# CCPA for Lenders: Where GLBA Stops and CCPA Starts

- Author: TrueBankFlow (https://truebankflow.com)
- Published: 2026-10-17
- Category: Lending compliance and borrower data
- Canonical: https://truebankflow.com/blog/ccpa-for-lenders

> How CCPA for lenders works alongside GLBA: which borrower data is exempt, which is not, deletion requests and notices for California residents.
The CCPA for lenders works data by data, not company by company. Personal information collected under the Gramm-Leach-Bliley Act is exempt, so a consumer loan file usually falls outside it. Marketing leads, website data and business-purpose applicants often do not. The CCPA's breach lawsuit section reaches a covered lender's files, GLBA or not.

## Where does GLBA stop and CCPA for lenders start?

GLBA stops and CCPA starts at the edge of the data GLBA covers. The California statute does not exempt financial institutions as businesses. It exempts personal information collected, processed, sold or disclosed subject to GLBA. Any other personal information a lender holds about California residents stays under the CCPA.

The text sits in section 1798.145(e) of the [California Consumer Privacy Act as published by the California Privacy Protection Agency](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf). It names GLBA and its regulations, the California Financial Information Privacy Act and the Farm Credit Act. Its last sentence says the exemption does not apply to section 1798.150, the private right of action for data breaches.

GLBA, in turn, has its own limit. Under [Regulation P's definitions in section 1016.3](https://www.consumerfinance.gov/rules-policy/regulations/1016/3/), a consumer is an individual who obtains a financial product or service to be used primarily for personal, family or household purposes. Information a consumer provides on a loan application is covered. Credit for a business is outside that definition.

## Borrower data the CCPA still reaches at a lender

The CCPA still reaches lender data that GLBA never covered: people who only browsed or filled in a lead form, information about individuals tied to business credit, and data used for marketing rather than for a financial product.

The CCPA applies only to a lender that meets one of its size thresholds, such as gross annual revenue over $25 million, a figure the statute adjusts for inflation. The table below sorts common records. It is an example to start a data inventory, not a legal conclusion for your files.

| Record | Likely regime | Why |
| --- | --- | --- |
| Personal loan application and statements | GLBA | Consumer credit for personal use |
| Mortgage asset statements used for [verifying funds to close](/blog/verifying-funds-to-close) | GLBA | Part of a consumer mortgage file |
| Website analytics and cookies before applying | CCPA | Not collected to provide a financial product |
| Purchased marketing leads | CCPA | No financial relationship yet |
| Business owner's details on a business loan | CCPA | Credit is for business purposes |
| Merchant owner on an advance | CCPA | Not consumer credit; see [whether an MCA is a loan](/blog/is-a-merchant-cash-advance-a-loan) |

The business rows surprise many small business lenders. The owner's name, Social Security number and personal guarantee details are personal information about a California resident, and GLBA's consumer definition does not reach them.

## How should a lender answer a CCPA deletion request?

A lender answers a CCPA deletion request by sorting the requester's data into GLBA-covered and CCPA-covered records, deleting what the CCPA reaches unless an exception applies, and explaining the result. The [California Attorney General's CCPA page](https://oag.ca.gov/privacy/ccpa) says businesses must respond to requests to delete within 45 calendar days, extendable once by 45 more with notice.

Steps that hold up:

1. **Verify the requester.** Match them to your records before acting.
2. **Find every copy.** Loan system, upload portal, analysis tool, email and marketing lists.
3. **Separate GLBA data.** The consumer loan file is exempt from the CCPA request, but still follows your Safeguards Rule disposal schedule.
4. **Delete or explain.** Remove marketing and lead data. For records you keep under an exception, such as a legal retention duty, say so.
5. **Tell your vendors.** The right to delete extends to service providers.

One person can sit on both sides. A borrower who first arrived as a purchased lead has a CCPA-covered lead record and a GLBA-covered loan file. Delete the lead record and the marketing history, keep the loan file under its own schedule, and tell the person which is which in plain words.

## CCPA breach lawsuits and lender bank statement files

CCPA breach lawsuits reach a lender's bank statement files even when GLBA covers them. Section 1798.150 lets a California resident sue when nonencrypted and nonredacted personal information is stolen or disclosed because the business failed to keep reasonable security. Statutory damages run from $100 to $750 per consumer per incident, adjusted for inflation, or actual damages if greater.

Encryption is the plain defense. The claim depends on the information being nonencrypted and nonredacted. Statements stored encrypted, in a system with limited access, are a smaller target. [TrueBankFlow](/) keeps uploaded statements encrypted in transit and at rest and limits access to your own team.

## CCPA notices for California applicants at collection

CCPA notices for California applicants are due at or before the point a lender collects personal information outside GLBA. The notice at collection lists the categories of information collected and the purposes, and links to the privacy policy. If the lender sells or shares information, it also needs a Do Not Sell or Share link.

For a lender, that usually means two notices. The GLBA privacy notice covers the consumer file. The CCPA notice covers the website, the lead form and business-purpose applications. Put the CCPA notice where the data enters: the lead form, the first application screen and the business application. If applicants sign electronically, deliver it in the same flow as your [E-SIGN consent for loan documents](/blog/esign-consent-for-loan-documents), so the record shows what they saw.