The Washington Post has published an article describing a relatively new arena for behavioral advertising: your online bank statement.  Participating banks serve marketing to their customers based on the customer’s spending history.  These promotions may be particularly valuable to advertisers because they are targeted based on how a customer actually spends his or her money and because customers can take advantage of advertised discounts without printing out coupons — if you click the associated link, the advertiser will recognize your debit card the next time it is swiped. 

The banks and their advertising partners have defended against privacy concerns by pointing out that customers may opt out and noting that, because the ad software runs on the bank’s server, customer data need not leave the bank’s secure network.  The federal banking regulators have not yet chimed in on this practice.  The FTC’s recent draft report on consumer privacy suggests that the FTC is inclined to treat financial information as sensitive information, subject to an opt-in consent requirement for data practices that are not “commonly accepted.”  The draft report does not define financial information.