Online lending apps can be useful in an emergency, but they become dangerous when they demand excessive phone permissions, harvest your contacts, shame you on Facebook or Messenger, call your employer, or threaten your family over a loan. In the Philippines, you have legal rights over your personal data even if you borrowed money, even if you are delayed in payment, and even if you clicked “I agree” in the app. This article explains what online lending apps may and may not do, how to protect your phone and contacts, how to document harassment, and where to complain in the Philippines.
What personal data do online lending apps usually collect?
An online lending app may collect basic information needed to assess and process a loan, such as your name, mobile number, address, selfie, ID, income details, bank or e-wallet information, and loan history. Some apps also ask for access to your contacts, photos, location, camera, microphone, SMS, social media accounts, or installed apps.
The legal issue is not simply whether the app collected data. The bigger questions are:
- Was the data collection lawful, fair, and transparent?
- Was the data necessary for the loan?
- Were you clearly told what data would be collected and why?
- Did the app use your data only for the purpose disclosed?
- Did it disclose your loan information to people who had no legal need to know?
- Did it use your contacts or photos to pressure, shame, or threaten you?
Under the Philippine Data Privacy Act, “consent” must be freely given, specific, and informed, and it may be shown through written, electronic, or recorded means. The Act also defines a “data subject” as the individual whose personal information is processed. (National Privacy Commission)
Your legal rights under Philippine law
1. Your data privacy rights under RA 10173
The main law is Republic Act No. 10173, or the Data Privacy Act of 2012. If an online lending app processes your personal information, you are a data subject and you have enforceable rights.
Important rights include the right to be informed whether your personal information is being processed, the right to know the purpose, scope, method, recipients, controller identity, retention period, and available remedies, and the right to access information about what data was processed, where it came from, who received it, and why it was disclosed. (National Privacy Commission)
You also have the right to correct inaccurate data and, upon substantial proof, to suspend, withdraw, block, remove, or destroy personal information that is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary. The law also recognizes a right to damages for inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information. (National Privacy Commission)
In simple terms: being in debt does not erase your privacy rights. A lender may collect a legitimate debt, but it may not treat your phonebook, photos, workplace, or family as collection tools.
2. SEC rules on unfair debt collection
Most lending companies and financing companies in the Philippines are regulated by the Securities and Exchange Commission (SEC) under laws such as RA 9474, the Lending Company Regulation Act of 2007, and RA 8556, the Financing Company Act of 1998, as amended.
SEC Memorandum Circular No. 18, Series of 2019 specifically prohibits unfair debt collection practices by financing companies, lending companies, and third-party service providers hired by them. The circular covers abusive acts such as threats of violence or criminal means, threats to take action that cannot legally be taken, insults or profane language intended to abuse the borrower, and publication of names or personal information of borrowers who allegedly refuse to pay.
The same SEC circular treats as unfair the act of communicating or threatening to communicate false loan information, including a false claim that a debt is being disputed, and contacting borrowers at unreasonable hours, generally before 6:00 a.m. or after 10:00 p.m., subject to the circular’s stated exceptions. It also states that contacting people in the borrower’s contact list other than those named as guarantors or co-makers is an unfair debt collection practice, notwithstanding the borrower’s consent.
This is one of the most important protections for borrowers. If the app calls your mother, officemate, barangay captain, HR manager, or Facebook friend just because their number was in your phone contacts, that may be a serious red flag unless that person was actually named as a guarantor or co-maker.
3. Truth in Lending Act disclosures
RA 3765, the Truth in Lending Act, requires disclosure of finance charges and credit costs so borrowers can understand the true cost of credit before entering into a loan transaction. The SEC also lists Memorandum Circular No. 7, Series of 2011 as an issuance implementing the Truth in Lending Act for transaction transparency among financing and lending companies. (Lawphil)
Before borrowing, you should be able to see the loan amount, interest, processing fees, penalties, net proceeds, due date, and total amount payable. If an app advertises “0% interest” but deducts hidden fees or makes the repayment amount unclear, keep screenshots.
