Digital lending platforms have brought millions of previously unbanked people into the formal financial system, particularly in emerging economies where traditional credit infrastructure is thin. To reach these borrowers, many platforms rely on alternative data such as call records, mobile usage patterns, and social network information. This is done not just to screen applicants but to enforce repayment after loans are disbursed. Privacy regulations that restrict access to such data are therefore not simply limiting what lenders know at origination; they are dismantling the enforcement mechanisms that made lending to high-risk populations viable in the first place.

This distinction matters. Prior research has documented that privacy regulation increases consumer willingness to engage with digital services (Tang 2019, Bian et al. 2021, Armantier et al. 2024) and can even boost loan applications (Doerr et al. 2023). These findings are encouraging. But they capture only the demand side. The question that remains largely unanswered is what happens on the supply side — specifically, whether the borrowers who gain confidence from stronger privacy protections are the same ones who lose access to credit when lenders can no longer enforce repayment through alternative data.

New evidence from India suggests the answer is no — and that the distributional consequences are severe (Agarwal et al. 2026).

A natural experiment in digital lending

In January 2019, Google prohibited Android applications distributed through the Play Store from accessing users’ call detail records (CDRs). For one of India’s largest digital lenders, this was not a minor data loss. Call detail records were the backbone of the platform’s enforcement system. By mapping each borrower’s social network including family, friends, and colleagues, the lender could contact these individuals in cases of delinquency. The implicit threat of social exposure created a form of collateral that kept default rates low and allowed the platform to extend credit to borrowers who would otherwise have been too risky to serve.

Google’s policy affected only Android users. iOS users, borrowing from the same lender under identical terms, were unaffected. This platform-specific shock creates a clean natural experiment: by comparing Android and iOS borrowers before and after 1 January 2019, we can isolate the causal effect of privacy regulation on both sides of the credit market. We complement this with a high-frequency event study that examines daily lending outcomes for Android users in a narrow window around the policy date, providing a regression-discontinuity-style check that does not rely on iOS users as a control group.

The analysis draws on application-level data from 2017 to 2022 on every loan request submitted to the platform, with detailed applicant characteristics including income, age, gender, caste, education, and credit scores. Critically, we link these records to India’s national credit bureau, which tracks formal borrowing from the universe of financial institutions. This allows us to follow each applicant’s credit trajectory for up to four years, regardless of whether subsequent loans come from the focal lender or from other institutions.

Borrowers want privacy; lenders need enforcement

Demand surges

After the policy change, Android users submitted 26% more loan applications relative to iOS users, controlling for location, time, and loan purpose. The high-frequency event study confirms an immediate 5.7% jump at the policy date itself. This response indicates that the requirement to share call records had been imposing a real cost on borrowers – a non-pecuniary ‘privacy tax’ that deterred participation. A structural model that rationalises this application response estimates that borrowers value the privacy protection at roughly 20.8–36.3% of monthly income: they would forego more than one-fifth to one-third of a month’s earnings to keep their call records out of the lender’s hands.

Supply contracts

The lender responded by dramatically tightening screening. Approval rates for Android applicants fell by 16-18 percentage points, a 25% decline relative to the sample mean. Interest rates and maturities barely moved, confirming that the lender adjusted on quantities rather than prices. The mechanism is straightforward: without call detail records, the lender lost the ability to discipline borrowers after disbursement and compensated by raising the bar for who gets a loan in the first place.

Default rates unchanged

Despite the dramatic shift from enforcement to screening, default rates showed no statistically or economically meaningful change. This confirms that the lender preserved portfolio quality by excluding borrowers who would have repaid under the old system, where social pressure kept them current.

Who bears the cost?

The screening tightening was not uniform. Low-income applicants experienced acceptance rate declines roughly 6.6 percentage points larger than higher-income applicants. Younger borrowers faced a 7.7 percentage point differential. First-time applicants — those with no prior relationship with the lender — saw a 25.4 percentage point gap relative to returning borrowers. Applicants from historically marginalised castes (Scheduled Castes, Scheduled Tribes, and Other Backward Classes) experienced an 8.1 percentage point larger decline than general-caste applicants.

