This bill amends Section 704B of the Equal Credit Opportunity Act to change how demographic and small‑business loan data are collected and handled. It requires lenders to provide a specific written notice when requesting demographic information, forbids compiling applicant characteristics determined by visual observation or other non‑applicant sources, and limits which institutions are subject to the reporting obligation.
The amendment also reshapes the Bureau of Consumer Financial Protection’s role: it must use notice‑and‑comment rulemaking before deleting or modifying collected data, perform statutorily specified cost and paperwork reviews before the amended rules take effect, and the statute establishes a delayed effective date and a temporary non‑enforcement period. Taken together, the changes reduce mandatory reporting scope and add privacy safeguards while shifting the timing and mechanics of enforcement and Bureau rulemaking — issues that matter for lenders, regulators, consumer advocates, and small‑business borrowers.
At a Glance
What It Does
The bill revises the statutory small‑business data collection framework under the Equal Credit Opportunity Act by changing how lenders solicit and may use demographic information, narrowing the set of institutions required to report, and imposing procedural constraints on the Bureau before it alters collected data sets.
Who It Affects
The primary targets are lenders that originate a high volume of small‑business credit; the text also carves out several types of institutions from the reporting requirement. The Bureau of Consumer Financial Protection faces new procedural steps before it may modify or delete reported data.
Why It Matters
The measure rebalances privacy and reporting obligations: it reduces mandatory data collection and forbids inferred demographic inputs, which limits the information available for fair‑lending analysis, while imposing compliance relief and procedural checks that change how regulators can act.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
SB2352 rewrites key parts of the small‑business data collection statute added to the Equal Credit Opportunity Act. At its core, the bill requires that when a lender asks an applicant for demographic information, the lender must provide a written notice explaining that the Bureau requires the collection, that the applicant’s answer will not affect credit evaluation, and that the applicant may decline to provide the information.
The bill forbids lenders from filling in those fields based on observation or other inference — they must rely on applicant‑provided answers.
The bill narrows who must comply. It defines a covered “financial institution” by activity and volume thresholds and explicitly excludes several categories of lenders from the statutory obligations.
It also defines “small business” in revenue terms for the purpose of the statute. Those definitional choices determine which origins trigger reporting obligations and which lenders escape them.On the regulatory side, SB2352 requires the Bureau to follow notice‑and‑comment rulemaking before deleting or modifying reported data and to explain how deletions would advance privacy interests.
The statute further bars the Bureau from using an institution’s applicant response rate as a compliance metric. Finally, the bill stages implementation: it ties the effective date to completion of statutorily referenced cost‑benefit and paperwork reviews and establishes a multi‑year delay and a temporary non‑enforcement window after the effective date.Operationally, the package shifts burdens.
Covered lenders must adapt forms and disclosure language and update reporting systems to ensure they do not infer or otherwise compile demographic fields. The Bureau must perform additional procedural work before changing datasets it receives, and fair‑lending stakeholders will confront a narrower public record for analysis.
The combination of definitional exclusions and the non‑enforcement period means the statute’s practical impact will phase in over several years, not immediately.
The Five Things You Need to Know
The bill defines a covered financial institution as an entity that originated at least 2,500 small‑business credit transactions in each of the preceding two calendar years but excludes institutions with under $10,000,000,000 in assets, Farm Credit System institutions, certified community development financial institutions, and equipment and vehicle finance lenders.
It sets the statutory small‑business revenue cap at $1,000,000 in the preceding fiscal year for the purposes of the reporting requirement.
The statute bans financial institutions from compiling or maintaining applicant demographic information that the lender determines by visual observation or any other method other than the applicant’s own response.
The Bureau may not treat the percentage of applicants who provide demographic information (response rate) as a factor in determining a lender’s compliance with the reporting requirement.
The effective date is staged: the subsection takes effect three years after the Bureau completes the required cost‑benefit and Paperwork Reduction Act analyses, and the Bureau is barred from enforcing the subsection for two years beginning on that effective date.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Act name
Convenience provision: the bill is titled the Preventing Regulatory Overreach to Empower Communities to Thrive and Ensure Data Privacy Act (PROTECTED Act). This has no substantive effect but signals legislative intent toward privacy and regulatory restraint.
Applicant notice requirement
The amendment inserts a statutory floor for the notice lenders must give when requesting demographic information. The lender must tell applicants that the Bureau requires the collection, that the applicant’s choice won’t affect credit decisions, and that the applicant can decline. Practically, lenders will need to update application language and training; compliance programs should document the notice and preserve evidence of delivery in case of later supervisory inquiries.
