Unveiling The Homebuyers Privacy Protection Act: Safeguarding Consumer Data In Mortgage Transactions

New Homebuyers Privacy Protection Act ending abusive use of mortgage credit trigger leads takes effect March 4, 2026

The Homebuyers Privacy Protection Act strengthens consumer privacy in mortgage transactions by limiting when consumer reporting agencies may furnish prescreened consumer reports triggered by a mortgage-related inquiry. Violations of these new limitations occur within the framework of the Fair Credit Reporting Act ("FCRA") and carry FCRA remedies and liabilities, including those applicable to consumer reporting agencies and users of consumer reports.

Overview

The Homebuyers Privacy Protection Act amends the FCRA to restrict when consumer reporting agencies may furnish prescreened consumer reports triggered by a mortgage-related inquiry.

The Homebuyers Privacy Protection Act takes effect 180 days after its enactment on September 5, 2025, or on March 4, 2026.

Substantive Restrictions on Prescreened Reports ("Trigger Leads")

• When a person requests a consumer report for a credit transaction involving a residential mortgage loan, a consumer reporting agency may not furnish a prescreened report to another person based on that request unless strict conditions are met.
  
• First, the transaction must consist of a firm offer of credit or insurance.
  
• Second, the recipient must either have documented consumer authorization under section 604(c)(1)(A) or the recipient must meet one of three relationships with the consumer:
  • the recipient may have originated a current residential mortgage loan of the consumer;
  • the recipient may be the servicer of a current residential mortgage loan of the consumer; or
  • the recipient may be an insured depository institution or credit union that holds a current account for the consumer.
    
• The statute expressly places a certification requirement on the recipient to submit documentation of authorization when relying on consumer consent.

Practical Effects

• Consumer reporting agencies are now barred from furnishing prescreened "trigger lead" reports prompted by a mortgage inquiry unless the offer is firm and the recipient has authorization or a qualifying relationship.
  
• Mortgage lead generators and nonbank lenders without existing relationships or consent are restricted from obtaining prescreened data tied to a consumer's mortgage application event.
  
• Depository institutions and credit unions holding current accounts, existing originators, and servicers retain limited access consistent with the new conditions.
  
• Firms relying on consumer consent must maintain and submit documented authorization to the consumer reporting agency.

Legal Consequences of Violation

• The Homebuyers Privacy Protection Act amends FCRA section 604(c) to add these limitations, making noncompliant furnishing or obtaining of prescreened reports subject to FCRA's existing enforcement and liability framework.
  
• Violations would fall under FCRA remedies, including actions by federal regulators and private civil liability, because the statute embeds the restriction within FCRA section 604(c).
  
• Entities lacking a firm offer or requisite authorization or relationship would be prohibited recipients, exposing them and the furnishing agency to FCRA consequences if reports are furnished.
  
• The certification requirement creates a compliance obligation for recipients, and false or missing certifications would indicate noncompliance under the amended section.

The Homebuyers Privacy Protection Act is a significant step forward in protecting consumer data within mortgage transactions.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.