Banks and credit unions spam me with ads of their services, some of which are quite high volume. I never gave my express informed consent. I may have consented to this buried in some fine print, but certainly was not asked for consent in a manner that would make me consciously aware that my inbox will be attacked with ads.

My problem is not really the annoyance. I can probably go through some opt-out hoops. The problem with banks specifically is security. Every time the bank e-mails you for any reason, both the metadata and the payload data are sent in-the-clear, thus enabling all handlers of the email to know where you bank. This info is valuable to both debt collectors and thieves.

So, new rule for non-GDPR regions of the world:

Banks that e-mail customers must very loudly obtain your unquestionably informed consent. The bank must give you a separate doc that says:

“Bank X will certainly send a flood of spam, and that flood of spam will disclose where you bank to all email providers and potentially ISPs and e-mail forwarding providers. All recipients free to sell that data to debt collectors. Show that you wholly agree to this abuse below by hand-writing out ‘please feel free to abuse my e-mail address’ and signing that statement.”

There must be a picture of a big eye or a zorro mask or cyber criminal with a hoodie next to that agreement (inspired by cigarrette box rules).

I believe if that level of transparency were in play, people would not agree and banks would either have to offer an email-free option or they would lose business.

#fuckBanks