Trigger Leads Are Now Restricted: What the Homebuyers Privacy Protection Act Actually Changed
If you've ever applied for a mortgage and watched your phone light up with calls from lenders you've never heard of, you've met the trigger lead. For years that flood was perfectly legal. As of 2026, the rules changed — narrowly, but in a way every mortgage operator needs to understand.
This is an operator's plain-English read, not legal advice. Every specific below traces to the law itself; confirm anything that matters with counsel.
What a trigger lead is, and why it was legal
A mortgage credit trigger lead is generated when a consumer applies for a mortgage and the lender pulls their credit. The bureau — a consumer reporting agency — detects that hard inquiry and sells the consumer's contact information as a lead to other lenders and brokers, who then solicit them, often within hours.
The mechanism that made this lawful is the FCRA's firm-offer-of-credit (prescreen) exception. Under the Fair Credit Reporting Act, a bureau may furnish a consumer report without the consumer's authorization when it's used in connection with a firm offer of credit or insurance the consumer didn't initiate — FCRA § 604(c), codified at 15 U.S.C. § 1681b(c). The consumer never consented; the "firm offer" structure supplied the permissible purpose.
What HPPA changed
The Homebuyers Privacy Protection Act — H.R. 2808 — became Public Law 119-36 on September 5, 2025, and its provisions take effect 180 days after enactment, on or about March 4, 2026.
The law narrows the firm-offer exception specifically in the residential-mortgage context. It limits when a bureau may provide a consumer credit report to a third party in connection with a residential mortgage transaction, prohibiting the sale unless the transaction is a firm offer of credit or insurance and one of two exceptions is met.
The two exceptions
A third party can still receive a mortgage trigger lead if (1) it provides documentation certifying it has the consumer's consent to receive the report, OR (2) it has an existing relationship — it originated a mortgage for the consumer, is the consumer's current mortgage servicer, or has a current specified banking/depository relationship with the consumer.
What's still legal vs. newly prohibited
Still legal after HPPA:
- The general FCRA firm-offer/prescreen framework outside the residential-mortgage trigger-lead use.
- Soliciting a consumer who affirmatively consented — with documented certification — to receive the offer.
- Solicitations by a party with a qualifying existing relationship: the originating lender, the current servicer, or an institution with a current banking relationship.
- The consumer's existing right to opt out of prescreened offers via 1-888-5-OPT-OUT.
Newly prohibited (effective ~March 4, 2026):
- A bureau selling a mortgage trigger lead to a third party that has no qualifying relationship with the consumer and no documented consent, in connection with a residential mortgage transaction. That cold sale is the core practice the law targets.
The Operator’s Compliance Brief
What changed in lead-gen compliance, and what to do about it. Free, no spam.
One myth to put to rest
HPPA was not part of the NDAA. It was signed as a standalone law — H.R. 2808, Public Law 119-36 — on September 5, 2025. An earlier version (S. 3502) passed the Senate in December 2024 but didn't become law; the concept was reintroduced and enacted in the 119th Congress.
What operators should do
If you buy mortgage leads, the practical question is now: for any trigger-sourced lead, can you show either documented consumer consent or a qualifying existing relationship? If you can't, that lead is a liability after the effective date. If you're the originating lender or current servicer running retention and recapture, the existing-relationship exception keeps you in the clear — but document the relationship.
Not Legal Advice
This is general information, not legal advice. The statute's exact codified subsections and the precise boundaries of the "current banking relationship" exception should be confirmed against the enrolled text of Public Law 119-36 with qualified counsel before you rely on them.
Sources
- H.R. 2808 — Homebuyers Privacy Protection Act (119th Congress) — Congress.gov (accessed 2026-06-29)
- 15 U.S.C. § 1681b — Permissible purposes of consumer reports — Cornell Legal Information Institute (accessed 2026-06-29)
- 12 CFR § 1022.54 — Prescreen opt-out notice — CFPB (accessed 2026-06-29)
30+ years in lead gen · BRSG Founder
Bill Rice has spent 30+ years in mortgage, lending, and performance marketing — generating leads, buying them, and building the systems that route and work them. He founded a performance-marketing agency, owned a direct-to-consumer lender, and wrote The Lead Buyer's Playbook. He built Lead Compliance Hub to help operators navigate the legal landmines of online lead generation from an operator's seat, not a law firm's. Nothing he writes here is legal advice.
Key Terms to Know
FCRA
The Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.), the federal law governing how consumer reports may be furnished and used — including the prescreen/firm-offer exception at § 1681b(c).
Firm Offer of Credit
Under FCRA § 603(l), an offer of credit or insurance that will be honored if the consumer meets pre-selected criteria. It supplies the “permissible purpose” that historically made prescreened trigger-lead solicitations lawful without consumer consent.
HPPA
The Homebuyers Privacy Protection Act — H.R. 2808, Public Law 119-36, signed September 5, 2025, effective 180 days later (≈ March 4, 2026). It restricts when credit bureaus may sell a mortgage trigger lead to a third party.
Mini-TCPA
A state telemarketing statute that is stricter than the federal TCPA — for example Florida’s and Oklahoma’s. These laws can impose their own consent standards and private rights of action, so federal compliance alone is not enough.
One-to-One Consent
The FCC rule that would have required a consumer’s TCPA consent to name a single specific seller. It was vacated by a federal appeals court in 2025 before taking effect — but state mini-TCPAs and the underlying PEWC standard still govern.
Permissible Purpose
The FCRA requirement that a consumer report may only be furnished for an enumerated reason. A “firm offer of credit or insurance” not initiated by the consumer is one such permissible purpose.
The Operator’s Compliance Brief
What changed in lead-gen compliance, and what to do about it. Free, no spam.