A significant step forward in consumer privacy protection within the mortgage industry was taken on September 5, 2025, with President Trump signing into law H.R. 2808—the bipartisan Homebuyers' Privacy Protection Act.
This act would limit the ability of credit bureaus (e.g., Equifax, Experian, and TransUnion) to sell trigger leads to mortgage brokers and lenders when a consumer has applied for a mortgage. This legislation would amend the Fair Credit Reporting Act (FCRA) to include specific restrictions on Trigger Leads as follows:
Consumer reporting agencies—Equifax, Experian, and TransUnion—are prohibited from furnishing a consumer’s credit report to a third party in connection with a residential mortgage transaction unless:
- Has the consumer’s explicit authorization (documented consent); or
- Is the originator or servicer of the consumer’s current mortgage loan; or
- Is an insured depository institution or credit union that holds a current account with the consumer.
The law is set to take effect on March 5, 2026, and is expected to foster a more respectful and streamlined homebuying experience.
At the federal level, the Homebuyers Privacy Protection Act is supported by a broad coalition of consumer advocacy groups and financial trades, including the Mortgage Bankers Association, the Independent Community Bankers of America, the American Bankers Association, the National Association of Mortgage Brokers, the Broker Action Coalition, Community Home Lenders of America, and others.