Privacy Comes at a Cost for Fintech Borrowers

Consumers in India welcomed an end to intrusive data mining, but it made it harder to get the loans

Fintech firms have become a lifeline for consumers who need a loan but lack the golden tickets — a strong credit score and stable income — required by traditional lenders. These firms leverage technology to mine alternative data that isn’t part of traditional credit scoring to suss out whether a higher-risk borrower is actually worth the risk. Artificial intelligence has turbocharged the lenders’ ability to collect and analyze nontraditional data.

But like all things digital, there is an implicit tension in how the ability to mine alternative data intersects with privacy.

In a working paper, National University of Singapore’s Sumit Agarwal, Peiyi Jin and Xinbo Wang, Indian Institute of Management Bangalore’s Pulak Ghosh, UCLA Anderson’s Shohini Kundu and Washington University in St. Louis’ Nishant Vats and Yingze Xu find that a real-world tightening of privacy in India — one that consumers welcomed — came with a costly consequence. With less data to work with, a large fintech lender approved significantly fewer loans.

The borrowers most likely to get shut out were younger applicants, lower-income borrowers, first-time borrowers and those from historically marginalized communities — the very people fintech lending is built to reach. 

And the damage doesn’t stop at a single rejected loan. The researchers note the structural importance of what they call the fintech ladder effect: Borrowers who successfully obtain and repay a fintech loan are effectively building a credit profile that can eventually give them access to the mainstream financial system. The researchers estimate that getting an initial fintech loan increases the probability of accessing any type of formal credit over the next four years by 13.7 percentage points. Fail to get past that first rung and your odds of moving into the financial mainstream are diminished. 

This unintentional consequence echoes other research suggesting that stricter data privacy protections can impede certain forms of economic activity. Europe’s much lauded tightening of consumer data privacy nearly a decade ago has seemingly also contributed to a decline in drug development, as building robust clinical trials has become harder.

Alternative Data That Crosses a Line

The researchers leveraged a 2019 policy change that curtailed a form of data mining in India that will seem wildly aggressive to American consumers. Up until then, borrowers using fintech lending apps were typically required to grant access to their phone data — contacts, call logs and SMS metadata — as a condition of getting a loan.

The polite framing is that sharing this personal phone activity created “social collateral.” Because borrowers often lacked physical assets, their social network effectively stood in as a form of guarantee. The practical reality is that it created a threat bordering on reputational ransom. Fall behind on a payment, and the lender had the ability to contact people in a borrower’s network — friends, family, even colleagues — to pressure repayment. 

In 2019, Google updated its developer policy to prohibit Android apps from accessing that data for lending purposes. This gave the researchers a clean real-world testing ground to study how increased data privacy affected both the demand for and supply of fintech loans. While Android users — who make up roughly 92% of the market — gained new protections, iPhone users did not, effectively making them a natural control group.

Drawing on a proprietary dataset of more than 200,000 loan applications from a large Indian fintech lender spanning 2017 to 2022, the researchers document that consumers seemed to be quite relieved. Among Android users, loan applications rose by about 26% after the policy change, consistent with borrowers placing real value on increased privacy, let alone the removal of the reputational threat within their social circles. There was no significant change in applications from iPhone users. 

The lender had the opposite reaction. Stripped of both valuable alternative data and a key collection mechanism, it had less ability to manage risk. Approvals fell by 16 to 18 percentage points. Yet default rates on approved loans remained essentially unchanged — meaning the lender maintained portfolio performance, but only by becoming significantly more selective about who got a loan in the first place. Many borrowers who would likely have been approved under the prior regime were turned away. The researchers suggest that the lender’s 20%-23% profit decline they document was driven largely by reduced loan volume rather than poorer loan performance.

The researchers are careful to note that while the data privacy change closed off borrowing for more consumers, that audience seems to be OK with the trade-off. The research team modeled the overall welfare effect, weighing the value borrowers place on enhanced privacy against the cost of reduced access to credit. They calculate that borrowers value increased privacy at the equivalent of 20.8%-36.3% of monthly income. That benefit is large enough to outweigh the cost of reduced credit access, resulting in a modest net gain in consumer well-being — the researchers estimate a 0.23%-0.60% increase in this “consumer surplus.”

While that trade-off may be more valued in a market where the privacy intrusion being curtailed was so extreme, the underlying dynamic is not unique to India. Protecting consumer data is a worthy goal. But for borrowers without assets, without credit histories, and without alternative funding sources, their personal data is a valuable currency. Remove it from the loan process, and access suffers. To the extent the overriding goal is to bring more consumers into the mainstream financial system, that’s a costly trade-off for stakeholders to consider.