Mortgage Trigger Leads After the Homebuyers Privacy Protection Act

Starting 180 days after its September 5 signing, the Homebuyers Privacy Protection Act will bar credit bureaus from selling mortgage trigger leads to most lenders. Buyers with the borrower’s authorization or certain existing relationships can still get them. The Act doesn’t change the Telephone Consumer Protection Act, and the TCPA governs the calls and texts that follow a lead. A lender that fixes its Do Not Call scrubbing, consent records, and relationship proof now, before the Act takes effect, is in a better position to defend those claims.

What is a mortgage trigger lead?

A trigger lead is a list of consumers whose credit was just pulled for a mortgage, sold to other lenders who want to compete for the loan. The House Financial Services Committee’s report on the bill explains that when a report is requested for a mortgage application, “the CRA may notify other mortgage lenders by selling them a trigger lead regarding this consumer.”

The legal hook is the Fair Credit Reporting Act’s prescreening provision. Under 15 U.S.C. § 1681b(c)(1), a credit bureau may furnish a report for a transaction the consumer didn’t start only if “the consumer authorizes the agency to provide such report to such person,” or if “the transaction consists of a firm offer of credit or insurance” and the other prescreening conditions are met. Trigger leads have run on that firm-offer route.

The committee report also describes what the committee was responding to: “in practice, the wide availability of trigger leads has led to consumers being inundated with phone calls and text messages.” I think that makes the TCPA part of any trigger-lead compliance plan.

What does the Homebuyers Privacy Protection Act change, and when?

It adds a new paragraph (4) to 15 U.S.C. § 1681b(c) that limits prescreened reports triggered by a mortgage inquiry. The President signed H.R. 2808, Public Law 119-36, on September 5, 2025. Section 3 provides that the Act “shall take effect on the date that is 180 days after the date of enactment of this Act,” which puts the start date in early March 2026.

Once it’s in effect, the new paragraph provides that a credit bureau that gets a request for a report “in connection with a credit transaction involving a residential mortgage loan” may not, based on that request, furnish a report to another person unless the transaction is a firm offer of credit or insurance and the other person fits one of four categories. Under the public law, the buyer must have certified to the bureau that it has the consumer’s authorization under paragraph (1)(A), or must have “originated a current residential mortgage loan” of the consumer. The Act also allows “the servicer of a current residential mortgage loan” of the consumer, and an insured depository institution or credit union that “holds a current account” for the consumer.

Section 4 also directs the Government Accountability Office to study “the value of trigger leads received by text message” and report to Congress within 12 months of enactment.

Does a mortgage application give another lender consent to call or text?

No. The consumer applied to a different company.

The FCC’s rule at 47 C.F.R. § 64.1200(a)(2) bars marketing calls to a cell phone that use “an automatic telephone dialing system or an artificial or prerecorded voice” without the called party’s “prior express written consent.” The rule defines that consent as a signed written agreement “that clearly authorizes the seller” to send those messages, and it names the phone number. A trigger-lead buyer is the seller, and unless it collected its own signed consent, the borrower never signed anything naming it.

So a prerecorded or artificial-voice message to a trigger-lead consumer is the riskiest version of this outreach. The FCC ruled in February 2024, in FCC 24-17, that the TCPA’s restrictions on an “artificial or prerecorded voice” cover current AI technologies that generate human voices. The same rule’s paragraph (a)(3) requires prior express written consent for prerecorded telemarketing to residential lines too, and the established-business-relationship exception doesn’t apply to either one.

The autodialer theory is narrower. In Facebook, Inc. v. Duguid, the Supreme Court held that an autodialer must have “the capacity to use a random or sequential number generator to either store or produce phone numbers to be called.” I’d expect most platforms that text a purchased list to fall outside that test. Our January post covers autodialer claims after Duguid in more detail. But the voice rule and the Do Not Call rules don’t depend on how the number was dialed.

Can a lender call trigger-lead consumers who are on the Do Not Call Registry?

Generally only with an established business relationship or the consumer’s permission. The FCC’s rule asks for that permission in a signed writing, and that’s the record to keep. A firm offer of a mortgage is a sales pitch for a loan, so plan your compliance as though every firm-offer call or text is a telephone solicitation.