4. Civil Code protection against privacy invasion and humiliation
Even outside the Data Privacy Act, the Civil Code of the Philippines may apply. Articles 19, 20, and 21 require every person to act with justice, give everyone his due, observe honesty and good faith, and compensate another person for damage caused contrary to law, morals, good customs, or public policy. (Lawphil)
Article 26 also protects a person’s dignity, personality, privacy, and peace of mind. It recognizes civil actions for acts such as meddling with private life or humiliating another person because of personal condition. This can matter where debt collectors publicly shame a borrower or drag family and workplace relationships into a private loan dispute. (AMSLAW)
5. Possible criminal issues: threats, coercion, libel, and cybercrime
Depending on the facts, abusive collection may also involve criminal laws. Examples include:
- Grave threats under Article 282 of the Revised Penal Code, if a collector threatens harm that amounts to a crime.
- Coercion under Articles 286 or 287, if intimidation is used to force a person to do something against their will.
- Libel or cyberlibel, if defamatory statements are published online.
- Identity-related cybercrime or unauthorized access issues under RA 10175, the Cybercrime Prevention Act of 2012, depending on the conduct.
The Supreme Court in Disini v. Secretary of Justice, G.R. No. 203335 (2014) dealt with the constitutionality of the Cybercrime Prevention Act, including online libel issues. (Lawphil) For repeated harassment that causes distress but may not fit a heavier offense, Philippine jurisprudence on unjust vexation is also relevant; in Maderazo v. People, G.R. No. 165065 (2006), the Court discussed unjust vexation as conduct causing annoyance, irritation, or vexation. (Supreme Court E-Library)
How to protect your personal data before using an online lending app
1. Check if the lender is legitimate
Do not rely on Google Play, the App Store, Facebook ads, TikTok videos, or professional-looking websites. App-store availability is not the same as SEC authority.
Before applying, check:
| What to verify | Why it matters |
|---|---|
| Corporate name | The app name may be only a brand; you need the actual company behind it. |
| SEC registration number | Shows the entity is registered, but this alone is not enough. |
| Certificate of Authority number | Lending and financing companies need authority to operate. |
| Whether the online lending platform is recorded with SEC | An app may be connected to a company but still not properly recorded as an online platform. |
| Office address, customer service channel, and privacy notice | Legitimate lenders should be traceable and responsive. |
SEC Memorandum Circular No. 19, Series of 2019 covers disclosure requirements in advertisements of financing and lending companies and reporting of online lending platforms; the SEC lists it under financing and lending company issuances. (SEC Appointment System) Professional summaries of the circular state that financing and lending companies are required to disclose their corporate name, SEC registration number, Certificate of Authority number, and an advisory for borrowers to study the disclosure statement before proceeding. (PwC)
2. Read the permissions before installing
Be careful if the app asks for access to:
- Your full contacts list
- Photos and videos
- SMS messages
- Call logs
- Microphone
- Precise location
- Social media accounts
- Files unrelated to loan processing
A lending app may need your camera to capture an ID or selfie, but it usually should not need broad access to your entire phonebook, private gallery, messages, or social media. If the app refuses to proceed unless you allow excessive permissions, consider that a warning sign.
3. Use privacy settings immediately
On Android or iPhone, review app permissions after installation. Turn off anything not needed.
Common privacy steps:
- Go to Settings.
- Open Apps or Privacy & Security.
- Select the lending app.
- Disable access to contacts, photos, location, microphone, and SMS unless truly necessary.
- Disable background activity if available.
- Keep screenshots of the permissions requested.
If you already granted access before, disabling permissions later may not erase data already copied by the app. That is why early caution matters.
4. Do not upload unnecessary documents
Many borrowers panic and upload extra documents to “increase approval chances.” Avoid sending unnecessary files such as:
- Family members’ IDs
- Employer documents not required for the loan
- Children’s school records
- Utility bills under another person’s name
- Screenshots of private conversations
- Full bank statements when a limited proof of income would do
If the app requires a reference person, do not list someone without telling them. Do not list a person as guarantor or co-maker unless that person actually agreed to be legally bound.
