The CFPB's privacy rules cover this at §1016.4(d) where it states: Existing customers—
When an existing customer obtains a new financial product or service from you that is to be used primarily for personal, family, or household purposes, you satisfy the initial notice requirements of paragraph (a) of this section as follows:
(1) You may provide a revised privacy notice, under §1016.8, that covers the customer's new financial product or service; or
(2) If the initial, revised, or annual notice that you most recently provided to that customer was accurate with respect to the new financial product or service, you do not need to provide a new privacy notice under paragraph (a) of this section.