California Consumer Privacy Act (CCPA) Notice at Collection of Personal Information and Privacy Policy

Last Updated: April 2026

 Download privacy notice (PDF, 175 KB) Opens a new window.

Scope of this policy

The California Consumer Privacy Act (CCPA) Notice at Collection of Personal Information and Privacy Policy (Policy) applies to the personal information of California residents (hereinafter referred to as “you”), collected by the Canadian Imperial Bank of Commerce (hereinafter referred to as “CIBC” or “we”) including the personal information collected when you visit CIBC’s website or use our mobile application. This Privacy Policy does not apply to the personal information in your capacity as an employee or prospective employee.

For purposes of this Policy, “personal information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked to, directly or indirectly, an individual. However, personal information does not include:

  • Information publicly available from government records or made publicly available by you or with your permission;
  • Deidentified or aggregated information; and
  • Information excluded from the scope of the CCPA, such as protected health information covered by the Health Insurance Portability and Accountability Act or the Health Information Technology for Economic and Clinical Health Act, medical information covered by California Confidentiality of Medical Information Act, or personal information covered by certain sector-specific privacy laws such as the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, or the California Financial Information Privacy Act.

California Notice at Collection

CIBC collects the personal information identified in the section “What we collect and how we collect it,” for the purposes and for the time periods identified in the section “How we use and retain your information,” and retains it for the period described in that same section. We disclose personal information for cross-context behavioral advertising (“sharing”) as described in the section below titled “What we disclose and to whom.” We do not sell your personal information, or collect or process sensitive personal information for the purpose of inferring characteristics about you.

California residents — Your privacy rights

The categories of personal information CIBC collects depends on the products or services you have with CIBC and your use of CIBC websites and services. Over the past 12 months CIBC has collected, and may continue to collect on an ongoing basis, the following categories of information:

Category Examples/Purpose of Collection
Identifiers  A real name, alias, email, telephone number, residential or business address, mailing address, unique identifiers for customer service and data analysis 
Characteristics of Protected Classifications Under California or Federal Law Age, marital status or gender
Professional or employment-related information Current or past job history 
Internet or other similar network activity Browsing history or cookie information
Commercial information  Records of personal property, products or services purchased or obtained, or considered, or other purchasing or consuming histories or tendencies 
Correspondence Records related to correspondence sent and received by CIBC regarding financial services
Inferences drawn from other personal information Profile reflecting a person’s preferences, characteristics 
Geolocation  To help serve the appropriate CIBC website or provide suggestions based on physical location
Audio, electronic, visual or similar information Call recordings to support customer service, images on building and ATM security cameras



 Category Examples/Purpose of Collection
Government issued identification numbers  Social Security Number or Social Insurance Number, driver’s license, state or provincial identification card, or passport number, including any details such as issue and expiration dates and personal address 
Financial information A consumer’s account log-in, financial account, debit card or credit card number combined with any required security or access code, password or credentials allowing access to an account. Financial account information includes background checks, financial institution account number, banking details, financial transaction history, credit history, credit bureau, insurance claim history, customer purchase history, audit reports, budgets and unreleased financial results, vendor agreements, or any other financial information
Citizenship and immigration status To ensure eligibility for commercial financial services and products and compliance with federal law
Precise location When enabled on your mobile application, to share location of the nearest ATM or ABM machines 
Biometrics As part of the verification process, CIBC may engage service providers to verify your identity and detect and prevent fraud
Protected characteristics Race, ethnicity, sex life or sexual orientation collected as part of inclusion and diversity initiatives, or as necessary to comply with applicable laws

CIBC may obtain the categories of personal information listed, both directly and indirectly:

  • Directly from you. For example, from forms you complete or products and services you purchase.
  • Indirectly from you. For example, from observing your actions on our website.
  • From business partners. For example, your employer or your employer’s service providers, such as payment initiation providers
  • From affiliated companies. For example, so that CIBC can assist other companies in the CIBC group of companies in providing you with products or services.

