On August 2, the U.S. Senate passed the Homebuyers Privacy Protection Act (H.R. 2808) by unanimous consent, which amends the Fair Credit Reporting Act (FCRA) to restrict consumer reporting agencies from sharing “trigger leads” generated in connection with residential mortgage credit inquiries. The bill now awaits the President’s signature and would take effect 180 days after enactment.
Trigger leads are generated when a consumer applies for residential mortgage credit, prompting credit bureaus to share limited prescreened data with other lenders. While originally intended to encourage competition through firm offers of credit, trigger leads have drawn criticism from lawmakers and consumer advocates for enabling a surge of unsolicited calls, texts, and emails following mortgage applications. The bill curbs this practice by sharply limiting who can access trigger leads and under what conditions.
Specifically, the bill’s provisions include:
- Restrictions on trigger leads. A consumer reporting agency may furnish a mortgage-related trigger lead only if the recipient: (1) has obtained the consumer’s documented authorization to access their report; (2) originated the consumer’s current residential mortgage loan; (3) services the consumer’s current residential mortgage loan; or (4) is a depository institution or credit union that holds a current account for the consumer.
- Preservation of firm-offer standard. Every trigger-lead recipient must continue to make a firm offer of credit, consistent with the existing FCRA safeguard against purely speculative solicitations.
- GAO study of text-message marketing. The Comptroller General must report to Congress within a year on the effectiveness and consumer impact of trigger-lead solicitations delivered by text.
Putting It Into Practice: If signed, the Act will start a 180-day countdown to compliance—meaning credit bureaus, mortgage lenders, and lead generators should review their prescreening practices and revise data-sharing protocols to align with the new statutory restrictions. Financial institutions should also prepare to document authorization flows, limit data access to only eligible entities, and maintain firm offer compliance under FCRA.