To continue enjoying all the features of Navy Federal Online, please use a compatible browser. Confirm your browser capability.

Last Updated: November 19, 2025

This California Consumer Privacy Act Disclosure and Notice at Collection (“CCPA Disclosure”) applies solely to California residents (“you”) and concerns the practices of Navy Federal Credit Union and its US affiliates (collectively, “Navy Federal,” “we,” “us” or “our”) with respect to personal information of California residents. It explains how we collect, use and disclose personal information subject to the California Consumer Privacy Act as amended by the California Privacy Rights Act (together “CCPA”). It also describes the privacy rights of California residents under the CCPA and how they can exercise those rights. 

Under the CCPA, personal information means information that “identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked … with a particular [California resident] or household.” Personal information does not include publicly available information, lawfully obtained, truthful information that is a matter of public concern or information that is de-identified or aggregated.

Please note that the CCPA does not apply to certain personal information, such as information subject to the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act and certain other state or federal privacy laws. This CCPA Disclosure therefore does not cover information that we collect in connection with financial products or services that California residents apply for or attain from us for personal, family or household purposes. That information is subject to our Consumer Privacy Policy.

This CCPA Disclosure supplements other Navy Federal privacy policies or notices applicable to information we collect about California residents in particular contexts, such as our Online Privacy Policy and our Workplace Privacy Notice and Workplace CCPA Disclosure and Notice at Collection. Any terms in this CCPA Disclosure that are not otherwise defined have the same meaning as they do in the CCPA. This CCPA Disclosure also serves as our “Notice at Collection” under California law.

Categories of Personal Information

The categories of personal information we collect about California residents depend on our specific relationship or interaction with that individual. In the past 12 months, we have collected the following categories of California residents’ personal information:

  • Personal identifiers, e.g., real name, alias, postal address, telephone number, unique personal identifier, online identifier, device identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license or state identification card number, passport number
  • Characteristics of protected classifications under California or federal law, e.g., race, national origin, religion, sex, age (40 years or older), disability, Veteran or military status
  • Financial information, e.g., bank account number, credit card number, debit card number, insurance policy number
  • Commercial information, e.g., records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies
  • Biometric information, e.g., imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns and voice recordings, from which an identifier template, such as a faceprint or a voiceprint, can be extracted, keystroke patterns or rhythms, and gait patterns or rhythms
  • Internet or other electronic network activity information, e.g., browsing history, search history, information regarding a California resident’s interaction with our website or mobile applications (collectively Sites) or advertisements displayed on our Sites and on third-party websites and mobile applications and sent by email (collectively, digital advertisements)
  • Geolocation data, e.g., GPS coordinates of a device, IP addresses
  • Communications, recordings, images: audio, electronic, visual
  • Professional or employment-related information, e.g., title, salary, employment files, references
  • Education information: details of your education and qualifications
  • Inferences: Any derivation of information, data, assumptions or conclusions drawn from certain of the above categories used to create a profile reflecting the individual’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities and aptitudes

In the past 12 months, we have collected the following categories of California residents’ sensitive personal information:

  • Social Security number, driver’s license, state identification card or passport number
  • Account log-in, financial account, debit card or credit card number in combination with any required security or access code, password, or credentials allowing access to the account
  • Precise geolocation
  • Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership
  • Mail, email and text message contents unless we are the intended recipient
  • Genetic data
  • Biometric information processed to uniquely identify that California resident
  • Health information
  • Information concerning sex life or sexual orientation
  • Information of California residents that we know are less than 16 years of age with parental consent

Sources of Personal Information

In the past 12 months, we have collected the above-listed categories of personal information about California residents from the following categories of sources:

  • Directly from you or your guardian, agent or representative
  • Indirectly from you, such as by observing your interactions with us or drawing inferences from the information you provide to us directly and indirectly

As well as from:

  • Our affiliates
  • Our service providers and contractors to support fraud prevention, ensure physical and digital safety and security, enable marketing and data analytics, facilitate human resource activities, and deliver products and services
  • Third-party advertising and social networks
  • Our business customers, who may provide information about you if you are associated with them, such as if you are an employee or board member
  • Our business partners
  • Credit reporting agencies
  • Data brokers
  • Government entities
  • Third parties you have authorized or directed to share information with us
  • Digital tracking technologies that may automatically collect information about you when you interact with us online as described in our Online Privacy Policy
  • Safety monitoring technologies, such as video security recordings
  • Speech analytics tools, such as real-time call transcription
  • Recruiters, former employers, educational institutions and professional organizations, and other third parties in relation to processing an application from you for work at Navy Federal
  • Any relevant third party for a legal purpose, such as in response to a court order or to defend against a legal claim
  • Any relevant third party when necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, violations of our terms and conditions, or situations involving threats to our property or the property or physical safety of any person or third party

Purposes for the Collection and Use of Personal Information

We collect and use the above-listed categories of personal information about California residents for the following purposes:

  • Providing our products and services
  • Maintaining our Sites, including debugging, security, fraud prevention and session management
  • Reviewing and processing your applications for our services and transactions with us
  • Verifying your identity
  • Maintaining and servicing your accounts
  • Responding to your requests and communicating with you
  • Managing your preferences and personalizing your experience on our Sites
  • Conducing analytics and research concerning your use of products, services and Sites and the effectiveness of our advertising campaigns
  • Providing to you non-personalized advertisements for our products and services
  • Delivering and tailoring our digital advertisements to you based on inferences about your interests and preferences inferred from your browsing behavior across the internet over time
  • Developing new products and services, improving existing products and services, and enhancing your experience when you use our Sites
  • Marketing to you promotions for select third-party products or services that we think would be of interest to you, such as discounted venue tickets
  • Assessing and ensuring the health and safety of ourselves, our customers, our workforce and third parties
  • Protecting the physical security and safety of our premises and the electronic security of our systems
  • Complying with our legal obligations, relevant industry standards, contractual obligations and our policies
  • Establishing, exercising and defending our legal rights
  • Detecting, preventing, investigating and addressing actual or potential fraud or other illegal activities or breaches of policy
  • Performing audits
  • Processing applications to work for us
  • Carrying out purposes described to you prior to or at the time the information is collected
  • Creating aggregated or de-identified information, which can then be used for any lawful purpose
  • Otherwise operating, managing and maintaining our business, such as analyzing credit risk, resolving complaints and disputes, and conducting institutional risk control, credit reporting, compliance and human resource activities

We may also collect and use personal information relating to California residents for one or more of the specific “business purposes” listed in the CCPA:

  • Certain auditing and measurement purposes, such as counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with applicable standards
  • Helping to ensure our ability to detect security incidents; resist malicious, deceptive, fraudulent, or illegal activity and prosecute those responsible for that activity; to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information; and to protect the physical safety of natural persons
  • Debugging to identify and repair errors that impair existing intended functionality
  • Short-term, transient use, including, but not limited to, non-personalized advertising
  • Performing services on behalf of Navy Federal, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, providing storage, or providing similar services on behalf of Navy Federal
  • Undertaking internal research for technological development and demonstration
  • Undertaking activities to verify or maintain the quality or safety of a service that is owned or controlled by Navy Federal and to improve, upgrade or enhance the service that is owned or controlled by Navy Federal

Disclosure of Personal Information 

In the past 12 months, we have disclosed the above-listed categories of California residents’ personal information to our service providers or contractors for the following business purposes:

  • Non-personalized advertising and marketing of Navy Federal products and services (i.e., advertising that is not cross-contextual behavioral advertising)
  • Data analytics
  • Provision of our products and services
  • Application review and processing
  • Account maintenance and servicing
  • Technological support and debugging
  • Fraud prevention
  • Information verification
  • Transaction and payment processing
  • Digital and physical security
  • Customer service
  • Dispute resolution and complaint handling
  • Product research and development
  • Data storage
  • Quality control and enhancement
  • Legal compliance and defense
  • Risk mitigation
  • Audits
  • Hiring
  • Data aggregation and de-identification
  • General business operations

Sale and Sharing of Personal Information

We do not sell personal information to third parties, within the meaning of the CCPA (and have not done so in the last 12 months). In the past 12 months, we have shared (and we plan to continue sharing) categories of personal information (specifically, non-sensitive personal identifiers, commercial information, internet or other electronic network activity information, and geolocation data) with third-party advertising and social networks for purposes of cross-behavior advertising.

California residents may have a right to opt out of this sharing, as described below. You can also review our Online Privacy Policy to learn more about how we use online tracking technologies to conduct personalization, analytics and targeted advertising.

Other than the categories of personal information specifically listed above, we do not share personal information about California residents with third parties (and have not done so in the last 12 months).

Use and Disclosure of Sensitive Personal Information

In the past 12 months, we have used or shared (and we plan to continue to use or share) precise geolocation data with third-party advertising and social networks for purposes of cross-behavior advertising. California residents may have a right to limit this use or sharing of their sensitive personal information, as described below. We do not otherwise use or disclose sensitive personal information about California residents in a manner that requires us to provide a right to limit the use or disclosure of this information or notice of such right (and have not done so in the last 12 months).

Individuals Under 16 Years of Age

We do not have actual knowledge that we sell or share the personal information of individuals under 16.

Rights of California Residents

As a California resident, you may have one or more of the following rights under the CCPA:

  • The right to know:
    •        the categories of personal information we have collected
    •        the categories of sources used to collect the personal information;
    •        the business or commercial purposes for collecting your personal information;
    •        the categories of recipients with whom we share your personal information, including for cross-contextual behavioral advertising purposes; and
    •        the specific pieces of personal information we have collected about you
  • The right to request, on legitimate grounds, deletion of your personal information that we collected
  • The right to opt out of our sharing your personal information for the purpose of cross-contextual behavioral advertising
  • The right to limit certain use and disclosure of your sensitive personal information
  • The right, in certain circumstances, to correct inaccurate personal information we collected about you
  • The right not to be retaliated against for exercising any of these rights

How to Exercise Your CCPA Rights

If you are a California resident, you or your authorized agent can use any of the following methods to make a request to exercise the rights described above.

