Homebuyers Privacy Protection Act Limits Mortgage Trigger Leads

JD Supra Finance & Banking

Published March 31st, 2026

Detected March 31st, 2026

Summary

The FTC released updated Fair Credit Reporting Act (FCRA) text incorporating the Homebuyers Privacy Protection Act (Public Law 119-36), which took effect in March 2026. The Act restricts consumer reporting agencies from selling consumer reports to third parties for mortgage trigger leads, requiring either a firm offer of credit/insurance or specific documentation certifications before furnishing reports.

View original document View source feed page

What changed

The Homebuyers Privacy Protection Act has been codified into FCRA Section 604, imposing new restrictions on mortgage trigger leads. Under the Act, consumer reporting agencies cannot furnish consumer reports to third parties based on mortgage-related requests unless the receiving party provides proper authorization documentation from the consumer, or meets one of three exceptions: (1) the party has originated a current residential mortgage loan for the consumer, (2) the party services the consumer's current mortgage, or (3) the party is an insured depository institution or credit union holding a current account for the consumer.

Financial institutions engaged in mortgage lending must immediately review their FCRA policies and procedures to ensure compliance with these new requirements. Organizations should verify they have a permissible purpose for every consumer report obtained and must not furnish reports to third parties unless the recipient meets the statutory exceptions. Failure to update internal controls could result in FCRA violations and enforcement action.

What to do next

Review FCRA policies and procedures for mortgage operations to ensure permissible purpose requirements are met
Update internal controls governing when consumer reports may be furnished to third parties
Verify that any mortgage trigger lead activities comply with the new restrictions or fall within the statutory exceptions

Source document (simplified)

March 31, 2026

Homebuyers Privacy Protection Act Added to FTC’s FCRA Text

LinkedIn Facebook X Send Embed

Earlier this month, the FTC released updated text of the Fair Credit Reporting Act (FCRA), which compiles the complete text of the FCRA, including all amendments, into one document to assist users and furnishers of consumer reports with compliance. The document was revised to include the Homebuyers Privacy Protection Act’s (Public Law 119-36) requirements in Section 604 on pages 17 and 18, which went into effect earlier this month. The Act was implemented to prevent consumer reporting agencies from selling consumer reports to third parties for mortgage trigger leads, as such practice results in excessive and unwanted loan solicitations to consumers.

The Act includes the following limitations on requests for prescreening reports:

“If a person requests a consumer report from a consumer reporting agency in connection with a credit transaction involving a residential mortgage loan, that agency may not, based in whole or in part on that request, furnish a consumer report to another person under this subsection unless—

the transaction consists of a firm offer of credit or insurance; and
that other person—
1. has submitted documentation to that agency certifying that such other person has, pursuant to paragraph (1)(A), the authorization of the consumer to whom the consumer report relates; or
2. (aa) has originated a current residential mortgage loan of the consumer to whom the consumer report relates; (bb) is the servicer of a current residential mortgage loan of the consumer to whom the consumer report relates; or (cc) (AA) is an insured depository institution or credit union; and (BB) holds a current account for the consumer to whom the consumer report relates.” This Act is a reminder for financial institutions to review their FCRA policies and procedures to ensure that such documents require that they have a permissible purpose for every consumer report that they obtain and that they do not furnish reports to another person unless such person has a permissible purpose to obtain the report. In particular for those organizations engaged in mortgage lending, now is a good time to review policies and practices as it relates to the use of consumer reports in the organization’s mortgage operations.

Send Print Report

Latest Posts

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.
Attorney Advertising.