What to do if an online lending app is already harassing you
Step 1: Secure evidence before blocking
Do not delete messages right away. First, collect proof.
Save:
- Screenshots of texts, chats, push notifications, emails, and Facebook messages
- Call logs showing date, time, and number
- Recordings, if available and lawfully obtained
- Screenshots of threats to contact your family, employer, or social media contacts
- Screenshots of posts publicly shaming you
- App permissions and privacy policy
- Loan disclosure statement, repayment schedule, and proof of payments
- Names, phone numbers, email addresses, and account names of collectors
- Screenshots from relatives or coworkers who were contacted
Make a simple timeline:
| Date and time | What happened | Evidence |
|---|---|---|
| Jan. 3, 9:15 p.m. | Collector threatened to message employer | Screenshot of SMS |
| Jan. 4, 7:30 a.m. | Mother received call about loan | Mother’s screenshot and statement |
| Jan. 5, 11:45 p.m. | Collector called after 10 p.m. | Call log |
| Jan. 6 | Facebook post with borrower’s photo | Screenshot and URL |
This timeline helps SEC, NPC, police, prosecutors, and courts understand the pattern quickly.
Step 2: Send a short written objection to the lender
Before filing with the NPC, it is usually helpful to show that you informed the personal information controller or lender and gave them a chance to act, unless the situation is urgent or dangerous.
Use a short message like this:
I object to the unauthorized use and disclosure of my personal data. I do not consent to your collectors contacting persons in my phone contacts, employer, relatives, friends, or social media connections who are not guarantors or co-makers. Please stop processing my personal data for harassment, public shaming, or disclosure of my loan information to unauthorized persons. Please also provide the identity and contact details of your Data Protection Officer, the source of the data used, the recipients of my data, and the legal basis for your processing.
Send it by email, in-app support, registered mail, or any channel that creates a record. Keep proof of sending.
Step 3: Revoke unnecessary app permissions and preserve your accounts
After saving evidence:
- Turn off the app’s access to contacts, photos, location, SMS, and microphone.
- Change passwords for email, e-wallets, social media, and banking apps.
- Enable two-factor authentication.
- Warn close contacts not to respond to collectors or send money to unknown accounts.
- Report fake profiles or public shaming posts to the platform.
- Avoid sending more IDs or selfies to “settle” harassment.
Deleting the app may reduce access going forward, but it does not cancel the debt and does not erase data already copied. Treat deletion as a privacy step, not a legal solution.
Step 4: File the right complaint with the right office
Different offices handle different issues.
| Problem | Where to report | What to prepare |
|---|---|---|
| Unauthorized use, disclosure, or harvesting of personal data | National Privacy Commission | Notarized complaint or assisted complaint form, evidence, timeline, proof you contacted the lender if available |
| Unfair debt collection by lending or financing company | SEC | Complaint, screenshots, loan details, company/app name, collector details |
| Threats, extortion, identity misuse, hacking, cyberlibel, fake posts | PNP Anti-Cybercrime Group or NBI Cybercrime Division | Screenshots with URLs, call logs, account names, device details, IDs |
| Local in-person harassment by an identifiable collector | Police station; barangay blotter may help document the incident | Name/description, video/CCTV, witnesses |
| Bank or credit card issue, not a lending app | BSP consumer assistance channels | Bank name, account details, complaint history |
| Credit report dispute | Credit Information Corporation or relevant credit bureau | Credit report, disputed entry, proof of payment or correction request |
The Credit Information Corporation itself notes that concerns involving lending and financing companies, online lending apps, and microfinance institutions should be directed to the SEC, while banks and credit card companies fall under the BSP. (Credit Information Corporation (CIC))
SEC also has the iMessage SEC platform for public complaints, inquiries, incidents, and requests, with ticket tracking. (Securities and Exchange Commission)
Step 5: File a privacy complaint with the NPC when data misuse is involved
For privacy violations, the National Privacy Commission is the main agency. The NPC states that a formal complaint must be in the required format, printed and filled out, notarized, and submitted personally, by courier, or by scanned email. (National Privacy Commission) The NPC also states that a complaint may be filed by the data subject, or by a representative authorized by a special power of attorney. (National Privacy Commission)
