Regulation
Serial Litigants May Target Websites and “Trackers” As Alternative to TCPA
June 12, 2026
The small business loan brokerage had played it safe. Rather than robodial and take their chances in the minefield of TCPA compliance, they ran ads on Facebook and Instagram and had the merchants call them. Inbound leads were gold, they cheered, until one of those inquiries came through a little differently. It was a demand for damages for having been tracked on the internet.
The merchant alleged that they had only been served ads on social media by that company because they had been tracked from a prior website visit. They hadn’t wanted to be tracked and there was no option to opt out of tracking. As a result, they demanded to be compensated, heftily.
By now, most internet users have at least heard the term GDPR, the General Data Protection Regulation that became a never-ending source of controversy throughout Europe, but not all are aware that states and litigants in the US have tried to create a similar framework for privacy. For some in the small business finance industry, the vast complexity of compliance was not fully understood until the lawyers came calling.
“Pretty much every MCA company is potentially a victim because they’re all doing advertising,” said Richart Ruddie, CEO of Captain Compliance, a firm that specializes in safeguarding companies against these sorts of threats. “What we do is we protect against the rise and surge in privacy lawsuits and privacy litigation. So, anybody running TikTok ads, Facebook ads, Instagram ads, any sort of technology that does session-replay where it watches you move the cursor on the screen, if they’re running Google Analytics, all of these are cases that have been tried and are being litigated over.”
Ruddie said that companies within the small business finance industry, including a few within the segment of MCA, have been hit with claims, and they’re now actively working with them to make sure it doesn’t happen again.
“What our software does is provides the ability for users to have consent to opt-in or opt-out of any sort of ad targeting, tracking, session-replay technology,” Ruddie said. “And then we also provide software that constantly keeps businesses’s privacy notices and privacy policies up to date with their tracking and what they’re doing as well as their data handling practices.”
The larger issue is that for companies that might already be aware of the risks, the solutions they’re using may not actually be compliant with the laws.
“What’s happening now is there’s a handful of these cookie banner softwares but they don’t work and they’re creating bigger issues because they’re like ‘Hey, you told me I could opt out, and then I turned off the selling and sharing of my personal information and you still track me,'” Ruddie explained.
This is made all the more complex by the fact that there are nearly two dozen states with their own twists on compliance. And a growing cottage industry of serial litigants that know this complexity could make website operators easy targets to profit off of. For instance, some of them are going around and running automated website scans just to see who to target. Ruddie said that he’s seen claims reach into the tens of thousands or hundreds of thousands of dollars for alleged privacy violations.
Preventative measures are within reach, however. Ruddie says that for a brand new customer they can get a company compliant in one to three business days. It’s hard for companies to hide in the shadows if they’re online because it doesn’t take much to see what’s there and what isn’t.
“You can right-click and look at the code and then you can see all the different tech and what’s running on the website,” Ruddie said.
New York State Bill Seeks to Criminalize Invoice Factoring, Merchant Cash Advances, and More
May 6, 2026A Senate Bill in New York hopes to rewrite the state’s criminal usury laws to include invoice financing, revenue-based financing, merchant cash advances, retail installment contracts, “or any transaction that in substance functions as the advance of funds in exchange for a future payment or obligation, regardless of the label assigned to such transaction.” S10127, introduced by Senator Rachel May (D), says that the purpose is to ensure “that businesses cannot evade New York’s longstanding usury laws by re-labeling high-cost financing products as services or other non-loan transactions, and to apply existing civil and criminal interest rate protections to covered financing arrangements.”
Any product that falls under these definitions would be deemed criminal if its all-in cost exceeds 25% per annum or the equivalent rate for a longer or shorter period. Depending on the circumstances it would either be considered a Class E felony punishable up to 4 years in prison or a Class C felony punishable up to 15 years in prison.
The bill has merely been introduced and has not yet made its rounds through the legislature. It can be viewed here.
RBFC Response to New CFPB Small Business Lending Rules
May 4, 2026Last week, the CFPB updated its final Section 1071 small business loan data collection rules to improve the usefulness of the data and to reduce the burden on covered parties. As part of that, merchant cash advances were finally excluded from the reporting requirements.
The Revenue Based Finance Coalition (RBFC) had advocated strongly for some of the changes that made it into the final version. In a public statement, the RBFC offered this feedback on the news:
“The final 1071 Rule is an important step in the right direction. It reflects an evenhanded approach to sales-based financing and recognizes that these products are fundamentally different from traditional credit. The rule properly focuses on financing arrangements that clearly fall within the scope of the Equal Credit Opportunity Act. We’re pleased to see the Consumer Financial Protection Bureau acknowledge that whether a product constitutes credit depends on its specific structure.
The new framework provides important clarity for responsible providers and the small businesses that rely on flexible, performance-based financing. The Revenue Based Finance Coalition remains focused on advocating for fair, clear, and appropriate regulation of sales-based financing, with a top priority of ensuring that our members can continue to provide businesses with the capital they need to grow and thrive. This clarity will help support continued innovation and responsible access to capital for small businesses across the country.”
