Capital One Financial Corporation (NYSE: COF) is a publicly traded bank holding company operating Capital One, N.A. and Capital One Bank (USA), N.A. under Federal Reserve, OCC, and FDIC supervision; it closed its acquisition of Discover Financial Services on May 18, 2025. Its GLBA notice answers "Yes" to every federal sharing category, including nonaffiliate marketing that continues after the customer relationship ends, and its online privacy policy discloses biometric identity-verification data, precise geolocation, and cross-site behavioral-advertising cookies, pixels, SDKs, and third-party plugins. Its Capital One Shopping browser extension separately collects the pages and purchase history a user views across other retailers' websites, though its own policy states it does not sell that data to third parties for their own marketing. Track record: the 2019 breach of roughly 98 million U.S. consumers' data drew an $80 million OCC civil money penalty in 2020 for cloud-migration risk-management failures, plus a class-action settlement finally approved in September 2022.
TRACK RECORD
1 ENFORCEMENT ACTION
[2020-08-06]
On August 6, 2020, the OCC announced an $80 million civil money penalty against Capital One, N.A. and Capital One Bank (USA), N.A. based on the bank's failure to establish effective risk-assessment processes prior to migrating significant IT operations to the public cloud and its failure to correct the deficiencies in a timely manner; the OCC noted it positively considered the bank's customer notification and remediation efforts.
Capital One's U.S. Consumer Privacy Notice (rev. 9/2025, the GLBA notice) states the personal information it collects and shares can include Social Security number and income, account balances and payment history, and account transactions and credit card or other debt, and that Capital One also collects personal information from credit bureaus, affiliates, or other companies.
Capital One's Online Privacy Policy (effective May 5, 2026) discloses collection of biometric information used to establish identity for authentication or fraud prevention, and precise location data (latitude/longitude) to locate a nearby branch, café, or ATM, alongside contact/identity, account, transaction, credit-report, demographic, and marketing-inference data.
Capital One Financial Corporation's Form 10-K for fiscal year 2025 (filed with the SEC) discloses it is a bank holding company and financial holding company subject to supervision by the Federal Reserve, and that on May 18, 2025 it closed its acquisition of Discover, merging Discover Bank into Capital One, N.A. and combining the companies' networks, customer base, technology, and data ecosystem.
Capital One's U.S. Consumer Privacy Notice (rev. 9/2025) answers "Yes" to every federal sharing category, including nonaffiliates marketing to the customer, and states that when the customer is no longer a Capital One customer, Capital One continues to share their information as described in the notice; opt-out is available only for the categories federal law allows.
Capital One's Online Privacy Policy states its marketing partners may collect information through its online services to target advertising based on personal information collected across different websites, mobile apps, and devices over time, in addition to sharing with affiliates and service providers.
On August 6, 2020, the OCC announced an $80 million civil money penalty against Capital One, N.A. and Capital One Bank (USA), N.A. based on the bank's failure to establish effective risk-assessment processes prior to migrating significant IT operations to the public cloud and its failure to correct the deficiencies in a timely manner; the OCC noted it positively considered the bank's customer notification and remediation efforts.
The court-administered settlement site for the 2019 Capital One data breach states that the attacker gained unauthorized access to the personal information of approximately 98 million U.S. consumers, and that the class action settlement's Order and Judgment Granting Final Approval was entered on September 13, 2022.
Capital One's Online Privacy Policy discloses use of cookies, pixel tags/web beacons, third-party mobile SDKs, resettable mobile advertising identifiers (Apple's IDFA or Google's Advertising ID), and third-party social-media plugins embedded in its online services.
The Capital One Shopping Global Privacy Policy (effective July 31, 2026) states that its browser extension collects the pages a user views, purchase history on various websites and services, prices paid, general and precise location, device/technical data, and advertising identifiers as the user browses other companies' websites and apps.