Can a lending app access my phone photos or camera?
Last updated: 2026-07-11 · Educational content; not legal advice.
Short answer
Only if that access is genuinely necessary for the loan — otherwise no. NPC Circular No. 20-01 (2020) prohibits lending and financing apps from demanding unnecessary permissions and limits data collection to what is adequate, relevant, and not excessive for evaluating your loan. A camera permission may be justified for a required selfie or ID verification (KYC), but demanding your whole photo gallery or storage is excessive processing under the Data Privacy Act (RA 10173 §11) that you can challenge before the National Privacy Commission.
Primary sources
Frequently asked
Isn't a selfie/camera permission normal for KYC?
A one-time camera use to capture a required selfie or photograph an ID for identity verification can be a legitimate, proportional purpose. What is not legitimate is standing access to your full gallery, files, or storage — that goes beyond what the loan needs and NPC Circular 20-01 bars it.
They already scraped my photos. What can I do?
Send a written demand to delete the images and revoke the permission in your phone settings, then file with the NPC. It can order deletion and impose fines; keep a screenshot of the permission screen as evidence of the over-collection.
Can they use my photos to shame me?
No. Editing or circulating your photos to pressure you is unauthorized processing and disclosure under RA 10173, and if sent to your contacts it is also an unfair collection practice under SEC MC 18. It can additionally be online libel under RA 10175.
Take action
Got a similar problem?
File a complaint and we'll pre-fill BSP, SEC, DTI, and small-claims letters for you.
Contact-list scraping, unauthorized data use, and how to file with the NPC.