The NPC’s complaint guidance says a complainant should file a filled-out and notarized complaint-assisted form or verified complaint together with copies of evidence and witness affidavits, through personal filing, registered mail, courier, or authorized email filing. (National Privacy Commission)
Practical documents to prepare:
- Government ID
- Loan agreement, disclosure statement, or screenshots of loan details
- App name and company name
- Privacy policy and terms of service
- Screenshots of permissions requested
- Screenshots of harassment or disclosure
- Call logs and messages
- Statements from contacted relatives, coworkers, or friends
- Proof you asked the lender to stop, if available
- Notarized complaint form
- Special Power of Attorney, if someone else files for you
If you are abroad, check whether the NPC will accept scanned notarized submissions for your situation. For documents signed abroad and used in the Philippines, notarization before a Philippine Embassy or Consulate, or local notarization plus apostille depending on the country and document, may be required. The Philippine Embassy in Washington, D.C., for example, explains the general process for private documents as local notarization, apostille by the competent authority, then use in the Philippines. (Philippine Embassy)
Common real-life scenarios
“The app messaged my contacts even though they are not guarantors.”
Save screenshots from each contacted person. Ask them to send you the date, time, number or account used, and exact message received. Under SEC MC No. 18, contacting people in your contact list other than guarantors or co-makers may be an unfair collection practice. It may also support a privacy complaint if your loan information or personal data was disclosed without a lawful basis.
“They posted my photo and called me a scammer.”
Take screenshots showing the full post, URL, account name, date, time, reactions, and comments. Ask friends not to argue online because arguments can make the post spread further. Report the post to the platform, but preserve evidence first. Depending on the wording and facts, this may raise issues under data privacy law, SEC debt collection rules, Civil Code damages, and possibly cyberlibel.
“They said I will be arrested if I do not pay today.”
A simple unpaid private debt is generally a civil matter. There is no automatic arrest merely because you failed to pay a loan. However, fraud, falsified documents, bouncing checks, or other separate criminal acts may create different issues. If a collector falsely threatens arrest, jail, or police action to force payment, keep the message and include it in your SEC complaint.
“They keep calling late at night.”
Save call logs. SEC MC No. 18 treats contact before 6:00 a.m. or after 10:00 p.m. as unreasonable or inconvenient, subject to its stated exceptions. Repeated late-night calls may also support a complaint for harassment or unfair collection.
“I paid, but they still threaten me.”
Keep proof of payment: screenshots, reference numbers, receipts, bank or e-wallet confirmations, and any settlement agreement. Send a written demand for account reconciliation and correction of records. If the lender continues to disclose that you are unpaid despite proof, that can strengthen a privacy and regulatory complaint.
Practical timelines, fees, and bottlenecks
| Process | Typical timing in practice | Common bottlenecks |
|---|---|---|
| App customer service complaint | A few days to 2 weeks | No response, generic replies, app disappears |
| SEC ticket or complaint intake | Days to several weeks | Incomplete company details, missing screenshots, wrong app name |
| NPC complaint preparation | 1–7 days if evidence is complete | Notarization, lack of proof, failure to identify respondent |
| NPC proceedings | Often months, depending on complexity | Need for comments, mediation, investigation, volume of cases |
| Police/NBI cyber complaint | Same day intake possible, investigation varies | Need for original device, URLs, account identifiers, technical tracing |
| Platform takedown request | Hours to weeks | Post already shared, fake accounts, incomplete reporting |
The biggest bottleneck is usually not the law. It is evidence. Many borrowers delete the app, erase messages, change phones, or block everyone before saving proof. Preserve evidence first, then secure your accounts.
What not to do
Avoid these common mistakes:
- Do not ignore serious threats involving violence, stalking, or identity misuse.
- Do not post the collector’s personal information publicly in revenge.
- Do not send more IDs, selfies, or passwords to stop harassment.
