Discover is a credit card issuer and direct bank whose parent, Discover Financial Services, merged into Capital One Financial Corporation on May 18, 2025 — the SEC 8-K confirms the separate legal existence of both Discover and Discover Bank ceased at closing. Discover's own Online Privacy Notice (last updated January 1, 2026) and GLBA Consumer Privacy Notice (rev. 11/25) still govern the Discover-branded card, banking, and mobile properties: they disclose biometric, geolocation, and broad financial data collection; cookies, pixel tags, third-party SDKs, and session-replay tracking; and a GLBA sharing table that answers "Yes" to every federal category, including marketing to nonaffiliates, with sharing continuing after the customer relationship ends. Its App Store privacy label does not declare a "Data Used to Track You" category, though it does list Analytics, Identifiers, and Device ID among data linked to the user's identity. Track record: no data-privacy breach or privacy-specific regulator order was found, but in April 2025 the FDIC issued an Amended and Restated Consent Order, a $1.225 billion merchant restitution order, and a $150 million civil money penalty against Discover Bank for misclassifying millions of consumer credit cards as commercial for roughly 17 years, while the Federal Reserve concurrently fined parent Discover Financial Services and DFS Services LLC $100 million — a large compliance/business-practices enforcement matter, not a data-privacy violation.
TRACK RECORD
1 ENFORCEMENT ACTION
[2025-04-18]
The FDIC's April 18, 2025 press release states that for approximately 17 years, Discover Bank misclassified millions of consumer credit cards as commercial, overcharging merchants more than $1 billion in interchange fees, and that the FDIC issued an Amended and Restated Consent Order, a $1.225 billion restitution order, and a $150 million civil money penalty, while the Federal Reserve concurrently fined parent Discover Financial Services and DFS Services LLC $100 million.
Discover's Consumer Privacy Notice (the GLBA notice, Rev. 11/25) states the personal information Discover collects and shares can include Social Security number and account transactions, account balances and payment history, and transaction and credit history.
Discover's Online Privacy Notice (last updated January 1, 2026) lists 'Sensitive Information and Other Personal Identifiers' it collects, including social security number, date of birth, government identifiers, account access credentials, and biometric information, alongside device-level geolocation data derived from cellular network location, Wi-Fi networks, or mobile location services.
Discover Financial Services' Form 8-K (filed May 19, 2025) reports that upon closing of the merger, 'the separate existence of Discover ceased and upon the closing of the Bank Merger the separate existence of Discover Bank ceased,' with Discover Bank merging into Capital One, National Association as the surviving bank.
Discover's GLBA Consumer Privacy Notice's sharing table answers 'Yes' to every federal sharing category, including nonaffiliates marketing to the customer, and states that when a customer is no longer a Discover customer, Discover continues to share their information as described in the notice.
Discover's Online Privacy Notice states it may share information among the Discover family of companies and current or future subsidiaries/affiliates, with service providers and third parties, including third parties who perform advertising services on Discover's behalf.
The FDIC's April 18, 2025 press release states that for approximately 17 years, Discover Bank misclassified millions of consumer credit cards as commercial, overcharging merchants more than $1 billion in interchange fees, and that the FDIC issued an Amended and Restated Consent Order, a $1.225 billion restitution order, and a $150 million civil money penalty, while the Federal Reserve concurrently fined parent Discover Financial Services and DFS Services LLC $100 million.
The Discover Mobile app's Apple App Store privacy label lists no 'Data Used to Track You' category; under 'Data Linked to You' the developer discloses collection of Analytics, User Content, Customer Support, Usage Data, Product Interaction, Diagnostics, Performance Data, Other Diagnostic Data, App Functionality, Identifiers, and Device ID tied to the user's identity.
Discover's Online Privacy Notice discloses that its Online Services and some emails use cookies and pixel tags, that data is gathered about users over time across multiple websites and platforms, and that Discover additionally implements session-replay technology that records the duration of visits, content reviewed, and the location of a user's clicks.