U.S. Bank (U.S. Bank National Association, "USBNA") is the consumer-banking subsidiary of U.S. Bancorp (NYSE: USB), the fifth-largest U.S. commercial bank by assets. Its GLBA privacy notice discloses standard bank data categories (SSN, income, account balances, transaction/credit history) and answers "Yes" to sharing for everyday business, its own marketing, and affiliates' everyday business purposes with no opt-out for those three, while stating it does not share for joint marketing or with nonaffiliates to market; its CCPA notice separately discloses sharing personal information with third parties for cross-context behavioral advertising. The U.S. Bank Mobile Banking App Store label discloses financial info, contact info, purchases, user content, and identifiers linked to identity, including a Third-Party Advertising purpose. Ownership is fully traceable through U.S. Bancorp's SEC 10-K: it is a registered bank holding company supervised by the Federal Reserve, with USBNA regulated primarily by the OCC and also by the FDIC and CFPB. Track record includes a July 2022 CFPB consent order and $37.5 million penalty for opening unauthorized credit card, credit line, and deposit accounts for consumers without their knowledge or consent and for pulling consumer credit reports without a permissible purpose.
TRACK RECORD
1 ENFORCEMENT ACTION
[2022-07-28]
The CFPB's enforcement-actions page states that on July 28, 2022 the Bureau issued a consent order against U.S. Bank National Association after finding it opened credit cards, lines of credit, and deposit accounts for consumers without their knowledge or consent and pulled consumer credit reports without a permissible purpose, resulting in a $37.5 million penalty to the Bureau.
The U.S. Bank Mobile Banking App Store privacy label (self-reported by developer U.S. Bancorp) lists Financial Info (Other Financial Info), Contact Info (Physical Address, Email Address, Name, Phone Number), Purchases, User Content, and Identifiers as data collected and linked to the user's identity, spanning App Functionality, Analytics, Product Personalization, Third-Party Advertising, and Developer's Advertising or Marketing purposes.
U.S. Bank's Consumer Privacy Notice (GLBA notice) states the types of personal information it collects and shares depend on the product or service, including Social Security number and income, account balances and payment history, and transaction history and credit history.
U.S. Bancorp's Annual Report on Form 10-K for fiscal year 2025 (filed with the SEC February 23, 2026) discloses it is registered as a bank holding company under the Bank Holding Company Act of 1956, and that its banking subsidiary, U.S. Bank National Association, is regulated, examined, and supervised primarily by the OCC and also by the FDIC, the Federal Reserve, and the CFPB.
U.S. Bank's state personal information (CCPA) program page states it does not sell personal information to third parties for monetary consideration without prior consent, but may share personal information with third parties for cross-context behavioral advertising, including identifiers, mobile advertising IDs, and internet/network activity information.
U.S. Bank's GLBA notice answers "Yes" (with no opt-out) to sharing for everyday business purposes, its own marketing purposes, and affiliates' everyday business purposes, but states it does not jointly market with other financial companies and does not share with nonaffiliates so they can market to the customer.
The CFPB's enforcement-actions page states that on July 28, 2022 the Bureau issued a consent order against U.S. Bank National Association after finding it opened credit cards, lines of credit, and deposit accounts for consumers without their knowledge or consent and pulled consumer credit reports without a permissible purpose, resulting in a $37.5 million penalty to the Bureau.
The U.S. Bank Mobile Banking App Store privacy label discloses a 'Third-Party Advertising' purpose built on Usage Data and Advertising Data collected and linked to the user's identity.
U.S. Bank's privacy-choices page states it uses tracking technologies such as cookies to understand website visitor behavior and deliver advertising, and separately states it honors opt-out preference signals such as the Global Privacy Control that communicate a visitor's opt-out preferences.