Mortgage Lead Consent: FCC and CFPB Requirements

TL;DR

Mortgage is one of the few lead generation verticals governed by two distinct federal agencies at once: the FCC, through the Telephone Consumer Protection Act and its implementing rules, and the Consumer Financial Protection Bureau, through the regulations that govern how lenders and brokers may advertise, compensate referrals, and handle consumer financial data.
The TCPA floor is the same as any other vertical. Autodialed or prerecorded telemarketing calls and texts to a mobile number require prior express written consent satisfying the four-element test at 47 C.F.R. § 64.1200(f)(9), and the FCC’s 2023 Lead Generators Order made that consent seller-specific.
The CFPB layer is what makes mortgage distinct. RESPA Section 8 (12 U.S.C. § 2607) restricts paying for referrals of settlement-service business, the Mortgage Acts and Practices–Advertising Rule (Regulation N, 12 C.F.R. Part 1014) governs the content of the disclosures the consumer sees, and the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) governs how nonpublic personal information collected at the lead event may be shared.
Rate-shopping behavior is the structural driver of mortgage TCPA exposure. A borrower comparing rates routinely submits the same number to several lenders and aggregators within minutes, producing overlapping, competing, and sometimes contradictory consent records for the same phone number.
The consent records that survive in mortgage litigation share the same anatomy as every defensible record: the rendered disclosure the consumer actually saw, the affirmative consumer action, an immutable timestamp, the named lender or broker as the seller, and an unbroken chain of custody from the consent event to the number dialed — plus, in mortgage, a record that the RESPA and advertising-rule constraints were satisfied at the same moment.

Most lead generation verticals answer to a single federal consent regime: the TCPA, administered by the FCC. Mortgage answers to two.

The first is the FCC’s TCPA framework, which governs whether a lender or broker may place an autodialed or prerecorded call or text to the consumer at all. That analysis is identical in structure to insurance, solar, or home services — prior express written consent, seller-specific, with a chain of custody to the dialed number.

The second is the Consumer Financial Protection Bureau’s authority over mortgage origination and advertising. The CFPB does not regulate the call; it regulates the transaction the call is trying to start. That means three additional bodies of law sit on top of the TCPA whenever a lead is a mortgage lead: the anti-kickback provisions of the Real Estate Settlement Procedures Act, the advertising-content rules of Regulation N, and the data-sharing constraints of the Gramm-Leach-Bliley Act.

These regimes are not redundant. A mortgage lead program can be fully TCPA-compliant and still violate RESPA by paying a per-lead fee that functions as a referral kickback. It can have flawless consent and still violate Regulation N if the disclosure that captured the consent made a triggering claim about rates or terms without the required additional disclosures. And it can satisfy both and still violate the GLBA if the nonpublic personal information collected at the lead form was shared with downstream buyers without a compliant privacy notice and opt-out.

The practical consequence is that a mortgage consent record has to prove more than that the consumer agreed to be called. It has to prove what the consumer saw, who the named seller was, that the disclosure satisfied the advertising rule, and that the data-sharing was permissible — all reconstructable from a single consent event years later.

The baseline that governs every mortgage lead-funded outreach campaign is the TCPA, codified at 47 U.S.C. § 227, and the FCC’s implementing regulations at 47 C.F.R. § 64.1200.

For autodialed or prerecorded telemarketing calls or texts to a mobile number — the channel virtually every modern mortgage program uses — the operative requirement is prior express written consent under 47 C.F.R. § 64.1200(a)(2) and the four-element definition at § 64.1200(f)(9). The consumer’s agreement must:

Be in writing, including electronic forms recognized under the E-SIGN Act at 15 U.S.C. § 7001.
Bear the signature of the consumer.
Include a clear and conspicuous disclosure authorizing the named seller to deliver autodialed or prerecorded telemarketing calls or texts to the number provided.
Make clear that consent is not a condition of purchasing any property, goods, or services.

The FCC’s December 2023 Lead Generators Order tightened the seller-identification element. Prior express written consent must now be given to one seller at a time. The named seller must be identified within the disclosure, and the goods or services offered must be specifically described. Generic “lending partners,” “mortgage marketing partners,” or “trusted advertisers” language no longer satisfies the rule. The 2025 reconsideration proceedings adjusted some implementation timelines but preserved the seller-specific structure as the central reform.

For mortgage programs, the seller-specific rule collided directly with rate-shopping economics. A comparison-rate form historically authorized contact from a long list of “participating lenders” — precisely the structure the order now rejects. The disclosure must name the specific lender or broker the consumer is consenting to be contacted by, and that consent does not extend to other lenders downstream.

The internal do-not-call obligations at 47 C.F.R. § 64.1200(d) apply in addition to the consent analysis: a written DNC policy, training, honoring opt-out requests within a reasonable time (interpreted as ten business days at most), and maintaining a five-year suppression record.

