Privacy regulation and fintech lending
June 2023, revised April 2026
Summary
Focus
When designing privacy protection regulation, regulators face a challenging trade-off. On one hand, individuals are reluctant to share their personal data due to concerns about potential abuse or misuse. To protect consumers' privacy, regulators may consider limiting or even prohibiting the collection of personal data. On the other hand, data play a vital role for data-intensive firms like fintechs, which rely heavily on personal information to screen and price borrowers. Privacy regulation could thus potentially hinder the growth of fintechs and weaken competition in the financial sector.
Contribution
Our paper focuses on the effects of the California Consumer Privacy Act (CCPA) on bank and fintech lending in the US mortgage market. The CCPA represents a landmark change in the design of privacy regulation as it aims to protect consumers without imposing general restrictions on information collection. Introduced in 2020, it grants California residents the right to control their data, even after they have shared them with a firm. The CCPA has reduced uncertainty around the use of personal data and has made applicants more willing to share their data. Many other states are now considering the introduction of similar legislation, and the CCPA is serving as a model for the US Congress in developing federal privacy protection regulations. Our paper offers an initial analysis of the CCPA's impact on loan markets.
Findings
We find that, following the introduction of the CCPA, loan applications to fintechs increase by significantly more than those to traditional banks, leading to an increase in fintechs' market share by up to 19%. This increase can be attributed to applicants' increased willingness to share their data. Fintechs, taking advantage of this data, expand their utilisation of information beyond traditional credit scores during the application process. Consequently, they engage in more personalised pricing and reject a larger proportion of applications. These findings suggest that fintechs enhance their screening process, leading to an improvement in the quality of their average borrower. As a result, fintechs are able to offer significantly lower loan rates than banks can following the CCPA's implementation. In sum, the CCPA has benefited consumers by providing fintech lenders, equipped with advanced screening technology, with improved access to data.
Abstract
Consumers dislike sharing data with fintechs, but greater access to data can improve loan market outcomes through better screening. We study how the California Consumer Privacy Act (CCPA), which grants users control over and mitigates concerns about sharing their data, affects fintech lending. After the CCPA's introduction, fintechs' loan rates decline relative to those of other lenders. In addition, rate dispersion across fintech loans increases, fintechs deny more applications, and they make greater use of nontraditional credit scoring models, whereas their default rates decline by more than those of other lenders. These results are consistent with an improved screening process enabled by additional data. Mortgage originations by fintechs also increase, suggesting that well-designed privacy regulation may enhance financial inclusion.
JEL classification: G21, G23, G28
Keywords: data privacy, data sharing, fintech, privacy regulation, CCPA
