Chase (JPMorgan Chase Bank, N.A.), the U.S. consumer bank of JPMorgan Chase & Co. (NYSE: JPM), is the largest U.S. bank by assets. Its GLBA privacy notice answers "Yes" to every federal sharing category, with no opt-out for everyday-business, own-marketing, or joint-marketing sharing. Its online privacy policy and App Store privacy label disclose third-party advertising cookies and identity-linked data (including a Third-Party Advertising category tied to email address), and in 2024 Chase launched Chase Media Solutions, a retail-media ad network that explicitly monetizes customers' first-party financial data for brand targeting. Ownership is fully traceable through SEC filings: JPMorgan Chase & Co. is a Federal Reserve-supervised bank holding company whose principal bank subsidiary, JPMorgan Chase Bank, N.A., is OCC/FDIC-regulated. Track record includes a large 2014 data breach (76 million households' contact data, no evidence of account credentials taken) and a December 2024 CFPB lawsuit over Zelle fraud handling that the Bureau voluntarily dismissed in March 2025 without a finding of wrongdoing.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2024-12-20]
The CFPB's enforcement-actions page states that on December 20, 2024 the Bureau sued Early Warning Services, Bank of America, JPMorgan Chase Bank, N.A., and Wells Fargo alleging unfair acts/practices and Regulation E violations tied to fraud on the Zelle payment network, and that the Bureau voluntarily dismissed the action with prejudice against all defendants on March 4, 2025 (dismissed by the court March 5, 2025) without a finding of wrongdoing or penalty.
JPMorgan Chase & Co.'s Form 8-K filed October 2, 2014 disclosed that a cyberattack compromised customer contact information (name, address, phone, email) affecting approximately 76 million households and 7 million small businesses, while stating there was no evidence that account numbers, passwords, user IDs, dates of birth, or Social Security numbers were compromised.
The Chase Mobile App Store privacy label (self-reported by JPMorgan Chase & Co.) lists Purchases, Financial Info, Location, Contact Info, Contacts, User Content, Identifiers, Usage Data, and Diagnostics as data categories collected and linked to the user's identity, spanning purposes from App Functionality and Analytics to Third-Party Advertising and an unspecified 'Other Purposes' catch-all.
Chase's U.S. Consumer Privacy Notice (GLBA notice) states the types of personal information it collects and shares depend on the product or service, and can include Social Security number and income, account balances and transaction history, and credit history and payment history.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
JPMorgan Chase & Co.'s Annual Report on Form 10-K for fiscal year 2025 (filed with the SEC on February 13, 2026) discloses that JPMorgan Chase & Co. is a bank holding company and financial holding company under U.S. federal law supervised by the Federal Reserve, and that its national bank subsidiary, JPMorgan Chase Bank, N.A., is supervised and regulated by the OCC and, for certain matters, the FDIC.
Chase's GLBA notice answers "Yes" to every federal sharing category listed (everyday business purposes, own marketing, joint marketing with other financial companies, affiliates' creditworthiness sharing, affiliate marketing, and nonaffiliate marketing), permits no opt-out for the first three categories, and states that sharing continues even after the customer relationship ends.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
Chase's own press release announcing Chase Media Solutions (April 3, 2024) describes the new retail-media ad business as combining the scale of a retail media network with 'the exclusive advantages of Chase's first-party financial data,' connecting brands directly with Chase's 80 million customers for targeted, personalized offers.
JPMorgan Chase & Co.'s Form 8-K filed October 2, 2014 disclosed that a cyberattack compromised customer contact information (name, address, phone, email) affecting approximately 76 million households and 7 million small businesses, while stating there was no evidence that account numbers, passwords, user IDs, dates of birth, or Social Security numbers were compromised.
The CFPB's enforcement-actions page states that on December 20, 2024 the Bureau sued Early Warning Services, Bank of America, JPMorgan Chase Bank, N.A., and Wells Fargo alleging unfair acts/practices and Regulation E violations tied to fraud on the Zelle payment network, and that the Bureau voluntarily dismissed the action with prejudice against all defendants on March 4, 2025 (dismissed by the court March 5, 2025) without a finding of wrongdoing or penalty.
Chase's Online Privacy Policy (last updated September 2023) states that certain companies Chase works with may set cookies and related tracking technologies, such as clear GIFs, throughout its online services to support online behavioral advertising (OBA), and directs users to the Digital Advertising Alliance's opt-out program at youradchoices.com.
The Chase Mobile App Store privacy label discloses a 'Third-Party Advertising' purpose using Contact Info (email address) that is collected and linked to the user's identity, in addition to the developer's own advertising/marketing use of other data categories.