For mortgage lenders, trigger leads make perfect sense. Since that person has already had a credit report pulled, you know they’re serious about pursuing a mortgage. You can then step in, potentially edging out the lender they’re already working with. 

For the borrower, though, trigger leads created a confusing, often overwhelming situation. They thought they were talking with one lender, but suddenly a number of others might be calling, texting, and emailing with unsolicited offers. 

Outcry from borrowers has led to a significant change in how trigger leads can legally work. Let’s go over everything mortgage lenders need to know now that the Homebuyers Privacy Protection Act has become law. 

The upswell of opposition to trigger leads

This Act didn’t come out of nowhere. For years, consumers have been saying that the contacts they get from trigger leads are unwelcome. It became such a problem that the major credit bureaus had to set up an opt-out website. Still, many people didn’t know this was an option and got a bunch of unwelcome outreach. 

One survey found that 74% of people got unwanted contact after applying for a loan or insurance policy. 66% said they were contacted at least 10 times and 10% received more than 50 pings.

With such a torrent of uninvited solicitations, legislators decided it was time to do something. In a bipartisan effort, representatives and senators banded together to put a layer of consumer protection in place. They were bolstered by support from the Mortgage Bankers Association, the American Bankers Association, the National Consumer Law Center, and others. 

All of this culminated in some recently passed legislation: Public Law 119–36, commonly known as the Homebuyers Privacy Protection Act. 

It was signed on September 5, 2025 with the line, “This Act, and the amendments made by this Act, shall take effect on the date that is 180 days after the date of enactment of this Act.” That means that the Homebuyers Privacy Protection Act went into effect on March 4, 2026. So it now applies to credit bureaus and the lenders who typically get trigger leads from them. 

Breaking down the Homebuyers Privacy Protection Act

The main part of this Act that lenders need to know is in Section 2(a)(4)(B). Tellingly titled “Limitation,” it restructures how consumer reporting agencies can use the information they get. 

To make sense of it, let’s break §2(a)(4)(B) into pieces. 

“(B) LIMITATION.—If a person requests a consumer report from a consumer reporting agency in connection with a credit transaction involving a residential mortgage loan, that agency may not, based in whole or in part on that request, furnish a consumer report to another person under this subsection…”

Basically, if someone has their credit report pulled because they’re getting a mortgage, the credit bureau can’t turn around and provide that person’s information to anyone else. In other words, they can’t provide a trigger lead. 

But the Homebuyers Privacy Protection Act continues with a key word: “Unless.” This gives credit bureaus and lenders some workarounds.

Exceptions to the no-trigger-leads rule

The Act continues:

“...That agency may not, based in whole or in part on that request, furnish a consumer report to another person under this subsection unless—

• (i) the transaction consists of a firm offer of credit or insurance; and
• (ii) that other person—
  
  • (I) has submitted documentation to that agency certifying that such other person has, pursuant to paragraph (1)(A), the authorization of the consumer to whom the consumer report relates; or
  • (II)(aa) has originated a current residential mortgage loan of the consumer to whom the consumer report relates; (bb) is the servicer of a current residential mortgage loan of the consumer to whom the consumer report relates; or (cc)(AA) is an insured depository institution or credit union; and (BB) holds a current account for the consumer to whom the consumer report relates.’’

That’s a lot to get your mind around. Basically, this subsection says that a credit reporting agency can only provide the lead to a lender if that lender’s outreach meets two criteria.

First, §2(a)(4)(B)(i) says that you have to provide them with a firm offer. It needs to be a legitimate prequalification. You can’t reach out as part of your marketing efforts, nor can one of your loan officers get in touch simply seeing if they qualify. 

But that’s not all. For a trigger lead to be permissible under this new law, one of the following needs to be true of your lending institution:

• You have that consumer’s explicit permission to contact them.
• You originated their current mortgage.
• You service their current mortgage. 
• You’re a bank or credit union with which that consumer already has an account. 

To sum that all up, under the Homebuyers Privacy Protection Act, trigger leads are only allowed if you’re approaching that lead with a firm offer AND you’re already working with that consumer OR have their explicit permission. 

What you can do instead

If your team has historically relied on trigger leads, now is the time to pivot. Fortunately, you have lots of other options — and these channels might help consumers look more favorably on you. You’re avoiding the overwhelm that came with trigger leads by choosing other ways to connect.

We recently did a deeper dive into alternative lead sources now that trigger leads are mostly off the table. We touch on some other paid lead sources, like Bankrate and LendingTree. But we also explore one of the biggest resources here: your own website. With options like live rate tables and a chatbot that can offer personalized quotes, you can turn website visitors into captured leads. 

With trigger leads gone, it’s time for a lot of lenders to pivot their lead generation strategy. If you’re one of them, we can help. To explore setting up website tools that help you convert visitors into leads, and then convert those leads into closed loans, let’s talk. Book some time with our team at your convenience.