Homebuyers Privacy Protection Act

Previously, we wrote about the Homebuyers Privacy Protection Act (the "Act") when it passed in the House (you can find that compliance blog post here). At the time, similar versions of the bill were passed by both the House and Senate, with one key difference between them. Those versions have now been reconciled, and the Act was signed into law by President Trump on September 5, 2025. However, the Act is not effective yet, as the final version of the Act sets a 180-day compliance window from the date of enactment.

As noted, both the House and the Senate had passed similar versions - with the difference being a provision in the House version that called for a Government Accountability Office (GAO) study on the "value of trigger leads received by text message." That provision was retained in the final version. Under the new law, the GAO is required to report to Congress within one year on the value of text-based trigger lead solicitations.

Now that it's been signed by the President, let's recap: the primary goal of the Act is to amend the Fair Credit Reporting Act ("FCRA") by placing new limits on how consumer reports can be used in residential mortgage transactions-specifically addressing the practice known as "trigger leads." Trigger leads occur when a member applies for a mortgage and that inquiry is reported to the credit bureaus. The bureaus may then sell consumer report information based on that inquiry to other lenders. This often results in members receiving a flood of unsolicited inquiries from competing lenders shortly after applying.

The FCRA requires a lender or credit union to have a permissible purpose before obtaining or using a member's consumer report information. The Act narrows the scope of permissible purposes by requiring more stringent conditions before a consumer report can be shared. So, what are the conditions? Per the Act:

"(B) LIMITATION.-If a person requests a consumer report from a consumer reporting agency in connection with a credit transaction involving a residential mortgage loan, that agency may not, based in whole or in part on that request, furnish a consumer report to another person under this subsection unless-

(i) the transaction consists of a firm offer of credit or insurance; and

(ii) that other person-

(I) has submitted documentation to that agency certifying that such other person has, pursuant to paragraph (1)(A), the authorization of the consumer to whom the consumer report relates; or

(II) (aa) has originated a current residential mortgage loan of the consumer to whom the consumer report relates;

(bb) is the servicer of a current residential mortgage loan of the consumer to whom the consumer report relates; or

(cc)(AA) is an insured depository institution or credit union; and

(BB) holds a current account for the consumer to whom the consumer report relates.". (Emphasis added).

In other words, credit reporting agencies would be prohibited from sharing a consumer's credit report with third parties in connection with a residential mortgage loan - unless the report is being used to make a firm offer of credit or insurance, and the third party either has the consumer's explicit consent (i.e., "has submitted documentation to that agency certifying that such other person has… the authorization of the consumer to whom the consumer report relates"), is already involved in one of the consumer's current mortgages as the originator or servicer, or is a credit union or insured depository institution that currently holds an account for the consumer.

Note: permissible purpose and firm offers of credit are discussed in more detail in our prior compliance blog, linked above.

So, what happens if members continue to get these types of inquiries even after the law goes into effect? While there is no specific enforcement mechanism established by or outlined in the Act itself, the Consumer Financial Protection Bureau ("CFPB") handles violations of the FCRA and members could report illegal trigger leads through the CFPB's consumer complaint database. Members may also report such inquiries to their state attorney general's office.

Overall, credit union members deserve the ability to apply for a residential mortgage loan without being inundated with invasive and unsolicited offers from unfamiliar or competing lenders. In addition to promoting a more respectful mortgage process experience, the Act empowers members to control who can access and use their credit inquiry data - helping to reduce unwanted solicitations and prevent potential misuse of consumer data by third parties.