California Consumer Privacy Act Notice

Last updated: April 30, 2026

Your Privacy Rights

Individuals considered “consumers” under the California Consumer Privacy Act of 2018, including as amended by the California Privacy Rights Act (together referred to in this notice as the “CCPA”), may be eligible to exercise certain privacy rights and receive certain disclosures with respect to their personal Information and sensitive personal information. For the purposes of this notice, “consumer”, “personal information”, and “sensitive personal information” have the same definition given to them by the CCPA. This notice is intended to inform those consumers of their rights under the CCPA and provide them with an explanation of how to exercise those rights. This notice does not apply to the collection, disclosure, and use of information not subject to the CCPA, including information covered by the Gramm-Leach-Bliley Act (GLBA), the Fair Credit Reporting Act (FCRA), and Health Insurance Portability and Accountability Act (HIPAA). For details on how we share information collected to provide, or determine an applicant's suitability to receive, financial products or services intended for personal, family, or household use, please refer to our US Consumer Privacy Notice.

This notice is provided pursuant to the CCPA, and, if eligible, you may exercise the following rights.

Personal Information Collected

Categories of Personal Information

We may have collected the following categories of personal information within the last twelve (12) months:

Behavioral (e.g., purchase history, leisure activities and interests, shopping preferences, inferences)
Contact and Biographical (e.g., first name, last name, maiden name, mailing address, phone number, email address, date of birth)
Demographic (e.g., household information)
Employment (e.g., occupation, job title)
Financial (e.g., account number, transaction history, property records, credit history, credit score)
Government-Issued (e.g., social security number, driver’s license number, passport number)
Location (e.g., geolocation)
Medical and Health (e.g., health insurance account number, medical payment information)
Payment Card (e.g., credit/debit card number, expiration date, card verification number)
Protected Classifications (e.g., racial or ethnic origin, legal status)
Unique Persistent Identifiers (e.g., IP address, cookies, login credentials)
Biometric Information (e.g., voiceprint, faceprint, or fingerprint information)
User Activity (e.g., information regarding interactions with Huntington websites, call logs, content of emails and text messages with Huntington colleagues)

Sources of Personal Information

We may obtain personal information from the following sources:

Directly from the Individual
Consumer Reporting Agencies
Directly obtained, generated, created
Government Entities and public records
Employer of Individual
Data Resellers
Affiliates
Our apps, websites, or any features or resources provided through them.

Purposes for Collecting Personal Information

We may obtain personal information for the following business and commercial purposes:

To provide, maintain, and/or service an account
To improve and develop our services and products
For marketing purposes
For data analytics or internal research purposes
For debt collection purposes
To comply with legal and regulatory requirements and guidance
For fraud prevention or account security purposes
To manage customer concerns and complaints

Disclosure of Personal Information

Categories of Personal Information Disclosed

We may have disclosed the following personal information in the past 12 months:

Behavioral (e.g., purchase history, leisure activities and interests, shopping preferences, inferences)
Contact and Biographical (e.g., first name, last name, maiden name, mailing address, phone number, email address, date of birth)
Demographic (e.g., household information)
Employment (e.g., occupation, job title)
Financial (e.g., account number, transaction history, property records, credit history, credit score)
Government-Issued (e.g., social security number, driver’s license number, passport number)
Location (e.g., geolocation)
Medical and Health (e.g., health insurance account number, medical payment information)
Payment Card (e.g., credit/debit card number, expiration date, card verification number)
Protected Classifications (e.g., racial or ethnic origin, legal status)
Unique Persistent Identifiers (e.g., IP address, cookies, login credentials)
Biometric Information (e.g. voiceprint, faceprint, or fingerprint information)
User Activity (e.g., information regarding interactions with Huntington websites, call logs, content of emails and text messages with Huntington colleagues)

Recipients to Whom Personal Information May Be Disclosed

We may have disclosed any of the above personal information to the following recipients in the past 12 months:

Service Providers and Contractors who we may employ for a variety of purposes, including for cybersecurity and fraud prevention services, information technology services, marketing and analytics services, and aiding us in providing you with financial products and services.
Outside advisors for the purpose of seeking legal, tax, audit, financial, or other advice or analysis.
Affiliates
Your authorized representative or other designated recipient
Consumer Reporting Agencies
Government Entities or industry regulatory authorities
To acquiring entities after the sale of all or a portion of one of our businesses
Operating Systems and Platforms
Non-Affiliated Financial Services Companies
Other third parties to whom you have requested that we provide your information.

