Citi has launched an advertising business that uses cardholders’ spending patterns to decide which offers they see, extending bank transaction data into ad targeting on Citi’s own services and third-party digital channels.
Citi Commerce Media is being pitched to brands as a way to identify likely buyers and measure whether advertising led to spending. The bank says the platform is informed by 6.5 billion annual transactions across more than 700 spending categories. Business Insider reported that Citi can target the bank’s more than 70 million customers based on spending history, including while they use outside properties such as social media.
The launch does not by itself establish misuse of customer data. It does, however, put a consequential control question in front of Citi: whether customers receive clear, specific notice and a usable choice before transaction-derived profiles influence advertising beyond the bank’s own channels.
Transaction history becomes an advertising signal
Citi’s advertiser-facing page describes the service as using billions of transactions from Citi cardmembers to turn financial signals into growth. Business Insider and PaymentsJournal reported that Citi ran pilot campaigns for brands in retail, payments, technology, and health and beauty before the broader launch.
According to those reports, Citi said two pilot campaigns produced an average 15% increase in spending among customers exposed to the ads compared with customers who were not. That is a company-reported marketing result. Public reporting reviewed for this article does not provide the campaign sizes, selection method, statistical significance, time period, or a breakdown by advertiser, so the figure should not be treated as an independently validated measure of effectiveness.
The commercial logic is straightforward. A bank can observe purchases across many merchants, giving it a wider view of spending than a single retailer’s media network. Citi executive Abhinav Anand told Business Insider that spending patterns are the platform’s primary targeting signal. The same reporting said ads may appear in Citi’s app and website or on third-party properties, with a travel offer shown on Facebook given as an example.
That cross-channel reach matters because it changes the customer’s context. A reward displayed after a customer opens a banking app is visibly connected to the bank. An ad selected from bank-observed spending but delivered elsewhere may make the role of the financial institution and the source of the targeting signal less obvious.
Reporting describes an opt-out model
Business Insider reported that Citi customers must opt out if they do not want to see the ads. Citi’s general U.S. online privacy notice separately says the bank collects transaction history and merchant-category information and may use personal information for tailored advertising on Citi services and third-party sites. The notice also directs users to a Privacy Hub to exercise rights, including an opt-out from the sale of personal information or sharing with third parties.
Those documents do not make every control boundary clear for this specific product. The public materials reviewed do not explain in one place whether enrollment in Citi Commerce Media is automatic for all eligible cardholders, how the program-specific opt-out relates to cookie choices and state-law privacy requests, how quickly a preference propagates across outside channels, or whether a customer can stop transaction-based targeting while continuing to receive ordinary card rewards.
That absence in public-facing material is not proof that internal controls are missing. It is a disclosure limitation. For customers and compliance teams, the practical test is whether the choice is easy to find, applies consistently across channels and is expressed in language that distinguishes the use of bank transaction data from ordinary web-browsing cookies.
Data minimization and separation need precise answers
The reports do not say that Citi gives advertisers identifiable transaction histories. They say Citi uses spending data to create target audiences and measure campaign results. The distinction is important: audience selection can occur without handing raw account records to a brand, but it still requires rules governing how payment data is transformed, matched, retained and activated.
Controls should separate the bank’s financial-services records from the advertising operation and define which merchant categories may be used for targeting. Sensitive inferences can arise from ordinary card transactions even when an advertiser never sees the underlying purchase. Health, religion, political activity, addiction treatment, debt stress and other sensitive circumstances can sometimes be inferred from where and how a person spends.
Public materials reviewed for this article do not specify excluded categories, minimum audience sizes, limits on sensitive segmentation, retention periods, advertiser access to measurement data, or the technical method used to deliver audiences to third-party platforms. These are questions for governance and disclosure, not evidence that Citi is using any particular sensitive category.
Accountability extends beyond Citi
A financial media network involves more than a bank and an advertiser. Ad-technology vendors, social platforms and measurement providers may participate in campaign delivery or reporting. Each connection creates a potential control point for audience leakage, re-identification, unauthorized reuse or a preference that fails to propagate.
For payments and compliance professionals, a defensible operating model should document the legal basis for each use, isolate raw transaction records, restrict sensitive categories, test suppression and opt-out flows, monitor partners, limit measurement outputs, and preserve an audit trail showing why an individual was included or excluded from a campaign. Customer complaints should be traceable across the bank, the advertiser and any delivery platform rather than disappearing between contracts.
Citi is entering a market already pursued by JPMorgan Chase, PayPal, Mastercard and American Express. That competition increases the importance of a clear standard: payment data can make advertising more measurable, but the resulting revenue should not depend on customers being unable to tell that their spending history is shaping the ads they see or unable to stop it without friction.