Upon submission of your request, we will take steps to verify your identity and, if applicable, that of your authorized agent. Those steps may vary depending on your relationship with Navy Federal and the intake method. Further, in rare cases, we may require you to visit a Navy Federal branch or acknowledge your identity before a notary public. If required for CCPA purposes, Navy Federal branches located in California (Branch Locator) that offer notary services will do so free of charge.

For agents submitting a request on behalf of another person, we may require proof of authorization. If you do not already have a valid power of attorney on file, you can designate an agent using our CCPA Power of Attorney Form. Parents/legal guardians making requests on behalf of their minor children will need to complete the Parent/Legal Guardian Cover Sheet and include a certified copy of the birth certificate or legal document to provide proof of their status.

Completed limited CCPA POA Forms and Parent/Legal Guardian Cover Sheets may either be:

  • mailed to Navy Federal Credit Union, PO Box 2464, Merrifield, VA 22116-2464; or
  • dropped off at a Navy Federal branch located in California (Branch Locator).

We will work to process all verified requests within 45 days. If we need an extension in order to process your request, we will reach out to you and provide you with an explanation for the delay.

In some instances, we may not be able to honor your request. For example, we will not honor your request if we cannot verify your identity or confirm that the personal information that we maintain relates to you, or if we cannot verify that you have the authority to make a request on behalf of another individual. Additionally, we may not honor your request where an exception applies, such as where the disclosure of personal information would adversely affect the rights and freedoms of another individual or where the personal information that we maintain about you is not subject to the CCPA’s rights.

We will advise you in our response if we are not able to honor your request. We will not provide Social Security numbers, driver’s license numbers or government-issued identification numbers, financial account numbers, healthcare or medical identification numbers, account passwords or security questions and answers, or any specific pieces of information if the disclosure presents the possibility of unauthorized access that could result in identity theft or fraud or unreasonable risk to data or systems and network security.

Your Privacy Choices

As noted above, we may sometimes share personal information, including sensitive personal information, with third-party advertising and social networks for cross-contextual behavioral advertising purposes. California residents may have a right to opt out of this sharing and to limit this usage or sharing of their sensitive personal information.

To facilitate these rights, we recognize Global Privacy Control (GPC) preference signals. GPC is a setting available in some browsers that notifies our websites of a California resident’s decision to opt out of the sharing of their personal information and to limit the usage or sharing of their sensitive personal information, for purposes of cross-contextual behavioral advertising. You can learn how to enable GPC on your browser here.

Please bear in mind that use of GPC is specific to a browser or device. Therefore, you will need to enable GPC from each browser on each of the devices that you use. Note that even if you exercise this choice, you may still receive advertisements from us—they just won’t be customized on the basis of the personal information you have signaled should not be used or shared for purposes of cross-behavioral advertising.

We do not offer an opt-out from the sale of personal information because we do not sell personal information as defined by the CCPA (and have not done so in the last 12 months). We do not otherwise offer a right to limit usage or disclosure of your sensitive personal information because we do not use or disclose your sensitive personal information in a manner that requires us to provide such a right.

Retention of Personal Information 

We take reasonable steps designed to ensure that your personal information is only processed for the minimum period necessary for the purposes set out in this disclosure. The criteria for determining the duration for which we will retain your personal information are as follows:

1. We will retain copies of your personal information in a form that permits identification only for as long as:

a. We maintain an ongoing relationship with you (e.g., while you are still receiving services from us); or

b. Your personal information is necessary in connection with purposes set out in this CCPA Disclosure

plus:

2. The duration of any applicable limitation period under applicable law and where required by applicable law or a retention policy established in accordance with applicable law

In addition, if any relevant legal claims are anticipated/brought, we may continue to retain your personal information for such additional periods as are necessary in connection with that claim.

Once the periods above have concluded, each to the extent applicable or permitted by applicable law, we will 1) permanently delete or destroy the relevant personal information, 2) archive your personal information so that it is beyond use or 3) anonymize the relevant personal information. 

Aggregated and De-identified Information

For information about you that is de-identified or aggregated, we implement reasonable safeguards to prohibit re-identification or de-aggregation, as applicable. With respect to de-identified information, we commit to maintain and use the information in de-identified form and not to attempt to re-identify the information, other than for the sole purpose of determining whether the de-identification process satisfies requirements under California law.

Changes to This CCPA Disclosure

We may change this disclosure from time to time. When we do, we will communicate the changes by appropriate means, such as by posting the revised disclosure on our CCPA website with a new “Last Updated” date. Any changes to this CCPA Disclosure will become effective when posted unless indicated otherwise.

Contact for More Information

For any questions, comments or complaints regarding our privacy practices, or if you need to access this CCPA Disclosure in an alternative format due to having a disability, please call us at 1-888-842-6328.