- Do not pay a random GCash number unless you can verify it is an official payment channel.
- Do not sign a settlement admitting false facts just to stop calls.
- Do not assume a Facebook page, Telegram group, or app-store listing proves legitimacy.
- Do not rely only on a barangay complaint if the issue is data misuse by a regulated company.
- Do not delete evidence before filing with SEC, NPC, PNP, or NBI.
Frequently Asked Questions
Can online lending apps access my contacts in the Philippines?
They may ask for permission, but asking does not automatically make broad access lawful. The lender must still comply with the Data Privacy Act’s principles of lawful, fair, transparent, necessary, and proportionate processing. Under SEC MC No. 18, contacting people in your contact list other than guarantors or co-makers is treated as an unfair debt collection practice.
Can an online lending app post my name and photo online if I do not pay?
No lender should use public shaming as a collection method. Publication of names and personal information of borrowers who allegedly refuse to pay is identified in SEC MC No. 18 as an unfair collection practice, subject to the circular’s rules. It may also create data privacy, civil, or criminal issues depending on the facts.
Can I file a complaint even if I really owe money?
Yes. Your obligation to pay a lawful debt is separate from your right to privacy and protection from abusive collection. A lender can pursue lawful collection, but it cannot threaten, shame, deceive, or misuse your personal data.
Where do I report online lending app harassment in the Philippines?
Report privacy violations to the National Privacy Commission, unfair debt collection by lending or financing companies to the SEC, and threats, hacking, identity misuse, or cyberlibel to the PNP Anti-Cybercrime Group or NBI Cybercrime Division. Use the office that matches the conduct, and file with more than one office if the facts involve multiple violations.
Do I need a lawyer to file with the NPC or SEC?
Not always. Many complaints can be filed personally if your evidence is organized and your complaint is clear. A lawyer becomes more important if there are large damages, criminal accusations, settlement negotiations, identity theft, employer involvement, or court action.
Is deleting the lending app enough to protect my data?
No. Deleting the app may stop future access, but it may not erase data already collected or shared. Before deleting, save evidence, revoke permissions, secure your accounts, and send a written request or objection if appropriate.
Can foreigners file privacy complaints in the Philippines?
Yes, if their personal data is processed in a way covered by Philippine law, especially by an entity operating in the Philippines. Practical issues may include notarization, identity documents, and special powers of attorney if someone in the Philippines will file or follow up for them.
Can a lending app call my employer?
A lender should not disclose your loan information to your employer unless there is a lawful basis and the employer is genuinely involved, such as where the employer was properly authorized for verification or the person contacted is a guarantor or co-maker. Calling HR or your boss simply to shame you or pressure payment can be evidence of unfair collection and unauthorized disclosure.
Can I demand deletion of my data after paying the loan?
You may request blocking, removal, or destruction of personal information if it is unlawfully obtained, used for unauthorized purposes, no longer necessary, or falls under the grounds recognized by the Data Privacy Act. The lender may still retain some records required by law, regulation, accounting, tax, anti-fraud, or legitimate claims purposes, but it should not keep or use your data without a lawful basis.
What if the online lending app is unregistered?
Document everything and report it to the SEC. If there are threats, fake posts, identity misuse, or hacking, report those facts to cybercrime authorities as well. Do not assume that an unregistered app will respond to ordinary customer service complaints; prioritize evidence preservation and official reporting.
Key Takeaways
- Debt does not cancel privacy rights. Borrowers still have rights under the Data Privacy Act.
- Contacting your phone contacts is not automatically allowed. SEC rules treat contacting contacts other than guarantors or co-makers as an unfair collection practice.
- Public shaming, threats, insults, false statements, and late-night harassment can be reportable.
- Check the lender’s corporate name, SEC registration, Certificate of Authority, and recorded online lending platform status before borrowing.
- Save evidence before deleting messages or blocking collectors.
- File with the right office: NPC for data privacy, SEC for lending company abuse, and PNP/NBI for cybercrime or threats.
- If you are abroad, prepare for notarization, apostille, or a Special Power of Attorney if someone will file for you in the Philippines.