The FCC’s rules bar telephone solicitations to a residential subscriber on the national Do Not Call Registry, the federal list of numbers whose owners have asked not to get sales calls. Paragraph (e) applies that rule to “telephone solicitations or telemarketing calls or text messages to wireless telephone numbers to the extent described in” the FCC’s 2003 order. Paragraph (c)(1) adds quiet hours: no solicitations “before the hour of 8 a.m. or after 9 p.m. (local time at the called party’s location).”

The established business relationship is where the new Act and the TCPA interact. Under the rule’s definition in paragraph (f)(5), the relationship rests on a “purchase or transaction with the entity within the eighteen (18) months immediately preceding the date of the telephone call,” or on an “inquiry or application regarding products or services offered by the entity within the three months immediately preceding the date of the call.” An application to someone else creates no relationship with you.

The Act’s categories and the TCPA’s test aren’t the same.

The originator of a current loan. The FCC said in its 2003 order (¶ 113) that “The 18-month time period runs from the date of the last payment or transaction with the company.” If you sold the loan and the servicing long ago, you may pass the Act’s test and still have no relationship under the TCPA.

The servicer. Each monthly payment is a transaction with you, and the FCC’s 2003 order says a prior relationship “entitles the company to call that consumer for eighteen (18) months from the date of the last payment or financial transaction.” Keep the payment history.

A bank or credit union holding an account. An active deposit account gives you recent transactions to point to, since the FCC measures the 18 months from the last one. The trap is affiliates. The rule provides that a relationship with one entity “does not extend to affiliated entities unless the subscriber would reasonably expect them to be included given the nature and type of goods or services offered by the affiliate and the identity of the affiliate.” I think a bank’s own mortgage affiliate, under a shared name, is the kind of affiliate a customer would expect. But the Act’s account-holder category covers the bank or credit union itself, so a separately organized mortgage affiliate needs its own basis under the Act to get the lead, as well as a TCPA basis to call.

A do-not-call request ends the relationship: the rule says a seller-specific request “terminates an established business relationship for purposes of telemarketing and telephone solicitation even if the subscriber continues to do business with the seller.” And the private claim under 47 U.S.C. § 227(c)(5) requires “more than one telephone call within any 12-month period by or on behalf of the same entity,” so a single call or text doesn’t support a private Do Not Call claim.

How exposed is a lender that gets this wrong?

Exposure is counted per violation, so it grows with every number a campaign reaches.

The reasonable-practices defense matters here. Section 227(c)(5) makes it “an affirmative defense” that the defendant “has established and implemented, with due care, reasonable practices and procedures to effectively prevent telephone solicitations” that violate the rules. The FCC’s rule adds a safe harbor for a Registry call that was an error, if the company meets standards as part of its routine business practice. Among other conditions, those include written procedures, training, an internal do-not-call list, documented scrubbing against a Registry download “no more than 31 days prior to the date any call is made,” and buying its own Registry access. Our April post on internal do-not-call policies walks through building that record, including the court split over whether the company-specific rules carry a private claim.

What should lenders and lead buyers change before the Act takes effect?

Start with the authorization route. The Act lets a buyer certify that it has the consumer’s authorization under § 1681b(c)(1)(A). If you collect that authorization anyway, build the form so it also meets the TCPA. That means a signed agreement that names your company, lists the phone number, and includes a clear and conspicuous disclosure that the consumer is authorizing telemarketing calls using an automatic telephone dialing system or an artificial or prerecorded voice and isn’t required to agree as a condition of any purchase. That tracks the definition in paragraph (f)(9). One form, two statutes.

Then map every lead to a category before anyone dials. Tag each record with the Act’s basis for the purchase (authorization, originator, servicer, or account holder) and, separately, the TCPA basis for the call: signed permission, an established relationship with the date of the last transaction, or a clean Registry scrub dated within 31 days of the call.

Next, take prerecorded and AI-voice messages out of trigger-lead campaigns unless signed consent naming you is on file. Keep the 8 a.m. to 9 p.m. window in the borrower’s local time. And make sure your texting platform honors replies like “stop” and “cancel.” For consent-based messages, the FCC’s rule at paragraph (a)(10) says those words, sent in reply to a text, are a “reasonable means per se to revoke consent,” and it requires revocations to be honored “within a reasonable time not to exceed ten business days.” A stop request also goes on your internal do-not-call list.

