Bipartisan support for legislation is rare to see in this political climate. One exception recently occurred with the enactment of the Homebuyers Privacy Protection Act, which amended the Fair Credit Reporting Act (“FCRA”) for purposes of prohibiting the sale of “trigger leads.” Below, we discuss the practice of selling “trigger leads,” the Homebuyers Privacy Protection Act in further detail, and why this law matters to your business.
Consumer Privacy Remains A Central Focus
As consumers know, when applying for a mortgage, car loan, or credit card, a credit check is triggered creating an inquiry on consumers' credit reports. Prior to the passage of the Homebuyers Privacy Protection Act, lenders paid the three primary consumer reporting agencies (i.e., Equifax, Experian, and TransUnion) (“CRA”) to provide information about consumers who applied for loans in order to contact them with prospective offers. Following the data sale, these consumers, or “trigger leads,” then often receive numerous offers from lenders and their marketing partners.
With the enactment of Homebuyers Privacy Protection Act, Congress seeks to eliminate the practice of selling trigger leads by amending the FCRA to prohibit CRAs from selling the information of consumers who apply for residential mortgage loans. Specifically, when consumers apply for residential mortgage loans, CRAs may no longer furnish their credit reports to third parties. Exceptions exist if the third party is: (1) the original residential mortgage loan lender for the consumer's current mortgage; (2) the servicer of the consumer's current residential mortgage; or (3) an insured bank or credit union that maintains a current account for the consumer. Absent one of these exceptions or consumer authorization, CRAs may not furnish consumer reports to third parties. Even if third parties have consumer authorization or fall within one of these exceptions, they must provide consumers with real credit or insurance offers that they will honor if consumers meet the specific criteria used to select them for the offers.
Why Does The Homebuyers Privacy Protection ActMatter to Your Business?
Notably, the explicit language of the Homebuyers Privacy Protection Act only extends to instances where consumers apply for residential mortgage loans. In other words, the Act does not appear to apply when consumers apply for other forms of credit.
Lenders and marketers that rely upon or use “trigger leads” must take note of this development as the Homebuyers Privacy Protection Act becomes effective on March 5, 2026. As such, it is imperative for companies to review their consumer data privacy and marketing practices to prepare for the law's effective date.
Similar Blog Posts:
Privacy Please: CPPA Announces Joint Consumer Data Opt-Out Investigation
California Data Broker Registration Requirements
Consumer Privacy Compliance Primer
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
