Regulation S-P: Initial Privacy Notice and Opt-Out

What this video covers

• Why the default framework is opt-out, not opt-in, and what happens when a customer stays completely silent
• The exact timing trigger for delivering the initial privacy notice, and the three exceptions that permit delayed delivery
• What nonpublic personal information (NPI) covers, versus ordinary public-directory data
• How the standardized model privacy form satisfies content requirements and what elements must appear in the notice
• When a short-form notice satisfies the rule for consumers who never become customers
• Why the 30-day opt-out window applies to standard relationships but disappears entirely for one-off accommodation transactions
• How joint-account opt-out rules work: one consumer's direction can bind all, but a firm can never require every joint consumer to opt out before honoring one request