How we use and retain your information

CIBC may use the personal information collected for one or more business purposes as follows:

  • To fulfill or meet the reason you gave the information. For example, if you provide your name and contact information to ask for a quote or ask a question about our products or services.
  • To comply with capital markets trading or banking regulatory requirements.
  • To provide support or personalize and develop CIBC’s website, products and services.
  • To create, maintain, customize and secure your account.
  • To process your requests, purchases, transactions and payments and prevent transactional fraud.
  • To personalize your website experience and deliver content, product and service offerings relevant to your interests, including targeted offers and ads through our website, third-party sites and via email or text message (with your consent, where required by law).
  • To respond to law enforcement requests and, as required by applicable law, court order or government regulations
  • As we described to you when collecting your personal information or as otherwise permitted by law

In the 12 months preceding the date of this Policy, CIBC has not “sold” personal information subject to the CCPA nor has CIBC “sold” personal information of minors under the age of 16. As defined by CCPA, “sold” means the disclosure of personal information to a third party for monetary or other valuable consideration.

CIBC does not use or disclose sensitive personal information, as defined by California law, for inferring characteristics or for purposes other than those permitted by law. CIBC retains personal information as long as it is necessary or relevant for the purposes for which it was collected. We also keep information as required by law or applicable regulations.

What we disclose and to whom

Over the past 12 months CIB has disclosed, and may continue to disclose on an ongoing basis, personal information to the following categories of third parties listed below for the following “business purposes” as that term is defined by California law:

  • CIBC may disclose to its service providers any of the categories of personal information listed in the section “What we collect and how we collect it,” for the business purpose of performing services on our behalf and for the specific purposes described in the section titled “How we use and retain your information.”
  •  CIBC may disclose the categories of personal information listed in the section “What we collect and how we collect it,” for the business purpose of auditing compliance with policies and applicable laws, in addition to performing services on CIBC’s behalf.
  •  CIBC may disclose any of the categories of personal information listed in the section “What we collect and how we collect it,” to other companies within the CIBC group of companies, for the business purposes of (a) auditing compliance with policies and applicable laws, (b) helping to ensure security and integrity, (c) debugging, (d) short-term transient use, (e) internal research, and (f) activities to maintain or improve the quality or safety of a service or device.

In addition, CIBC has also disclosed over the past 12 months and may continue to disclose, personal information to the following categories of third parties for purposes other than a “business purpose” as defined by California law:

  • CIBC may disclose your personal information to third parties at your direction.
  • For example, to comply with financial reporting requirements, or to report unlawful activity to law enforcement.
  • CIBC may disclose personal information to the public as part of a press release.
  •  CIBC will also disclose personal information if thought to have to in order to comply with the law or to protect CIBC . For example, CIBC may disclose information in response to a court order or subpoena, or to a request made by a government agency or investigatory body, including U.S. and non-U.S. law enforcement or regulatory authorities.
  •  CIBC may disclose personal information when believed disclosure is necessary to protect the rights, property, or safety of CIBC, individuals or others.
  •  As part of a merger, acquisition, or other sale or transfer of all or some of our assets, or as part of a bankruptcy or financing, CIBC may disclose all categories of personal information.

CIBC may share personal information for cross-context behavioral advertising. You have the right to opt out of the sharing of your personal information for cross-context behavioral advertising. Review the CIBC Digital Banking Privacy Notice and Cookie Policy to learn more about how CIBC uses online tracking technologies, such as cookies, to conduct personalization, analytics and targeted advertising.

How to exercise your rights

You can exercise your privacy rights under California law or ask for more information as follows :

All requests must be verified prior to receiving a response. To verify a request, each request must include certain criteria:

  • Enough information that lets CIBC reasonably confirm you are the person about whom personal information has been collected, or an authorized representative on your behalf.
  • Enough detail in your request that lets CIBC properly understand, evaluate and respond.

CIBC will search existing information to confirm your identity or authority to make the request. Please note that for certain requests, you may be asked to provide a signed declaration under penalty of perjury affirming that you are the consumer whose personal information is the subject of the request. Information submitted for verification purposes will only be used to verify your identity and/or authority to make a request on another’s behalf.

