July 11, 2023 news release states the agency assessed a $60 million civil money penalty against Bank of America, N.A. for violations of law relating to the bank's practice of assessing multiple overdraft and insufficient-funds fees against customers for a single resubmitted transaction, in violation of Section 5 of the FTC Act; this was announced the same day as a coordinated CFPB enforcement action over related credit-card-rewards and account-opening conduct.
The Bank of America Mobile Banking App Store privacy label separately discloses a 'Developer's Advertising or Marketing' purpose using Identifiers, User ID, and Advertising Data collected and linked to the user's identity, distinct from its Third-Party Advertising category.