Below is a structured, Philippine-context overview of everything you need to know about this topic, as a legal-style article. This is general information, not a substitute for advice from your own lawyer.

I. Legal Framework Governing Online Lending and Debt Collection

Several laws and regulators overlap when it comes to online lending apps and their collection practices:

Data Privacy Act of 2012 (DPA) – Republic Act No. 10173
- Protects personal information processed by companies, including lending apps.
- Requires:
  - Lawful basis for processing data (e.g., consent, contract, legal obligation).
  - Transparency (clear privacy notices).
  - Proportionality (collect only what is necessary).
- Grants rights to data subjects, such as:
  - Right to be informed.
  - Right to object.
  - Right to access and correct data.
  - Right to suspend, withdraw, or block processing under certain conditions.
- Enforced by the National Privacy Commission (NPC), which can order companies to stop unlawful processing, impose penalties, and recommend criminal prosecution.
Financial Products and Services Consumer Protection Act – RA 11765
- Aims to protect consumers of financial products, including digital lending.
- Recognizes the right to fair and respectful treatment, and the right to data privacy and protection.
- Gives stronger powers to:
  - Bangko Sentral ng Pilipinas (BSP) – for banks, e-money issuers and BSP-supervised financial institutions.
  - Securities and Exchange Commission (SEC) – for lending and financing companies and their online platforms.
- Implementing regulations and circulars require fair debt collection practices and prohibit harassment.
SEC Regulations on Lending and Financing Companies
- Lending and financing companies must be registered with the SEC and must comply with:
  - Rules on online lending platforms (OLPs).
  - Rules against unfair or abusive collection practices (e.g., harassment, public shaming, contacting people unrelated to the loan just to pressure the borrower).
- The SEC has, in practice, suspended or revoked licenses of companies using abusive online collection methods.
Other Relevant Laws
- Civil Code – protects rights to privacy, dignity, and provides basis for damages (moral, exemplary, etc.).
- Revised Penal Code – may apply where debt collection goes too far, such as:
  - Grave threats.
  - Grave coercion.
  - Unjust vexation.
  - Libel or slander (if they defame you to others).
- Cybercrime Prevention Act – can apply when harassment or libel is committed through electronic means (e.g., social media, online messaging).

All of these intersect when an online lending app accesses your contacts and calls or texts them.

II. Can a Lending App Collect Your Contacts from Your Phone?

1. Access to Contacts Requires Valid, Informed Consent

Under the Data Privacy Act:

Your contacts list (names, phone numbers, emails) is personal information of other people, not just yours.
For the app to lawfully access it, it must have:
- A clear, specific purpose.
- Informed consent – you must be told:
  - What data is being collected (e.g., all contacts, including non-borrowers).
  - Why it’s needed (e.g., for account verification).
  - How it will be used (not just generic “for services”).
Consent must be:
- Freely given – not forced by deception.
- Specific – not blanket consent “for any purpose.”
- Informed – you actually understand the implications.
- Documented – the company should be able to prove it.

Simply clicking “Allow” on a permission pop-up does not automatically make any and all uses of your contacts lawful. If the purpose is vague or disproportionate, it may violate the DPA.

2. Proportionality and Necessity

Even with consent:

The collection must be proportionate and necessary for a legitimate purpose.
Typical legitimate reasons to ask for some contacts might include:
- Confirming your identity or employment.
- Identifying emergency contact or co-maker/guarantor.
Bulk harvesting your entire contact list just so they can threaten or shame your friends and relatives is not necessary for granting or managing a loan, and is generally inconsistent with data privacy principles.

III. Can They Call or Message Your Contacts to Demand Payment?

1. General Rule: No, They Cannot Freely Contact Your Contacts

As a rule:

A lender or collection agent should directly communicate with you, the borrower, through your:
- Provided phone numbers.
- Email address.
- Mailing address or in-app messages.
They may contact co-borrowers, co-makers, or guarantors who are contractually liable on the loan, or references (within reasonable bounds and for legitimate verification purposes).
BUT contacting random people from your phonebook or social media to say:
- “Si [Name] may utang sa amin,” or
- “Scammer ‘yan, may delinquent loan,” solely to shame or pressure you, is generally considered:
- Unfair collection practice, and
- A likely data privacy violation.

2. Co-Makers, Guarantors, and References: Special Case

If you explicitly identified someone as:

Co-maker or co-borrower – they share liability. Contacting them about the loan is usually allowed, but still must be done respectfully and within legal limits.
Guarantor or surety – they have a contractual obligation; they can be notified if you default.
Character/emergency reference – lending apps sometimes ask for references. Contacting a reference once or a few times to:
- Verify your identity or location, or
- Confirm your contact details, may be legitimate—but using that reference to repeatedly pressure, harass, or embarrass you through that person crosses the line.