Several decisions frame the mortgage industry’s exposure analysis:

Murphy v. DCI Biologicals Orlando, LLC (11th Cir. 2015) is the leading authority on the volunteered-number theory, but courts have consistently held that providing a number to one lender is not consent to be called by another. The seller-specific rule formalizes this for written-consent campaigns.
Van Patten v. Vertical Fitness Group, LLC (9th Cir. 2017) confirmed that consent must be commensurate with the scope of the messaging it authorizes — directly relevant to rate-shopping leads sold across multiple lenders.
Facebook, Inc. v. Duguid (S. Ct. 2021) narrowed the autodialer definition, moving some marginal mortgage programs into the prerecorded-voice or texting analysis, but did not change the prior-express-written-consent requirement for any campaign meeting the autodialer or prerecorded definitions.
Bradford v. Sovereign Pest Control of Texas, Inc. and a line of district court decisions applying the consent-scope analysis confirm that consent does not survive a substitution of seller — the recurring fact pattern when a comparison-rate lead reaches a lender never named in the disclosure.

The proof burden in TCPA litigation rests on the caller, regardless of where consent was collected. It does not shift through contractual indemnity, and it does not pass to the publisher under the FCC’s framework.

The CFPB Layer: RESPA, Regulation N, and GLBA

What separates mortgage from every other lead vertical is the Consumer Financial Protection Bureau’s authority over the underlying transaction. Three bodies of law apply to the lead event itself.

RESPA Section 8 and the Referral-Fee Problem

The Real Estate Settlement Procedures Act, at 12 U.S.C. § 2607, prohibits giving or accepting “any fee, kickback, or thing of value” in exchange for the referral of business involving a federally related mortgage loan. Its implementing rule, Regulation X at 12 C.F.R. § 1024.14, governs how lead arrangements may be structured.

This is where mortgage lead buying diverges sharply from other verticals. In insurance or solar, a per-lead fee is simply a media cost. In mortgage, a payment that is tied to or contingent on the referral of settlement-service business can be recharacterized as an unlawful kickback under Section 8. The CFPB and courts have scrutinized lead arrangements where payment functions as compensation for steering a consumer to a particular lender rather than as payment for a bona fide marketing service of commensurate value.

The operative distinctions in the case law and CFPB guidance are familiar to mortgage compliance teams:

Payment for bona fide advertising or marketing services, priced at fair market value and not contingent on referrals or closed loans, is generally permissible.
Payment that varies with the volume or value of referrals, or that is structured to compensate for the act of steering a consumer, raises Section 8 exposure.
Arrangements decided in PHH Corp. v. CFPB and addressed in long-running CFPB guidance turn on whether the payment is for a service actually rendered at market value, not for the referral itself.

A mortgage lead consent record that does not also reflect a defensible RESPA posture — fixed-fee or fair-market media pricing, services actually rendered, no contingency on closed loans — leaves the buyer exposed on an axis that does not exist in non-settlement-service verticals.

Regulation N: The Mortgage Advertising Rule

The Mortgage Acts and Practices–Advertising Rule, Regulation N at 12 C.F.R. Part 1014, governs the content of mortgage advertising — including the lead form and disclosure the consumer sees at the consent event.

Regulation N prohibits material misrepresentations in any commercial communication regarding a mortgage credit product. It reaches representations about interest rates, the existence or amount of fees, the consumer’s ability or likelihood to obtain a refinance or modification, government affiliation, and a long list of other triggering claims. When a comparison-rate form advertises a specific rate or payment to capture the lead, the advertising-rule constraints attach to that representation.

The practical intersection with consent is direct: the same rendered disclosure that establishes TCPA consent is also the commercial communication that Regulation N governs. A lead form that captures a flawless prior-express-written-consent record but advertises a teaser rate without the required substantiation has satisfied one regulator and breached another — in the same artifact.

The Gramm-Leach-Bliley Act, at 15 U.S.C. § 6801 et seq., and its implementing Regulation P at 12 C.F.R. Part 1016, govern how financial institutions — including mortgage lenders and brokers — collect and share nonpublic personal information.

A mortgage lead form collects exactly the data GLBA protects: name, contact information, and frequently loan amount, property value, credit-quality indicators, and income range. When that lead is sold or shared downstream, the GLBA privacy-notice and opt-out framework applies to the disclosure of that nonpublic personal information to nonaffiliated third parties.

The intersection with consent is that the moment of lead capture is simultaneously a TCPA consent event, a Regulation N communication, and a GLBA collection-and-sharing event. A defensible mortgage consent record reflects all three: the consumer authorized the contact, saw a compliant advertisement, and received a privacy notice covering the data sharing the lead transaction depends on.

State Mini-TCPAs and Mortgage Litigation

State statutes generate a parallel docket of mortgage lead litigation on top of the federal framework.