The Section 1071 label comes from its statutory section number in the 2010 Wall Street Reform and Consumer Protection Act.
Merchant Cash Advances Excluded From CFPB Small Business Loan Data Collection
May 1, 2026Merchant Cash Advances are now excluded from the CFPB’s small business loan data collection requirements. In the final rules filed by the agency on April 30th, the previous proposal to exclude MCAs from Section 1071 is now deemed approved and final.
“Since MCAs are not covered credit transactions under this final rule, no MCA providers will be required to report,” the docs say. The rationale is discussed across the 314 pages that comprise the final decision. However, the agency did leave open the possibility to reconsider the inclusion of MCAs years down the road.
But for now after more than a decade of debate and confusion over the matter, MCAs will not be considered a covered credit transaction for the purpose of Section 1071 of the Wall Street Reform and Consumer Protection Act. You can read the final rules here.
Connecticut Commercial Financing Bill Moving Forward
April 29, 2026Connecticut’s commercial financing bill is moving its way through the state legislature. See it here.
Like a few other states it applies to merchant cash advances and it includes an APR requirement. While an earlier version of the bill exempted all sales-based financing transactions above $250,000 from the rules, it removed the threshold and made all transactions of all sizes subject to them. Both brokers and funders would be required to register with the Banking Department in order to offer commercial financing to Connecticut-based merchants.
Bill Proposed to Amend CFPB’S Small Business Data Collection Rule
April 27, 2026
A simple bill has been introduced in the House of Representatives to amend the CFPB’s small business data collection rules. The 888-page rulebook has been undergoing an internal reconfiguration by the CFPB itself but in this instance members of Congress are attempting to make minor changes through legislation.
These proposed changes are as follows:
• Amend the definition of small business to mean a business that does $1 million a year in revenue versus the $5 million defined in the last iteration of the rules.
• Amend covered financial institutions as ones that do at least 500 credit transactions a year versus the 100 transaction threshold defined in the last iteration of the rules.
This bill is called the “Small Lenders Exempt from New Data and Excessive Reporting Act.”
The small business lending data collection rules drafted by the CFPB have been the subject of controversy since 2010 when the law requiring the agency collect small business loan data was first passed. Sixteen years later there has still been much disagreement as to what was actually intended to be collected, from whom it is to be collected from, the manner in which this collection takes place, and what can be done with the data itself once it’s in the agency’s hands. The agency is likely to release an amended version of the rules sometime this year.
229 Companies Now Registered as Sales-Based Financing Providers in Virginia
April 20, 2026Almost four years since Virginia’s sales-based financing provider law went into effect, the state now lists 229 registered parties. That’s an increase of only 27 companies since last year.
Both funders and brokers are required to be registered if they intend to transact with Virginia-based merchants, subject to some exceptions. Registrants on the list include some big recognizable names like eBay Commerce, First Data Merchant Services, PayPal, and Wal-Mart.com USA, but dozens of smaller known MCA broker shops also appear.
If you are a broker or funder in MCA and are not registered to do deals with Virginia-based merchants, you should contact a knowledgeable industry attorney to get set up right away. The law went into effect in 2022.
Concerned About The MCA Automatic Debit Law in Texas? This ACH Company Says There’s a Way
March 25, 2026
There may be no need to overcomplicate Merchant Cash Advance compliance in Texas. A key phrase in the MCA prohibition law that went into effect last year specifies that it’s a prohibition on “establishing a mechanism for automatically debiting a recipient’s account” unless a lot of other requirements are met.
One company looked closely at that piece of the language and came up with a simple solution.
“…our approach is to request the payment at each time and capture the authorization at the time of the transaction,” said John Innes, President of the Texas-based and aptly-named ACH Processing Company. “So instead of capturing an authorization at the beginning and embedding that into the documents where you’re going to do a recurring debit transaction to the merchant’s account, you are sending a request saying, ‘Okay, please authorize this payment.’ And so each payment is individually authorized so you don’t need that security interest [component] anymore.”
No automatic recurring debits. Instead there’s a Request For Payment that requires merchants to manually authorize debits on a debit-by-debit basis whether that be daily, weekly, or monthly, depending on whatever the agreed frequency is.
“I think this was maybe the intent of the law,” Innes continued. “It gives the merchant kind of that control over that debit and it fosters communication between the two parties.”
Innes said there’s various ways that this interaction can be conducted to reduce the friction of this process.
Other options proposed across the industry have focused on another piece of the language, that the prohibition is specifically meant for “commercial sales-based financing providers” and the proposed cure for that is to offer a non-sales-based financing product in the state instead. ACH Processing Company’s solution, however, allows an MCA funder to keep its product suite as-is.
“…you don’t have to break all that,” said Innes. “Continue with the same business plan. ”
Since the Texas law went into effect seven months ago, Innes says that numerous funders have still been in a holding pattern trying to figure out how to approach it. It’s their belief that this solution is a simple way to now get Texas turned back on if they’re ready.
