MCA Broker Data Privacy Compliance: CCPA, State Laws, and Protecting Merchant Data

If you operate as an MCA broker or ISO, you are sitting on a goldmine of sensitive business data -- bank statements, tax returns, revenue figures, credit profiles, and merchant contact information. As state privacy laws multiply across the country, brokers who ignore data compliance face regulatory exposure, vendor contract terminations, and disputes from merchants and business partners.

This guide covers what MCA brokers actually need to do about data privacy in 2026: which laws apply, where the real risk lives, and practical steps to protect your brokerage and your merchants. See our MCA glossary for definitions of industry-specific terms used throughout this article.

What Data MCA Brokers Actually Handle

Before diving into regulations, take stock of what your brokerage actually collects. Most MCA brokers routinely handle:

• Business financial data -- bank statements (3-6 months), processor statements, tax returns, profit and loss statements
• Owner personal data -- Social Security numbers, personal credit reports, driver's license copies, home addresses
• Business identification data -- EIN, business address, years in business, ownership structure
• Contact and lead data -- phone numbers, email addresses, often purchased from third-party lead vendors
• Communication records -- call recordings, email threads, and chat logs with merchants
• Funder submission data -- packages sent to multiple funders, offer terms received, decision outcomes

This data profile makes your brokerage a potential target for both regulators and bad actors. When you search our funder directory and prepare deal packages for merchants, you are acting as a data intermediary between business owners and funders. That role carries legal obligations that are growing in scope every year.

The Federal Landscape: Why States Are Filling the Gap

The United States still lacks a comprehensive federal consumer data privacy law. The American Privacy Rights Act was debated in 2024 but did not pass into law, leaving a vacuum that more than 20 states have now rushed to fill with their own frameworks.

What federal laws do exist -- the Gramm-Leach-Bliley Act (GLBA), the Fair Credit Reporting Act (FCRA), and the Electronic Communications Privacy Act -- were written primarily for traditional financial institutions and consumer lending contexts. MCA funders that securitize deals or partner with banks may fall under GLBA safeguards requirements, and they frequently pass those requirements down to brokers through ISO agreement data security clauses. If your ISO agreement requires you to maintain an information security program, that is a contractual GLBA proxy obligation -- not just a suggestion.

CCPA and CPRA: Does California's Law Apply to Your Brokerage?

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA, effective January 1, 2023), is the most comprehensive state privacy law and sets the benchmark for all the others. It applies to for-profit businesses that do business in California and meet at least one of these thresholds:

• Annual gross revenue exceeding $25 million
• Buy, sell, receive, or share the personal information of 100,000 or more consumers or households per year
• Derive 50 percent or more of annual revenue from selling or sharing personal information

Many solo brokers and small ISOs will not hit these thresholds. But if you are running a volume-based lead generation operation, purchasing and processing tens of thousands of merchant contact records, the 100,000-consumer threshold is more reachable than it might seem.

The more important point: CCPA personal information includes data about individual business owners. When you collect a merchant's Social Security number, home address, or personal credit score as part of an application, that is personal information belonging to the individual -- not the business entity. The B2B exemption that existed in early CCPA iterations has expired. Business contact information of sole proprietors and small business owners is now fully in scope under California law.

The State Privacy Law Map in 2026

California is no longer alone. By late 2026, the following states have active comprehensive privacy laws:

• Virginia (Consumer Data Protection Act, effective January 1, 2023)
• Colorado (Colorado Privacy Act, effective July 1, 2023)
• Connecticut (CT Data Privacy Act, effective July 1, 2023)
• Texas (Texas Data Privacy and Security Act, effective July 1, 2024)
• Florida (Florida Digital Bill of Rights, effective July 1, 2024)
• Montana, Oregon, Delaware, Iowa, Indiana, Tennessee, New Hampshire -- all enacted, with effective dates between 2024 and 2025

Most of these laws share a common structure: they require covered businesses to provide privacy notices, honor consumer rights to access and delete their data, and implement reasonable data security. Many have revenue or volume thresholds similar to California's, which means smaller brokerages may fall below the coverage line in some states.

Texas TDPSA is worth calling out specifically because it applies to businesses that process personal data of Texas residents and conduct business in Texas -- without a revenue floor in all contexts. This makes it one of the broader state frameworks, and it applies to many brokers who market aggressively in Texas, one of the most active MCA markets in the country.

Where the Real Risk Actually Lives

Even if your brokerage does not technically meet the threshold for CCPA or most other state laws, four practical risk areas deserve your immediate attention:

1. Lead Vendor Relationships

When you buy leads from a third-party vendor, you become a data controller for that personal information. If the lead vendor did not obtain proper consent from the business owner to sell their data to MCA brokers, you may be downstream of a TCPA or state privacy violation. Our guide to buying MCA leads covers how to evaluate vendors -- but data compliance is an additional layer of due diligence most brokers skip entirely.

Ask your lead vendors directly: What consent language did the merchant see when their data was collected? Do they have written opt-in records? Can they provide evidence of consent on request? A reputable vendor should answer these questions without hesitation. If they cannot, that is a serious red flag for your legal exposure.

2. ISO Agreement Data Security Clauses

Funders are increasingly including data security requirements in ISO agreements because they face their own GLBA and investor-imposed obligations. These clauses typically require you to maintain an information security policy, limit access to merchant data to employees who need it, and report data breaches within a defined window -- often 48 to 72 hours. If your ISO agreement has these clauses and you experience a breach, failure to comply is a contract violation. Funders can and do terminate ISO relationships over this.