By contrast, borrowers with established credit scores were largely unaffected. When the lender has hard information to assess risk, the loss of call detail record-based enforcement matters less. The implication is clear: call detail records were most valuable precisely for borrowers who lack conventional credit histories, the population that digital lending was designed to reach.

The long shadow of rejection

The most consequential finding concerns what happens after rejection. Using national credit bureau data, we track whether applicants obtained any formal credit from any lender in the economy over subsequent years. Android applicants affected by the policy were 2.2 percentage points less likely to access formal credit even four years later, representing a 6% decline relative to the baseline.

An instrumental variables analysis quantifies the mechanism: initial loan approval at the focal FinTech increases the probability of obtaining formal credit within four years by 13.7 percentage points. For marginal borrowers, those with thin files, limited collateral, and no prior banking relationships, that first loan serves as a stepping stone into the broader financial system. It generates a credit history, builds a repayment track record, and signals creditworthiness to other lenders. When privacy regulation blocks that first step, the consequences compound. This ‘FinTech ladder effect’ means that the short-run contraction in credit supply translates into persistent exclusion from formal finance.

Quantifying the trade-off

A structural model decomposes the welfare effects. For borrowers, the net effect is modestly positive: consumer surplus rises by 0.23-0.60%. The direct utility gain from privacy protection (+0.49–0.82%) more than offsets the loss from reduced approval rates (−0.22–0.26%). But this aggregate figure masks the concentrated harm to marginal borrowers, who bear the brunt of tighter screening without fully benefiting from the privacy gain.

For the lender, profits fall by 20.95-23.08%. The application margin contributes positively. More applicants mean more potential borrowers to select from, but this is overwhelmed by losses on the approval margin (fewer loans originated) and the surplus margin (lower expected profit per loan, as default predictions deteriorate without call detail record-based enforcement). The lender’s call detail record-based enforcement system was not merely informational; it was an economic asset whose removal destroyed value across the entire portfolio.

Implications for regulatory design

These findings carry direct lessons for the design of privacy regulation in digital finance.

First, blanket data restrictions can be regressive. The borrowers most harmed by the loss of call detail records access — low-income, young, first-time, and socially marginalised applicants — are precisely those whom digital lending platforms were created to serve. A well-intentioned privacy rule ended up reinforcing the exclusion it was meant to counteract.

Second, short-run analyses of credit supply understate the true cost. The long-run exclusion effects we document, persistent inability to access formal credit, even from other lenders, suggest that the welfare losses from privacy-induced credit rationing compound over time and extend well beyond the directly affected platform.

The broader lesson is that privacy regulation in credit markets requires the same distributional scrutiny that we apply to other financial regulations. Average welfare gains can coexist with concentrated harm to vulnerable populations. As policymakers design data protection frameworks for digital finance, the challenge is to safeguard consumer autonomy without inadvertently reconstructing the barriers to credit that digital lenders were built to dismantle.

References

Agarwal, S, P Ghosh, P Jin, S Kundu, N Vats, X Wang and Y Xu (2026), “When Privacy Protects but Excludes: The Costs and Benefits of Privacy Regulation in Credit Markets”, Olin Business School Center for Finance & Accounting Research Paper No. 2026/01. 

Armantier, O, S Doerr, J Frost, A Fuster and K Shue (2024), “Nothing to hide? Gender and age differences in willingness to share data”, BIS Working Papers No. 1187.

Bian, B, X Ma and H Tang (2021), “The supply and demand for data privacy: Evidence from mobile apps”, Working Paper.

Doerr, S, L Gambacorta, L Guiso and M Sanchez del Villar (2023), “Privacy regulation and fintech lending”, BIS Working Papers No. 1103.

Tang, H (2019), “The value of privacy: Evidence from online borrowers”, Working Paper.