NEWS: On September 5, 2025, President Trump signed into law, the Homebuyers Privacy Protection Act (H.R. 2808), also known as the Trigger Leads Bill. The Act amends the Fair Credit Reporting Act (FCRA) to limit the sharing of “trigger leads” by consumer reporting agencies (CRAs).
Trigger leads occur when a consumer applies for a mortgage and the lender’s inquiry to a CRA notifies the CRA that the consumer is interested in home financing. The CRA could then sell this information to other mortgage lenders as “trigger leads” without the consumer’s knowledge or approval. The loan applicant is then bombarded by phone, text, or mail messages from other competing lenders, trying to lure the consumer away from their chosen lender.
Under the FCRA, CRAs are currently permitted to resell consumer information to prospective creditors without the consumer’s permission if the prospective creditor is prepared to make that consumer a “firm offer of credit.” This Act puts clear “guardrails” around the sale of trigger leads, limiting how and when personal financial data can be shared.
The new law prohibits a CRA from providing a consumer’s credit report to a third party in connection with a residential mortgage transaction unless it’s part of a firm offer of credit or insurance and specific documentation is provided by the third party. What this means is that a CRA will not be allowed to furnish a “trigger lead” to a third party unless the third party certifies to the CRA that:
- The consumer explicitly consents to such solicitations;
- It has originated the current residential mortgage loan of the consumer;
- It is the servicer of the current residential mortgage loan of the consumer; or
- It is an insured depository institution or insured credit union and holds a current account for the consumer.
The law will take effect on March 5, 2026.