Private lending runs on personal information. Every loan file holds Social Security numbers, tax returns, bank statements, and driver’s licenses. Even when the borrower is an LLC, the guarantors and principals behind it are individuals, and if they live in California, the California Consumer Privacy Act (CCPA) may govern how you collect, use, store, and share the personal information they give you.
Many lenders assume the CCPA is a law for technology companies and retailers. It is not. Whether it applies to your business comes down to two questions.
Question 1: Do you do business in California and collect personal information from California residents?
For most private lenders, the answer is yes. You do not need a California office. If you lend on California property, take applications from California borrowers, or accept guaranties from California residents, you should assume you do business in California. You also collect personal information on nearly every deal.
If you answered “No”, the CCPA does not apply to your business!
If you answered “Yes”, continue reading.
Question 2: Does your business exceed the revenue threshold?
For nearly every private lender, coverage turns on a single number. The CCPA applies to a business with annual gross revenue above $26,625,000 in the prior calendar year, a figure the California Privacy Protection Agency adjusts for inflation every two years. The test is total worldwide gross revenue, not California revenue alone. Affiliated entities that share common control, common branding, and personal information can be combined for purposes of the threshold.
If you answered yes to Questions 1 & Question 2, the CCPA applies to your business!
California Consumer Privacy Act Requirements for Private Lenders
Once the CCPA applies, your business needs, at a minimum:
- A Compliant Website and Privacy Policy. The CCPA requires a California-specific privacy policy posted on your website. If your website uses advertising pixels or tags from platforms like Google, Meta, or LinkedIn to retarget visitors or build ad audiences, that is treated as “sharing” personal information under the CCPA and triggers the Do Not Sell or Share requirements.
- Notice at Collection. Borrowers and guarantors must be told what you are collecting and why, before the time you collect it. For a lender, that means before the loan application stage, not the closing table.
- A Process For Consumer Requests. California residents have the right to know what information you hold, to request deletion or correction, and to opt out of certain uses. You need a written procedure and a way to meet the response deadlines. Consumer opt-out requests must be honored.
- Compliant vendor contracts. Loan servicers, credit bureaus, and other vendors that handle borrower information must be under contracts containing specific CCPA terms. A confidentiality clause and/or NDA is not enough.
CCPA Penalties and Enforcement
The California Attorney General is actively enforcing the CCPA and publishes information about enforcement actions. Penalties reach up to $2,663 per violation and $7,988 per intentional violation with no cap on total exposure. A data breach caused by inadequate security can give consumers a private right of action with statutory damages of $107 to $799 per person per incident. For a lender managing hundreds if not thousands of borrower files, that exposure is significant.
New Obligations Arriving in 2027 and 2028
Regulations that took effect on January 1, 2026 add three requirements that phase in over the next several years, and each one reaches directly into lending operations.
- Automated decision-making technology. If you rely on automated underwriting or scoring tools to make lending decisions, new pre-use notice, opt-out, and access requirements apply beginning January 1, 2027.
- Risk assessments. A business that processes sensitive personal information, which includes Social Security and driver’s license numbers, must conduct and document a formal risk assessment. For processing already underway on January 1, 2026, the assessment must be completed by December 31, 2027, with the first attestations and summaries due to the California Privacy Protection Agency by April 1, 2028.
- Cybersecurity Audits. Businesses that process personal information above certain volume thresholds must complete an annual independent cybersecurity audit and certify completion to the Agency, with the first certifications due between April 1, 2028 and April 1, 2030 depending on revenue.
Fortra Law Is Here to Help
At Fortra Law, we work with private lending clients to build CCPA compliance programs that are practical, complete, and tailored to the way lending businesses actually operate. Whether you need a full compliance assessment to find out exactly where your gaps are, help drafting your privacy policy and notices, a review and update of your vendor and servicer contracts, or ongoing support as the law continues to evolve, our team is ready to walk you through every step.
You do not need to figure this out alone. Reach out to Fortra Law today and let us help you get your compliance program where it needs to be.
