What is a mortgage trigger lead?

A trigger lead is generated when a consumer applies for a mortgage and the credit pull registers at the credit bureaus. Before the new law, bureaus could sell that event (with the consumer's contact information) to other lenders, who would then solicit the consumer, often within hours of their application.

When did the Homebuyers Privacy Protection Act take effect?

The Act was signed into law in September 2025 and its trigger-lead restrictions took effect in early March 2026, 180 days after enactment.

Does the law ban all trigger leads?

No. It restricts them. Credit bureaus can still furnish trigger leads in limited cases: for example, when the consumer has authorized the contact, or when the recipient has an existing relationship with the consumer, such as their current mortgage originator or servicer or a bank or credit union where they hold an account. Recipients generally must also be in a position to make a firm offer of credit.

Does the trigger lead ban affect leads from consumer-submitted web forms?

No. The law targets the sale of credit-inquiry data by credit bureaus. A consumer who fills out a form asking to be contacted about a mortgage has opted in directly. That's first-party, consent-based lead generation, which is the model the law leaves fully intact.

Is this article legal advice?

No. It's a plain-language summary for lead buyers, written by a lead generation company. For decisions about your own compliance obligations, consult a qualified attorney.

The Trigger Lead Ban: What the Homebuyers Privacy Protection Act Changed for Lead Buyers

The Homebuyers Privacy Protection Act, signed into law in September 2025 and effective in early March 2026, amended the Fair Credit Reporting Act to sharply restrict "trigger leads": the practice of credit bureaus selling notice of a consumer's mortgage credit inquiry to other lenders. Bureaus may now furnish that information only in narrow cases, chiefly when the consumer consents or the recipient already has a relationship with them, such as their current lender, servicer, or a bank where they hold an account. For lead buyers, the practical effect is simple: the era of buying borrower intent data scraped from someone else's credit pull is largely over, and consent-based lead generation is now the standard the market is built on.

This article is a plain-language summary for people who buy leads, not legal advice.

What trigger leads were

When a consumer applied for a mortgage, the lender pulled credit. That inquiry registered at the credit bureaus. The bureaus, permitted under the pre-2026 reading of the Fair Credit Reporting Act, could sell the event as a "trigger lead": the fact that this specific person, at this address and phone number, just applied for a mortgage somewhere.

Competing lenders bought those triggers and dialed fast. Consumers who had just applied with one lender commonly reported a burst of unsolicited calls and texts within hours, from companies they'd never contacted. From the industry's side, it was high-intent data. From the consumer's side, it looked like their mortgage application had leaked. Functionally, it had.

What the Act changed

The Homebuyers Privacy Protection Act (H.R. 2808, 119th Congress) passed both chambers and was signed in September 2025, with the trigger-lead provisions taking effect 180 days later, in early March 2026. It amends the Fair Credit Reporting Act to prohibit consumer reporting agencies from furnishing a consumer report in connection with a residential mortgage inquiry (the trigger-lead mechanism) except in limited circumstances.

In general terms, a bureau may still furnish the information when:

The consumer authorized it. Explicit consent to be contacted keeps the door open.
An existing relationship exists. The recipient originated the consumer's current mortgage, services it, or is a depository institution or credit union where the consumer holds an account.
Firm-offer conditions are met. Recipients generally must be positioned to make a firm offer of credit rather than merely prospecting.

The precise contours live in the statute's text, and edge cases belong to attorneys. The direction, though, is unambiguous: unsolicited third-party mining of mortgage credit inquiries is now the exception, not the business model.

See exactly how your leads would be delivered

Twenty minutes, live screens, per-market pricing in writing, and a straight answer if your market is full.

Book a call

What it means if you buy leads

The cold-call channel got quieter

Originators who relied on trigger data to intercept other lenders' applicants lost most of that channel in March 2026. If part of your pipeline was built on it, that volume needs replacing, and the replacements that remain are the channels the law deliberately left standing.

Consent-based generation is the surviving model

A consumer who completes a mortgage inquiry form and asks to be contacted has opted in directly. Nothing in the Act touches that. First-party lead generation (a consumer site, a form, express consent, documented) is now not just the cleaner model but effectively the default one. (It's the only model we've ever operated at Mortgage Connect Pro: every lead we deliver originates from a consumer's own submission, with consent captured and stored on the lead record.)

Provenance questions are now table stakes

The law raised the stakes on knowing where a lead came from. When you evaluate a vendor, ask directly: what is the source of this lead, and can you show me the consumer's consent? A vendor generating its own opt-in inquiries can answer with a record. A vendor aggregating data of uncertain origin will answer with adjectives. After March 2026, that difference matters more than it ever has.

Consumers should be easier to reach

One second-order effect worth naming: borrowers who submit an inquiry are no longer buried under trigger-driven calls from strangers within the hour. The consumer who asked to hear from you now has a somewhat quieter phone, which makes your first call, made quickly, count for more.

What to do about it

Audit your current sources. If any vendor's answer to "where do these come from" involves credit-inquiry data, understand exactly which exception they're operating under, in writing.
Weight your mix toward first-party consent. Leads that begin with a consumer's own request to be contacted carry both better economics and none of this law's ambiguity.
Keep the records. Consent documentation per lead was already good practice under telemarketing rules; it's now part of the provenance story for the whole channel.

The bottom line

The Homebuyers Privacy Protection Act ended the broad sale of mortgage trigger leads as of March 2026, leaving narrow exceptions for consent and existing relationships. For lead buyers, the takeaway isn't complicated: buy leads that start with the borrower raising their hand, from vendors who can prove it, and the trigger-lead ban is a change that happened to your competitors, not to you.