Purposes for Disclosure of Personal Information

We may have disclosed personal information to the above recipients for the following purposes in the past 12 months:

For our everyday business purposes—such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus
For our marketing purposes—to offer our products and services to you
For joint marketing with other financial companies
For our affiliates' everyday business purposes—information about your transactions and experience
For our affiliates’ everyday business purposes—information about your creditworthiness
For our affiliates to market to you
For Cybersecurity and fraud prevention purposes

Sale of Personal Information

Huntington has not knowingly sold any personal information to third parties in the preceding 12 months, including the personal information of minors under 16 years of age.

Sharing Personal Information

We sometimes share personal identifiers and online activity information with marketing partners for cross-context behavioral advertising. California residents can opt out of this sharing by visiting our “Your Privacy Choices” and clicking the toggle so it's in the opt out position. Huntington also recognizes Global Privacy Control (GPC) signals, which notify us of your desire to opt-out of having your personal information shared for cross-context behavioral advertising. You can learn how to enable GPC in your browser here. Opt-outs may be browser or device specific, so you might need to opt out on each one you use. Even if you opt out, you may still see our ads, but they won't be personalized using the information you've opted out from sharing.

Sensitive Personal Information

Categories of Sensitive Personal Information

Huntington may have collected the following categories of sensitive personal information about you in the past 12 months:

Sensitive identification numbers (e.g., social security number, driver’s license number, passport number)
Access or log-in credentials (e.g., account log-in or financial account number in connection with password, security code, or access code)
Precise geolocation
Racial or ethnic origin
Religious or philosophical beliefs
Biometric data
Health information

Use of Sensitive Personal Information

Huntington may have used sensitive personal information for the following purposes in the past 12 months:

To perform services on behalf of Huntington and Huntington’s customers
To ensure the security and integrity of Huntington systems and accounts
For short-term, transient use, including non-personalized advertising
To undertake activities to verify or maintain quality or safety of service or enhance service

Disclosure of Sensitive Personal Information

Huntington does not knowingly disclose sensitive personal information in a way that is inconsistent with the CCPA so it does not offer a right to limit the use of your sensitive personal information.

Retention of Personal Information

We retain your personal information only as long as necessary for the purposes outlined in this disclosure. Specifically, we keep it while you have an ongoing relationship with us, or as required by law and our retention policies. If a legal claim is anticipated or made, we may keep your information longer to address that claim. After these periods, we will either delete, archive, or anonymize your personal information, as permitted by law.

Your Rights Related to Your Personal Information

If you are eligible, you may have the following rights related to the personal information that Huntington has collected:

Know Information: The right to know what personal information that Huntington has collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting or sharing personal information, the categories of recipients to whom the we discloses personal information, and the specific pieces of personal information the business has collected about the you.
Delete: The right to delete personal information that Huntington has collected about you, subject to certain exceptions.
Correct: The right to correct inaccurate personal information that Huntington maintains about you.
Non-Discrimination: The right not to receive discriminatory treatment by the business for the exercise of privacy rights conferred by an applicable privacy law.
Opt-out: The right to opt out of our sharing your personal information for the purpose of cross context behavioral advertising.

How to Exercise a Privacy Right and What to Expect

Methods

Huntington provides two methods for submitting a request to know what information has been collected about you, or correct or delete that information:

Option 1: Submit an online request
Option 2: Call our designated “Personal Information Rights Request” line at 866-644-9790, daily 6:00 a.m. to midnight ET.

Verification

To verify your request, we will ask you to provide information to identify yourself (for example: name, date of birth, address, email address, phone number, and last 4 of your Social Security Number). We will use the identifying information you provided to attempt to verify your identity. If necessary, we may also use a third-party provider to assist in verification.

Authorized Agent

You will be asked to submit a notarized affidavit authorizing your delegate to act on your behalf. If you do not submit the notarized affidavit within 10 business days, your case may be closed.

What to Expect

In the event you submit a rights request, you can expect the following:

We will determine whether your request can be fulfilled, which may include, verifying your identity, determining whether you have reached your request limit (no more than two for the preceding 12 months), determining whether you reside in a state that provides these rights, and determining whether you are ineligible under any other exception.
We may take up to 45 days to fulfill your request.
We may also extend the time to fulfill your request by another 45 days (for a total of 90 days); however, we will notify you when we make this extension.
We will provide you with your response via your chosen communication method (mail or email)

Please note, as discussed above, your submission does not guarantee that we will fulfill your request.

Contact

For questions or concerns about Huntington’s privacy policies and practices, please contact us at privacy@huntington.com.

Changes to this Disclosure

We may change this disclosure from time to time. When we do, we will communicate the changes by appropriate means, such as by posting the revised disclosure on our CCPA web site with a new “Last Updated” date. Any changes to this disclosure will become effective when posted unless indicated otherwise.