Homebuyers Privacy Protection Act
HPPA
Credit reporting · Marketing · Financial
This 2025 law limits 'trigger leads', which are credit reports sold to other lenders when a consumer applies for a mortgage. From March 4, 2026, an agency may pass on such a report only for a firm offer of credit or insurance to a party that has the consumer's documented consent or already originates, services, or holds an account relationship with the consumer.
- Where
- Federal
- Citation
- Pub. L. 119-36 (Sept. 5, 2025); 15 U.S.C. 1681b(c)(4)
- Status
- In force
- In force since
- 2026-03-04
- Enforced by
- CFPB and FTC (through FCRA enforcement), plus FCRA private actions
- People can sue
- Yes
- Penalties
- Violations are FCRA violations: willful noncompliance allows actual or $100-$1,000 statutory damages plus punitive damages and fees; regulators may also enforce.
- Applies to
- Consumer reporting agencies that receive residential mortgage credit inquiries
- Third parties seeking prescreened 'trigger lead' lists tied to mortgage inquiries
Practices it requires
- Do not furnish a mortgage-inquiry-triggered consumer report to another person unless the transaction is a firm offer of credit or insurance.15 U.S.C. 1681b(c)(4)(B)(i) · From 2026-03-04
- The recipient must certify it has the consumer's authorization, or be the consumer's current mortgage originator or servicer, or an insured depository institution or credit union holding a current account for the consumer.15 U.S.C. 1681b(c)(4)(B)(ii) · From 2026-03-04
Sources
- Official text
- 15 U.S.C. 1681b, incl. effective date note for Pub. L. 119-36 (OLRC)
- Congress.gov, Public Laws of the 119th Congress (API listing, Pub. L. 119-36)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: The effective date (180 days after Sept. 5, 2025) was computed as March 4, 2026 from the statutory note
Research reference, not legal advice.