As far as I can tell, Reg P only applies to consumer customers.

What about a consumer applicant that is declined? Clearly a privacy notice would not be required, but is there anything governing the sharing of the applicants information? Would it all be based on any language in the application?

It wouldn't fall under Reg P because they aren't a customer. However, I think you could be in big trouble for sharing info on declined, withdrawn, etc. applicant. I wouldn't go there.

1016.3 of Regulation P defines customers and consumer differently. Basically, a customer has a relationship with you (like one who obtained a loan) and a consumer may not have a relationship with you (like someone who applied for a loan that was denied).

An example from 1016.3(e)(2)(i):
"(i) An individual who applies to you for credit for personal, family, or household purposes is a consumer of a financial service, regardless of whether the credit is extended."

1016.4 explains when the privacy notice is required for both customers and consumers. In simple terms, consumers (who are not customers) must get a privacy notice (with an opt-out option) before you share their information.

From 1016.4:
"(a) Initial notice requirement. You must provide a clear and conspicuous notice that accurately reflects your privacy policies and practices to:

(1) Customer. An individual who becomes your customer, not later than when you establish a customer relationship, except as provided in paragraph (e) of this section; and

(2) Consumer. A consumer, before you disclose any nonpublic personal information about the consumer to any nonaffiliated third party, if you make such a disclosure other than as authorized by §§1016.14 and 1016.15 of this part."

This is a very helpful summary. Thank you Adam.

Well done Adam.