The Homebuyers Privacy Protection Act, and what loan officers can still do.
H.R. 2808 ended the third-party mortgage trigger lead industry on March 4, 2026. This is the plain-English guide to the trigger lead ban, what changed, what loan officers can still do, and what the GAO's November 7, 2026 report found in the first eight months of enforcement.
A federal restriction on selling mortgage trigger leads.
The Homebuyers Privacy Protection Act (HPPA, H.R. 2808) is a federal law that restricts the sale and purchase of consumer mortgage trigger leads by third-party lenders. It took effect on March 4, 2026, the ninetieth day after enactment. The statute amends the Fair Credit Reporting Act to narrow the permissible-purpose basis on which the national credit bureaus can furnish prescreened consumer reports generated by a mortgage credit pull.
A mortgage trigger lead is the prescreened consumer report a credit bureau sells when a lender pulls a borrower's credit for a new mortgage. Before HPPA, dozens of competing lenders could buy that lead within 24 hours of the pull and solicit the consumer. HPPA ends that practice for third parties, while preserving access for the originator of the consumer's current mortgage, the servicer of record, and depository institutions with an existing account relationship.
The practical result for mortgage loan officers: the third-party trigger lead stream is closed. The lawful, first-party stream that remains is each loan officer's own book of past clients, where the originator relationship already satisfies the FCRA permissible-purpose test and the Gramm-Leach-Bliley Act's non-public personal information rules.
What the trigger lead ban actually changed.
Open market
- Credit bureaus sold trigger-lead lists to any lender on a daily basis.
- A single mortgage credit pull generated calls and texts from 10 to 30 competing lenders within 24 hours.
- Consumer complaint volume on unwanted mortgage solicitations ran in the tens of millions per year.
- Independent mortgage brokers paid between $0.75 and $3.00 per lead and built pipelines around the stream.
Relationship-only access
- Credit bureaus may furnish prescreened reports only to parties with a defined relationship: the originator, the servicer, or an existing-relationship depository.
- Independent lenders and brokers without one of those relationships cannot buy mortgage trigger leads.
- Lenders who did have an originator or servicer relationship with the borrower retain access.
- Opt-in borrower-initiated leads (consent captured on the loan officer's own site) remain fully available.
What loan officers can still do, legally.
1. Work your own past-client book.
Every loan you originated is a borrower you already have an FCRA permissible-purpose relationship with. Rate-drop windows, ARM resets, HELOC and cash-out opportunities, anniversary touches, and credit-improvement events are all actionable from data you already hold. This is the single largest source of post-HPPA mortgage activity for an individual loan officer, and it is the exact problem LO Radar was built to solve.
2. Work the lender's or servicer's portfolio where you have standing.
If you originate for a bank or an IMB that services its own portfolio, you have access to that portfolio under the same existing-relationship exception. Servicing signals (payoff quotes viewed, autopay cancellations, escrow changes) remain lawful first-party intelligence and are often the strongest leading indicators of a payoff weeks before it happens.
3. Capture borrower-initiated consent on your own site.
A past borrower (or any homeowner) who opts in to "text me when I can save $300 a month" gives you the strongest possible consent record: timestamped, one-to-one, in the borrower's own words. Borrower-set triggers are the only post-HPPA lead source that is cleaner than past-client intelligence, and they are available to any loan officer who has a landing page and a calculator.
4. Partner with your title, insurance, and real-estate ecosystem under RESPA-safe terms.
Co-marketing is still permitted when the loan officer pays fair market value for the actual promotional cost and there is no thing of value exchanged for referrals. See our RESPA Section 8 guide for the current enforcement posture.
What stops working.
Buying third-party mortgage trigger leads. Reselling borrower credit-pull lists. Any pipeline that depended on competing against an originator's own credit pull within the 24-hour window. Rebuilding around items 1 through 4 is not optional for an independent loan officer; it is the only legal path left.
What the first eight months of HPPA looked like.
The Government Accountability Office's first review of HPPA enforcement, published November 7, 2026, measured the eight months from March 4 (effective date) through October 31, 2026. Three findings matter for a loan officer thinking through the next twelve months:
Consumer complaint volume on unsolicited mortgage calls fell sharply. The GAO found that CFPB, FCC, and state attorneys general received materially fewer complaints about mortgage trigger-lead solicitations in the eight-month window than in the equivalent pre-HPPA baseline. Enforcement actions were correspondingly rare.
Independent mortgage brokers saw lead-cost shifts in both directions. Brokers who had relied on purchased trigger leads reported pipeline shortfalls through roughly the first four months, then partial recovery as they rebuilt around past-client monitoring, borrower-initiated opt-ins, and real-estate-agent referral networks. Lead-cost-per-closed-loan fell for those who successfully rebuilt around first-party sources.
Existing-relationship holders captured a larger share of refinance activity. Depository institutions, servicers, and originators with standing access ran a higher recapture rate in the post-HPPA period than in the pre-HPPA baseline. For a bank home-lending head, this is the structural tailwind that makes a past-client intelligence investment underwrite itself.
HPPA questions, answered.
What is a mortgage trigger lead?
A mortgage trigger lead is a prescreened consumer report that credit bureaus sell to lenders when a consumer's credit is pulled for a mortgage inquiry. Before the Homebuyers Privacy Protection Act, any lender could buy these leads and solicit the consumer within 24 hours of a competing lender's pull. The practice generated tens of millions of unwanted calls and texts per year and was the subject of long-running consumer complaints before Congress acted.
When did the trigger lead ban take effect?
The Homebuyers Privacy Protection Act (H.R. 2808) was signed into law in 2025 and its mortgage trigger lead restrictions took effect on March 4, 2026. Some sources cite March 5, 2026; the statute itself is the March 4 date, which is the ninetieth day after enactment. The Government Accountability Office published GAO-27-108874 on November 7, 2026, reviewing the first eight months of implementation.
Can loan officers still get trigger leads on their own past clients?
Yes. HPPA restricts third-party purchase of credit-bureau trigger leads. It does not restrict a loan officer or lender from monitoring their own past-client book, since that borrower data is held under an existing GLBA relationship. Past-client intelligence platforms like LO Radar operate on this lawful, first-party data and are structurally compliant with HPPA.
Are mortgage trigger leads now illegal?
The sale and purchase of consumer mortgage trigger leads by third parties is restricted under HPPA. Exceptions exist for the originator of the consumer's current mortgage, the loan servicer, and certain depository institutions with an existing account relationship. Independent lenders and mortgage brokers without one of those relationships can no longer buy the leads at all.
What replaces trigger leads for loan officers after HPPA?
Three sources remain legally available: (1) a loan officer's own past-client book, (2) the lender or servicer's own portfolio where the relationship already exists, and (3) borrower-initiated opt-ins (consent capture on the loan officer's own site). Everything else that depended on third-party credit-bureau access is now blocked for independents.
What did the GAO report on HPPA find?
The GAO's November 7, 2026 report (GAO-27-108874) documented the first eight months of HPPA enforcement. Consumer complaint volumes about unsolicited mortgage calls dropped significantly, independent mortgage brokers reported substantial lead-cost shifts, and servicer-affiliated lenders and existing-relationship holders captured a larger share of refinance activity than in the pre-HPPA baseline.
Your past-client book is the trigger lead source you already own.
LO Radar consolidates every past borrower across every LOS you have ever used and runs the seven trigger categories (rate-drop, ARM reset, anniversary, HELOC, cash-out, second-home, credit-improvement) daily. HPPA-compliant by construction: all first-party data, no bureau pulls, no purchased leads.
Bring a CSV, see your post-HPPA book in 15 minutes