Simply being in your contacts list does not make someone a reference or guarantor.

3. Use of Contacts for “Shaming”: Typically Illegal

Common abusive practices of some shady lending apps include:

Sending mass texts to your contacts saying you are a “scammer” or “delinquent.”
Sending edited photos or messages meant to humiliate you.
Creating group chats with your relatives or coworkers to shame you.
Calling employers or HR to tell them about your personal debt.

These tactics can amount to:

Unlawful processing of personal data (Data Privacy Act).
Unfair or abusive collection practices (violating SEC or BSP rules).
Defamation, grave threats, grave coercion, or unjust vexation under the Penal Code.
Grounds for civil liability (damages for humiliation, mental anguish).

IV. What Debt Collection Practices Are Allowed?

Legitimate lenders and collectors may:

Remind you of payment due via:
- Text, email, or calls to your registered contact information.
- In-app notifications or official letters.
Call You During Reasonable Hours
- Usually within standard business hours or early evening, not late at night or at dawn.
- Reasonable frequency (not dozens of calls in a row with intent to annoy).
Provide Accurate Information
- Amount owed, due dates, penalties/interest.
- Consequences of non-payment:
  - Reporting to credit bureaus (if applicable).
  - Possible civil action (e.g., collection suits, small claims).
Escalate to Legal Collection
- Endorse the account to legitimate collection agencies (who must follow the same rules).
- File civil cases or other lawful remedies.
- Negotiate restructuring or settlement.

All of this must be done in a manner that is respectful, truthful, and not harassing.

V. What Practices Are Prohibited or Questionable?

While exact wording depends on specific regulations and circulars, the following are commonly regarded as prohibited or abusive:

Harassment and Intimidation
- Threats of physical harm or violence.
- Threats to harm your reputation unless you pay.
- Constantly ringing your phone to annoy or intimidate you.
Public Shaming
- Posting about your debt on social media.
- Sending mass messages to your contacts announcing your unpaid loan.
- Creating group chats with your family, co-workers, or social circle to shame you.
False Threats of Arrest or Criminal Charges
- “Papakulong ka namin dahil hindi ka nagbayad.”
  - Non-payment of a purely civil loan is not a crime.
  - You can be sued civilly but not jailed just for failing to pay (separate from special cases like bouncing checks or fraud, which are different issues).
Misrepresentation
- Pretending to be from law enforcement, a court, or a government agency when they are not.
- Claiming there is already a “warrant of arrest” when there is none.
- Using fake “legal notices” with seals to scare you.
Contacting Unrelated Third Parties
- Calling or texting people in your phonebook who have nothing to do with the loan.
- Disclosing your debt and personal data to them.
- Asking them to “pressure” you or warning them about you as a “scammer.”
Use of Your Photos or Personal Media for Blackmail
- Using your selfie, ID, or other images submitted for KYC to threaten you:
  - “Ipapakalat namin picture mo sa social media.”
- This can fall under multiple criminal and privacy violations.

VI. Legal Consequences for Abusive Online Lenders

Entities that engage in these practices face potential liability under several regimes:

1. Under the Data Privacy Act

Administrative sanctions from the NPC:
- Orders to stop unlawful processing.
- Fines, suspension, or blacklisting in extreme cases.
Criminal liability (for willful and/or malicious violations) for:
- Unauthorized processing.
- Improper disposal.
- Malicious disclosure.
Personal liability of officers who allowed or directed the unlawful acts.

2. Under SEC and BSP Regulations

Suspension or revocation of license to operate as:
- Lending company.
- Financing company.
- Online lending platform.
Fines and penalties for violation of circulars on collection and consumer protection.
Orders to cease abusive collection practices, modify policies, and improve data governance.

3. Civil Liability

Borrowers may file civil cases for:

Invasion of privacy.
Defamation (libel or slander).
Mental anguish, wounded feelings, social humiliation (moral damages).
Exemplary damages to deter similar conduct.
Attorney’s fees and costs of suit, if granted by the court.

4. Criminal Liability

Depending on the conduct, company officers, employees, or collection agents may face charges for:

Libel (if done in a public or electronic forum).
Grave threats or grave coercion.
Unjust vexation.
Cybercrime-related offenses if done through information and communications technology.

VII. What Are Your Rights as a Borrower?

You generally have the right to:

Fair and Respectful Treatment
- No harassment, humiliation, or threats.
- No abusive language or intimidation.
Data Privacy Rights
- To be informed how your data (including contacts) is collected and used.
- To object to certain processing of your data.
- To ask for correction or deletion of data, where applicable.
- To withdraw consent in some situations, subject to the effects on the contract.
Clear Information on the Loan
- Interest rates, fees, and penalties.
- Computation of total obligations.
- Available payment channels.
Effective Complaint Mechanisms
- Internal complaints mechanisms with the lender or platform.
- Right to elevate disputes to regulators (NPC, SEC, BSP, etc.).

