Citi (Citigroup Inc., NYSE: C) is a U.S. money-center bank whose consumer arm operates via Citibank, N.A. and the Citi Mobile app. Its U.S. Privacy Notice for Consumers discloses collection of Social Security numbers and government-ID numbers as "Sensitive Personal Information," states it "may sell or share" several categories of non-sensitive data with trusted third parties, and offers a CCPA-style opt-out; its cookie/interest-based-advertising disclosures route opt-outs through the industry-wide Digital Advertising Alliance program rather than an account-level toggle. Ownership is fully traceable: Citigroup is a registered bank holding company and financial holding company supervised by the Federal Reserve, and its national bank subsidiaries, including Citibank, are regulated by the OCC. Track record includes a $400 million OCC civil money penalty and cease-and-desist order in October 2020 for long-standing enterprise risk-management, compliance, and data-governance deficiencies, followed in July 2024 by an additional $60.6 million Federal Reserve penalty (combined with the OCC's own follow-on penalty, totaling approximately $135.6 million) for insufficient remediation progress under the still-active 2020 order.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2024-07-10]
The Federal Reserve Board's July 10, 2024 press release states it fined Citigroup $60.6 million for violating the Board's 2020 enforcement action, finding Citigroup had made insufficient progress remediating its data quality management problems, and that the combined OCC and Federal Reserve penalties announced totaled approximately $135.6 million.
The OCC's October 7, 2020 press release states it assessed a $400 million civil money penalty against Citibank, N.A. and issued a related cease-and-desist order, related to deficiencies in enterprise-wide risk management, compliance risk management, data governance, and internal controls.
The Citi Mobile App Store privacy label states that the developer, Citibank, self-reports handling of data types including Financial Info, Precise and Coarse Location, Contact Info, Contacts, and User Content (emails or text messages) linked to the user's identity, used for purposes spanning App Functionality, Analytics, Product Personalization, and an unspecified 'Other Purposes' category; Apple notes this information has not been verified by Apple.
Citi's U.S. Privacy Notice for Consumers lists 'Personal Identifiers' it collects as including Social Security number and information from government-issued identification (driver's license, Green Card, National ID, State ID, Passport/Visa), classifying these as Sensitive Personal Information.
Citigroup Inc.'s Annual Report on Form 10-K for fiscal year 2025 (filed with the SEC on 2026-02-20) discloses that Citigroup is a registered bank holding company and financial holding company regulated and supervised by the Federal Reserve Board, and that its nationally chartered subsidiary banks, including Citibank, are regulated and supervised by the Office of the Comptroller of the Currency (OCC).
Citi's notice states it may sell or share several categories of non-sensitive personal information with trusted third parties in limited circumstances, and separately grants consumers the right to opt out of that sale or sharing via its Privacy Hub, consistent with CCPA.
The OCC's October 7, 2020 press release states it assessed a $400 million civil money penalty against Citibank, N.A. and issued a related cease-and-desist order, related to deficiencies in enterprise-wide risk management, compliance risk management, data governance, and internal controls.
The Federal Reserve Board's July 10, 2024 press release states it fined Citigroup $60.6 million for violating the Board's 2020 enforcement action, finding Citigroup had made insufficient progress remediating its data quality management problems, and that the combined OCC and Federal Reserve penalties announced totaled approximately $135.6 million.
Citi's online privacy notice states it may use cookies, web beacons/pixel tags, and other technologies for interest-based advertising, and directs users wanting to opt out of interest-based advertising to the Digital Advertising Alliance's industry-wide opt-out program rather than a Citi-specific account setting.