If CIBC cannot verify your request, it may be denied. Additionally, we will not honor your request where an exception applies, such as where the disclosure of personal information would adversely affect the rights and freedoms of another California resident or where the personal information that we maintain about you is not subject to the CCPA's access or deletion rights.

Upon submission of a request, you will receive an initial confirmation of receipt within 10 business days. CIBC will respond to your request within 45 calendar days. If an extension for up to an additional 45 calendar days is required in order to process your request, you will be provided with an explanation for the delay.

Under CCPA, you may only make a verifiable request for access twice within a 12 month period.

You may directly exercise these rights or designate an authorized agent to make a request on your behalf. If you are a minor under 16 years of age, your parent or guardian may make a verifiable request on your behalf.

Requests made on another person’s behalf can only be accepted upon receipt of documentation that the requestor is an authorized agent, parent or legal guardian of the consumer whose information is being requested. This will require the submission of a valid Power of Attorney, Birth Certificate, Guardianship Order or other court order granting authority to receive information, as appropriate.

Your California privacy rights

As a California resident, you have certain rights with respect to your personal information.

Subject to certain exceptions, you have the right to access what personal information CIBC has collected about you, as well as how such personal information is being used and the retention period of same for business purposes. Once CIBC receives and confirms your verifiable request, you will be provided with the following: 

  • The categories of personal information CIBC has collected about you.
  • The categories of sources for the personal information CIBC collected about you.
  • CIBC’s business or commercial purpose for collecting that personal information.
  • The categories of third parties with whom CIBC has or may have disclosed that personal information.
  • The specific pieces of personal information CIBC collected about you.
  • If CIBC disclosed your personal information for a business purpose, you will be provided with separate list of disclosures for a business purpose. CIBC will identify the personal information categories that each category of recipient received.

You have the right to ask CIBC to delete any of the personal information collected from you and retained , with certain exceptions. Once CIBC receives and confirms your verifiable request, your personal information will be deleted from CIBC’s records, unless there’s an exception. 

Subject to certain exceptions, you also have the right to ask CIBC to correct any inaccurate personal information collected from you and retained. Once CIBC receives and confirms your verifiable request, your personal information withing CIBC’s records will be corrected.

CIBC does not discriminate or retaliate against you for exercising your privacy rights as described in this Policy.

Do not sell or share rights

CIBC does not sell personal information, meaning under California law, that CIBC does not provide personal information to a third party for monetary or other valuable consideration. CIBC does not sell personal information of minors under the age of 16.

CIBC may share personal information as defined by CCPA as the disclosure of personal information to a third party for cross-context behavioral advertising. You have the right to opt out of the sharing of your personal information for cross-context behavioral advertising in the following ways:

You can enable the Global Privacy Control (GPC) in your browser. GPC is a setting that allows you to communicate your privacy preferences to websites and online services that you visit. When CIBC detects a GPC signal from a browser, Digital Banking services are designed to treat the browser as opted out and to stop sharing personal information for certain targeted advertising purposes, in accordance with applicable laws. Please visit the Global Privacy Control website to learn more about the setting and how to enable it on your browser.

You can opt out of cross-context behavioral advertising by going to Manage cookie preferences and switching the toggle to the left and clicking save, indicating that you do not want CIBC to share your personal information for cross-context behavioral advertising.

Your choices are specific to the device, website, mobile app and browser you are using. They can be reset when you clear your browser’s cookies and data on your device. For more information on cookies, visit the Cookie Policy.

At any time, you may change your preference setting using the toggle bar. Any manual adjustment will override previous settings.

Other important information

CIBC may change or update this Policy from time to time. Once done, the revised Policy on this page with a new “Last Updated” date.

General questions

For questions regarding use of the information collected in accordance with the Policy, please contact the CIBC HR Contact Center at 1-800-668-0918 Opens your phone app. or your Human Resources Business Partner. Job applicants may contact .

Start my privacy request  Opens in a dialog.

CIBC cannot respond to your request or provide you with personal information if your identity, authority to make the request or the personal information as it relates to you cannot be confirmed. You do not need to have an account with CIBC to make a verifiable request.