VIII. What Can You Do If a Lending App Calls or Messages Your Contacts?

If an online lending app is already harassing you by contacting your contacts, consider the following steps:

Document Everything
- Screenshots of messages to you and to your contacts.
- Call logs and recordings (if legally made).
- Names and numbers used by the collectors.
- Statements or screenshots from your contacts showing what was sent to them.
Formally Complain to the Lender
- Use official customer service channels or email.
- Clearly state:
  - The abusive behavior (e.g. contacting your mother, co-workers, etc.).
  - The laws you believe they are violating (Data Privacy Act, unfair collection practices).
  - That you demand they stop contacting third parties and process only necessary data.
File a Complaint with the NPC (for Privacy Violations)
- Particularly where:
  - Your contacts were accessed and used without a proper lawful basis.
  - Your personal data and that of other people has been misused or over-collected.
- Complaints typically include:
  - Your narrative.
  - Supporting documents (screenshots, emails, etc.).
File a Complaint with the SEC or BSP (for Abusive Collection)
- SEC – for lending or financing companies and online lending platforms.
- BSP – for banks and BSP-supervised financial institutions.
- Include:
  - Company name, app name, registration details if known.
  - Evidence of harassment and unfair collection.
Consider Police Reports and Legal Counsel
- For severe threats, blackmail, or defamation:
  - File a police blotter or report with the cybercrime unit.
- Consult a lawyer, especially if:
  - The harassment is severe.
  - Your employer, business, or reputation has been seriously harmed.
  - You plan to file civil or criminal cases.
Continue to Deal With the Underlying Debt Separately
- The illegality of their collection methods does not automatically erase the debt.
- You can:
  - Negotiate better terms.
  - Transfer or restructure debt to a more reputable lender if possible.
  - Seek advice on your options.

IX. How to Protect Yourself Before Borrowing from an Online Lending App

Check if the Lender Is Legitimate
- Confirm if the company is properly registered (e.g. with SEC or BSP).
- Beware of apps with no clear entity behind them or with poor/disappearing contact details.
Review Permissions Carefully
- If the app insists on reading all your contacts, photos, or messages:
  - Ask yourself: Is this really necessary to evaluate my loan?
- Be cautious about granting very broad permissions.
Read the Privacy Notice
- Look for:
  - Specific purposes for data collection.
  - Whether they mention contacting your contacts.
  - How long data will be kept.
- If it’s vague or clearly one-sided, reconsider.
Limit the Data You Provide
- Provide only necessary references or contacts, not your entire phonebook.
- Avoid sending extra personal photos or documents not directly required.
Use Reputable Financial Platforms Where Possible
- Formal banks and well-regulated providers typically have stricter compliance systems and clearer complaint mechanisms.

X. Frequently Asked Questions

1. Can an online lending app have me arrested for not paying?

Generally, no.

Failure to pay a purely civil loan is typically a civil matter, not criminal.
They can:
- Sue you in civil court.
- Endorse to collection agencies.
- Report to credit bureaus (if applicable).
They cannot simply “have you arrested” just because you did not pay an unsecured loan.

(Separate laws may apply to things like bouncing checks or fraud, but that’s a different scenario.)

2. Is it legal for them to tell my boss or HR about my debt?

Usually, no, unless:

Your employer is explicitly a co-maker or guarantor (unusual), or
You clearly and specifically authorized such disclosure (also unusual).

Even then, shaming you or spreading unnecessary details may still be a violation of privacy, unfair collection rules, or even defamation.

3. Can they access my photos or gallery and threaten to post them?

Collecting photos solely for ID verification (e.g., government ID, selfie) can be legitimate.
Using those photos later as blackmail or public shaming is likely illegal under multiple laws (privacy, cybercrime, and possibly extortion/coercion).

XI. Conclusion

In the Philippine context, online lending apps are not generally allowed to call or message your contacts just to pressure you into paying. Doing so often violates:

The Data Privacy Act (unlawful processing and disclosure of personal data).
SEC/BSP rules on fair and ethical debt collection.
Potentially, provisions of the Civil Code, Revised Penal Code, and cybercrime laws.

Legitimate collection focuses on you, the borrower, and persons who are genuinely contractually liable—not on harassing your friends, relatives, co-workers, or employer.

If you experience this kind of harassment, you have options: document the abuse, complain to the lender and regulators, seek protection under data privacy and consumer protection laws, and consult a lawyer if needed.

If you’d like, I can help you draft a sample complaint letter or a formal message telling a lending app to stop contacting your contacts under the Data Privacy Act and consumer protection principles.