The highly anticipated Homeowners Privacy Protection Act will officially becomes effective on March 5, 2026. The primary objective of this legislation is to address and reduce the volume of unsolicited calls, emails, and text messages that consumers often receive following a credit inquiry related to a mortgage application.
Up to this point, the three major credit bureaus—Experian, Equifax, and TransUnion—have generated and sold leads to third-party organizations. When a loan officer performs a hard credit inquiry, it triggers an alert at the bureau level. Subsequently, the bureaus sell these trigger leads based on the criteria specified by the third party, such as demographic information, age, credit score range, and other parameters. In some cases, within minutes of a credit inquiry, consumers may receive multiple unsolicited emails, text messages, and phone calls from brokers attempting to secure their business.
Going forward, in order to obtain a lead, the loan officer must provide documentation to the Credit Reporting Agencies confirming that they have authorization from the consumer to access their credit report. This authorization can be a signed document from the consumer granting permission to release their information or an active checkbox on a form indicating, “I consent to have my credit information shared with (Lender Name) for the purpose of obtaining a mortgage.” Even with the consumer’s consent, there must be a bona fide “firm offer of credit or insurance” involved. Leads cannot be purchased solely for generic marketing purposes.
There are some exceptions that do not require authorization from the consumer:
- If the company is the current mortgage servicer – the company that currently handles the mortgage.
- If the person is the original loan originator – the lender who originated the loan, even if they do not service it.
- If it is a depository institution with an existing relationship. Banks or credit unions which the consumer has an existing relationship with. Even if it is just a checking or savings account. They do not have to be the current mortgage holder or originator.
What businesses will be most impacted by this? Non-bank mortgage lenders relying on real-time alerts to engage with borrowers who have applied elsewhere. Additionally, marketing partners, such as insurance companies or credit card issuers, that utilize mortgage inquiry data for cross-selling purposes.
For the first year the Government Accountability Office (GAO) will do an additional study on the impact of Trigger Leads by text message. By September 2026, the Government Accountability Office (GAO) must submit a report evaluating whether residual benefits from these leads exist—such as promoting competition or consumer choice—and to offer recommendations for potential future reforms.
It is important to clarify that this regulation does not cover all types of credit applications. Specifically, it does not apply to credit cards, auto loans, or personal loans. The focus is solely on mortgage leads.
Additionally, this regulation does not eliminate the options for opting out of prescreened offers or registering on the Do Not Call Registry. Consumers are still encouraged to utilize these options for added security and to reduce leads related to other types of loans.
Does this mean the complete elimination of Trigger Leads? No, it does not. However, it should significantly reduce the volume of unsolicited communications that potential homebuyers currently receive.