3. State Data Breach Notification Laws

All 50 states now have breach notification laws. If your CRM or email system is compromised and merchant Social Security numbers, bank account information, or other sensitive data is exposed, you are legally required to notify affected individuals -- and in many states, the attorney general as well. The notification window ranges from 30 days (most common) to 72 hours in stricter states. A delayed or missing notification can generate fines and class action exposure that far exceeds any commission you earned on those deals.

4. Email Marketing and Outbound Calling

If you are running cold email campaigns or outbound calling to purchased lists, you are operating in territory where privacy law and TCPA compliance overlap. Some state laws extend rights to business contacts in ways that affect your marketing operations. Minnesota's recently enacted privacy law, for instance, has relatively low thresholds and includes protections that extend beyond strict B2B contexts.

Practical Data Security Basics for MCA Brokers

Regardless of which laws technically apply to your brokerage today, the following practices protect you against both regulatory risk and the more immediate threat of a data breach:

CRM and File Storage

Your CRM is the core of your data exposure risk. Use a platform with role-based access controls so that only the people who need a merchant's SSN can see it. Our guide to building your MCA broker tech stack covers platform options, but the data security settings matter as much as the features. Enable two-factor authentication on all accounts. If a former employee leaves, revoke their access immediately -- this is the most common source of internal data exposure in small businesses.

Bank statements and tax returns sent by merchants should be stored encrypted. Cloud storage tools like Google Drive and Dropbox encrypt data at rest by default, but you should also control who has access via shared folders and permissions. Avoid emailing unencrypted sensitive documents when possible. Use a document portal or secure upload link instead.

Data Minimization

Only collect what you actually need to run your underwriting workflow and calculate factor rates and deal economics. If you are storing personal data longer than necessary -- keeping rejected merchants' SSNs for years in a spreadsheet, for instance -- that is unnecessary exposure. Set a retention policy: delete or anonymize personal data for merchants who did not fund within a defined period, such as 12 to 18 months.

Vendor Contracts

Any third party that handles merchant data on your behalf -- your CRM vendor, your email platform, your document storage service -- should have a data processing agreement (DPA) in place. Major platforms like Salesforce, HubSpot, and Dropbox offer standard DPAs. This matters because under laws like CCPA, if your vendor processes data on your behalf and they experience a breach, you share responsibility as the data controller.

A Written Privacy Policy

If your brokerage has a website that collects any information from visitors -- even a simple contact form -- you should have a privacy policy posted. This is a legal requirement for covered businesses under CCPA, and it signals professionalism to the funders and merchants you work with. The policy should describe what data you collect, how you use it, and how merchants can request deletion or access.

Protecting Your Commission and ISO Status

Data privacy is not just a compliance issue for brokers -- it is a business continuity issue. Here is what happens when it goes wrong:

• Funder ISO termination. If a funder discovers you mishandled merchant data or experienced a breach you failed to disclose under your ISO agreement, they can terminate your relationship. Rebuilding a funder panel takes months. Maintaining preferred ISO status with funders increasingly depends on data handling standards, not just volume.
• Merchant disputes. Some states allow individuals to sue for data violations. A merchant who discovers their data was misused could pursue claims even without a class action forming around the incident.
• Regulatory fines. California's Privacy Protection Agency can impose fines up to $7,500 per intentional violation. A single non-compliant lead vendor purchase affecting hundreds of merchants can multiply quickly.
• Reputational damage. Word travels fast in tight-knit merchant communities and on industry forums. A data breach or privacy scandal can dry up your referral pipeline more effectively than any competitor could.

The investment in basic data hygiene -- a compliant CRM setup, vendor contracts, an internal privacy policy, and a breach response plan -- typically costs less than a single declined deal. Treat it as infrastructure, not overhead.

Practical Action Plan: What to Do This Month

You do not need a full legal audit to make meaningful progress on data privacy compliance. Start with these six steps:

1. Audit your data holdings. Make a list of every place you store merchant data: CRM, email folders, Dropbox, shared drives, local hard drives. Know what you have before you can protect it.
2. Review your ISO agreements. Look specifically for data security clauses. If they require a written information security policy and you do not have one, draft a simple one now.
3. Vet your lead vendors. Ask for their consent documentation and data processing agreements. If they cannot produce these, weigh whether the legal exposure is worth it.
4. Enable two-factor authentication everywhere. CRM, email, cloud storage, funder portals. This single step prevents the majority of unauthorized account access incidents.
5. Post a privacy policy. Even a basic one demonstrates good faith to regulators and business partners, and it is legally required for covered businesses in California.
6. Create a breach response plan. Know who you would contact -- a data privacy attorney, your funder ISO contacts -- and what notification obligations apply in your state if merchant data is ever compromised.

MCA brokers who handle data carefully earn trust from merchants and funders alike. As regulations tighten and funders become more selective about their ISO relationships, compliance will increasingly be a competitive differentiator. Create your broker account on MCA Directory and start connecting with verified funders who take professional standards seriously.

Takeaway

Data privacy compliance for MCA brokers is not primarily about navigating complex federal law -- it is about state laws, ISO agreement obligations, and the practical risk of a data breach exposing your merchant base. Most small brokerages fall below the revenue thresholds of major state privacy laws, but that does not mean they are exempt from exposure. Lead vendor risk, ISO agreement data security clauses, breach notification obligations, and the personal data of individual business owners all create real liability that standard business operations do not automatically address. Build data hygiene into your workflow now, before an incident forces a scramble.