Surgical edits to reportable categories
The bill strikes and redesignates several subparagraphs in the reporting list. The textual edits will change the enumerated data categories that lenders must collect or report; because the bill removes specific subparagraphs rather than replace them wholesale, stakeholders must compare the amended statutory text to current law to see precisely which data elements drop out. That change can materially alter the granularity available for fair‑lending analytics.
Bureau must use notice‑and‑comment before modifying datasets
The Bureau still retains the authority to delete or modify data, but the bill requires it to issue rules, after notice and comment, describing what changes it plans and how those changes promote privacy interests. This inserts a procedural gate: the Bureau must publicly justify data deletions and give stakeholders an opportunity to respond — slowing ad hoc data removals and forcing an explicit privacy rationale.
Prohibitions, compliance metrics, timing, and definitions
New paragraph (5) forbids compiling demographic information by visual observation or any method other than the applicant’s provision; paragraph (6) prohibits using applicant response rates as a compliance metric; paragraph (7) creates a two‑year non‑enforcement safe harbor after the subsection’s effective date; paragraph (8) fixes the effective date at three years after the Bureau completes specified Regulatory Flexibility Act and Paperwork Reduction Act analyses; and paragraph (9) supplies definitions for “financial institution” (activity and volume thresholds) and “small business” (gross annual revenues not exceeding $1,000,000). These mechanics determine who reports, what counts as a small business, when the law takes effect, and how compliance will be judged.
This bill is one of many.
Codify tracks hundreds of bills on Finance across all five countries.
Explore Finance in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Small‑business borrowers who decline to provide demographic information, because the bill establishes a clear written notice that the response is optional and forbids lenders from filling in demographic fields by inference, reducing unwanted or inaccurate data capture.
- Smaller and mission‑driven lenders excluded by the statute (institutions under the asset threshold, Farm Credit System entities, community development financial institutions, and equipment/vehicle lenders) because they avoid the new reporting and administrative burden the statute otherwise imposes.
- Financial institutions that prefer reduced mandatory disclosure obligations: by narrowing the universe of required reporters and removing certain reporting categories, the bill lowers compliance costs and recordkeeping obligations for covered and excluded entities alike.
Who Bears the Cost
- Large and high‑volume lenders meeting the 2,500‑originations threshold, which must update application materials, data systems, and compliance programs to capture applicant notice language and to prevent inferred demographic entries.
- The Bureau of Consumer Financial Protection, which must perform the required cost‑benefit and paperwork analyses, conduct notice‑and‑comment rulemakings before modifying datasets, and manage the administrative workload of phased implementation.
- Researchers, fair‑lending enforcers, and community advocates who rely on comprehensive demographic reporting: narrowing reportable categories and excluding inferred data will reduce the completeness and comparability of datasets used to detect and prove discriminatory lending patterns.
Key Issues
The Core Tension
The central dilemma is privacy versus enforceability: the bill strengthens individual privacy protections and limits intrusive or inferred data collection, which benefits applicants and reduces lender burden, but those same limits shrink the data regulators and researchers rely on to detect and prove discriminatory lending patterns, making robust fair‑lending enforcement harder without alternative data or new investigative approaches.
The bill resolves some privacy concerns but creates analytic and enforcement gaps. Prohibiting inferred demographic data eliminates a common method for filling missing cells in datasets, which will reduce both false positives from inaccurate inferences and the ability to run certain statistical tests that require complete data.
At the same time, striking enumerated reporting subparagraphs — without specifying replacements — injects uncertainty about which data elements will persist. That raises the real possibility that public and supervisory datasets will be less useful for identifying disparities.
Implementation timing and the definitional choices create additional wrinkles. Tying the effective date to completion of Regulatory Flexibility Act and Paperwork Reduction Act analyses, then delaying enforcement for two years after that effective date, means the statutory changes will phase in slowly; stakeholders should expect years of transition.
The statute’s volume and asset thresholds (2,500 originations/preceding two years; $10 billion asset exclusion) concentrate reporting on large, active lenders, but leave potential blind spots in regional markets and for niche lenders. Finally, the language leaves room for litigation and administrative disputes over key terms — for example, what constitutes a ‘credit transaction for small businesses’ or whether particular data elements fall within the struck subparagraphs — which could further delay clarity.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.