Who Can Still Buy a Mortgage Trigger Lead After HPPA? The Two Exceptions
The Homebuyers Privacy Protection Act doesn't end trigger leads — it ends cold ones. The law leaves two doors open. If you buy mortgage leads, your entire post-HPPA compliance posture comes down to whether each lead fits through one of them.
This is an operator's read, not legal advice.
Exception 1: Documented consumer consent
A third party can still receive a mortgage trigger lead if it provides documentation certifying it has the consumer's consent to receive the report. The operative word is documented. It isn't enough that a consumer once filled out a form somewhere; you need a record that certifies consent to receive this offer.
What "documented" should mean in practice
A retained record of the consent language the consumer saw, a timestamp, the originating page or form, and an identifier tying it to that consumer — the kind of trail consent-capture tools are built to produce. If you can't reproduce it on demand, treat the lead as if you don't have it.
Exception 2: A qualifying existing relationship
The second door is for parties that already know the consumer. The exception covers a third party that:
- has originated a mortgage on behalf of the consumer,
- is a current mortgage loan servicer to the consumer, or
- has a current specified banking or depository relationship with the consumer.
This is the retention-and-recapture lane. If you originated the loan or service it today, soliciting that borrower isn't the cold trigger sale the law targets. Document the relationship so you can show why the exception applies.
The buy-side checklist
For every trigger-sourced mortgage lead after the effective date, ask:
- Can I show documented, certified consent for this consumer to receive this offer? or
- Do I have a qualifying existing relationship — originated, currently servicing, or a current banking relationship?
If neither is true, the lead doesn't clear HPPA. Build the question into intake so a non-qualifying lead never gets worked.
Not Legal Advice
General information, not legal advice. The precise contours of "certifying" consent and the "current specified banking relationship" should be confirmed against Public Law 119-36 with counsel before you operationalize them.
The Operator’s Compliance Brief
What changed in lead-gen compliance, and what to do about it. Free, no spam.
Sources
- H.R. 2808 — Homebuyers Privacy Protection Act (119th Congress) — Congress.gov (accessed 2026-06-29)
30+ years in lead gen · BRSG Founder
Bill Rice has spent 30+ years in mortgage, lending, and performance marketing — generating leads, buying them, and building the systems that route and work them. He founded a performance-marketing agency, owned a direct-to-consumer lender, and wrote The Lead Buyer's Playbook. He built Lead Compliance Hub to help operators navigate the legal landmines of online lead generation from an operator's seat, not a law firm's. Nothing he writes here is legal advice.
Key Terms to Know
FCRA
The Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.), the federal law governing how consumer reports may be furnished and used — including the prescreen/firm-offer exception at § 1681b(c).
Firm Offer of Credit
Under FCRA § 603(l), an offer of credit or insurance that will be honored if the consumer meets pre-selected criteria. It supplies the “permissible purpose” that historically made prescreened trigger-lead solicitations lawful without consumer consent.
HPPA
The Homebuyers Privacy Protection Act — H.R. 2808, Public Law 119-36, signed September 5, 2025, effective 180 days later (≈ March 4, 2026). It restricts when credit bureaus may sell a mortgage trigger lead to a third party.
Mini-TCPA
A state telemarketing statute that is stricter than the federal TCPA — for example Florida’s and Oklahoma’s. These laws can impose their own consent standards and private rights of action, so federal compliance alone is not enough.
One-to-One Consent
The FCC rule that would have required a consumer’s TCPA consent to name a single specific seller. It was vacated by a federal appeals court in 2025 before taking effect — but state mini-TCPAs and the underlying PEWC standard still govern.
Permissible Purpose
The FCRA requirement that a consumer report may only be furnished for an enumerated reason. A “firm offer of credit or insurance” not initiated by the consumer is one such permissible purpose.
The Operator’s Compliance Brief
What changed in lead-gen compliance, and what to do about it. Free, no spam.