Finally, look at your vendors. If a vendor calls or texts for you, the contract decides how much of that risk you can shift back to the vendor, and our July post on TCPA vendor contracts and indemnity covers the terms that matter.

Before you answer a trigger-lead TCPA claim

1. Put a litigation hold on call and text logs, dialer and texting-platform data, and the consent or relationship records for each number involved.
2. Pull the opt-out and internal do-not-call history for those numbers, with the date each request came in and the date it was honored.
3. Pull the Registry scrub records and the download dates for the campaigns that reached them.
4. Collect the trigger-lead purchase records, the vendor and lead-source contracts, the scripts, and any recorded or AI-voice audio files.
5. Talk to a lawyer before you respond to the demand letter, contact the borrower, or offer anything to settle.

The firm’s TCPA defense lawyers page summarizes how claims involving calls and texts to mortgage trigger-lead consumers are defended.

Questions lenders ask about trigger leads and the TCPA

Can we keep buying trigger leads before the Act takes effect?

Yes, subject to the existing prescreening rules, until the effective date in early March 2026. But the TCPA applies to those calls and texts today. A purchase that’s lawful under the Fair Credit Reporting Act doesn’t make the outreach lawful under the TCPA.

Does the Act’s exception for our own customers also satisfy the TCPA?

Not automatically. The Act asks whether you originated or service a current mortgage, or hold a current account. The TCPA’s established business relationship asks whether there was a purchase or transaction with you in the last 18 months (or an inquiry or application to you in the last three), and whether the consumer has asked you to stop calling.

Can a lead aggregator’s consent form cover our calls?

Only if it actually authorizes your company. The FCC’s rule requires written consent to authorize the seller, which is you. The FCC’s 2023 one-to-one consent rule, and a companion rule requiring consented calls to be “logically and topically associated with the interaction that prompted the consent,” never took effect. The Eleventh Circuit vacated both in Insurance Marketing Coalition Ltd. v. FCC in January 2025. A signed form that names your company is still the record I’d want to defend.

Do texts to trigger-lead consumers count as calls?

The FCC’s rules treat them as covered, but the question is now contested for Do Not Call claims. The rule applies the Registry and company-specific rules to text messages sent to wireless numbers, to the extent its 2003 order describes, and the safe course is to scrub texts like calls. But the Supreme Court held in June, in McLaughlin Chiropractic Associates v. McKesson Corp., that “In an enforcement proceeding, a district court must independently determine for itself whether the agency’s interpretation of a statute is correct.” In July, the court in Jones v. Blackstone Medical Services dismissed Do Not Call claims built on texts, concluding that “under a plain reading, Section 227(c)(5) of the TCPA does not regulate text messages.” It’s one district court, and an appeal is pending, but a lender sued over texts alone should raise it.

Facing a TCPA claim over trigger-lead calls or texts?

If your company is defending a TCPA claim over calls or texts to mortgage applicants, the lead-purchase records and the scrub logs for each number are the first documents to pull. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving calls and texts to mortgage trigger-lead consumers. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The Act is the Homebuyers Privacy Protection Act, Pub. L. No. 119-36, 139 Stat. 493 (2025) (H.R. 2808), with the committee’s House Report No. 119-166. The prescreening provision is 15 U.S.C. § 1681b(c).

The TCPA is 47 U.S.C. § 227. The FCC’s rules are at 47 C.F.R. § 64.1200, as published in the eCFR on September 22, 2025. The FCC’s discussion of the established business relationship is in its 2003 Report and Order, FCC 03-153, ¶ 113. The FCC’s ruling on AI-generated voices is FCC 24-17 (Feb. 8, 2024).

The Supreme Court decisions are Facebook, Inc. v. Duguid, 592 U.S. 395 (2021), and McLaughlin Chiropractic Associates, Inc. v. McKesson Corp., No. 23-1226 (U.S. June 20, 2025). The Eleventh Circuit’s decision is Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. Jan. 24, 2025). The district court order is Jones v. Blackstone Medical Services, LLC, No. 1:24-cv-01074 (C.D. Ill. July 21, 2025), appeal pending.

This post is general information about the Telephone Consumer Protection Act and related laws as of September 22, 2025. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.