Florida’s Telephone Solicitation Act (Fla. Stat. § 501.059) requires prior express written consent for telephonic sales calls placed with automated systems, including texts, with a private right of action and statutory damages of $500 per violation. Florida remains one of the most active forums for mortgage lead litigation.
Washington’s Commercial Electronic Mail Act (RCW 19.190) reaches text messages and has been applied to mortgage SMS campaigns lacking state-specific consent capture.
Oklahoma’s Telephone Solicitation Act (Okla. Stat. tit. 15, § 775C.1 et seq.) substantially mirrors the Florida statute and has produced a comparable docket.
Maryland’s Telephone Consumer Protection Act (Md. Code, Com. Law § 14-3201 et seq.) and New York’s General Business Law § 399-p add jurisdiction-specific obligations on consent format, calling hours, and disclosure language.

A national mortgage lead program therefore cannot run a single consent form. The disclosure language, the named seller, and the affirmative action must be served conditionally based on the consumer’s state of residence, and the record must preserve evidence of which version was served and accepted.

How the Liability Cascade Works in Mortgage

A typical mortgage lead funnel shows how compliance gaps surface in litigation:

A borrower submits a comparison-rate or refinance form on an affiliate publisher’s site after clicking through from a search ad or social campaign — frequently submitting the same number to two or three comparison sites within the same shopping session.
The publisher transmits the lead through a routing platform to an aggregator buyer.
The aggregator distributes the lead to one or more lenders or brokers, sometimes selling the same lead to several buyers as shared or exclusive.
The lender or broker assigns the lead to a loan officer or to a contracted call center.
The call center places an autodialed call or sends an autodialed text within minutes of receipt — often colliding with the same borrower’s near-simultaneous submissions to competing lenders.

If the borrower files a TCPA claim, the defendant is the lender or broker that placed the call — not the publisher, not the aggregator, not the affiliate. That defendant bears the proof burden under the FCC’s rules. The publisher’s confirmation that consent was collected is not the record the defendant needs; the defendant needs the rendered disclosure, the affirmative consumer action, and the chain of custody from the consent event to the dialed number — and, in mortgage, evidence that the RESPA and advertising-rule constraints were satisfied at the same moment.

Mortgage defendants have lost cases on each of the following recurring fact patterns:

The publisher’s lead form authorized contact from a generic list of “lending partners” and did not name the lender as the seller.
The disclosure shown to the consumer differed from the template produced in discovery — common where comparison-rate forms are A/B tested and version history is not preserved.
The seller-identification list at the moment of consent did not include the lender whose loan officer eventually called.
The same number had competing consent records from simultaneous rate-shopping submissions, and the defendant could not establish that its consent record corresponded to the call it placed.
The consent record was a database row with a timestamp but no corresponding rendered-form artifact.
The number eventually dialed was an appended household number that did not match the number provided at the consent event.

The pattern is consistent: mortgage defendants who can reconstruct the borrower’s experience at the moment of consent prevail; those who cannot, do not.

Practical Checklist for Mortgage Lead Buyers

Lenders and brokers purchasing mortgage leads should treat procurement as a regulated activity spanning both the FCC and CFPB regimes.

Require seller-specific consent. Contracts should require that the lender or broker be named in the disclosure the consumer saw. Generic “lending partners” language fails the rule and produces uniformly bad outcomes.
Require the rendered disclosure, not the template. For every lead, obtain an artifact of the exact disclosure the consumer saw — not a stored template or a description of the form.
Confirm the disclosure satisfies Regulation N. The advertisement that captured the lead is a regulated commercial communication. Rate, payment, and government-affiliation claims trigger substantiation and disclosure obligations that must be satisfied in the same artifact that establishes consent.
Structure payment to survive RESPA Section 8. Lead fees should be bona fide media or marketing costs at fair market value, not contingent on closed loans or structured as compensation for referrals. Document the services actually rendered.
Verify the GLBA data-sharing posture. Confirm the lead form delivered a compliant privacy notice and that the nonpublic personal information you receive was lawfully shared.
Disambiguate the rate-shopping number. Require session-level metadata that ties your consent record to the specific submission, so a competing lender’s near-simultaneous record cannot be confused with yours.
Verify the chain of custody to the dialed number. The number routed to the dialer should be the number captured at the consent event. Enrichment and household-append services break the chain and have cost defendants summary judgment.
Require state-by-state attestations. Florida, Washington, Oklahoma, Maryland, and New York consumers should be flagged at delivery with the state-specific consent format reflected in the record.
Audit publishers periodically. Test forms, verify disclosures match contracts, and sample-record consent events against delivered leads. The contractual right to audit is not enough; the inspection has to happen.

Practical Checklist for Mortgage Lead Publishers

Publishers serving the mortgage vertical have to engineer forms and records to satisfy both regulators and the most stringent lender in their distribution chain.

Treat seller identification as a structural form requirement. The disclosure must name the specific lender or broker the consumer is consenting to hear from. Pre-2024 participating-lender patterns no longer survive.
Build the form to satisfy Regulation N. Any rate, payment, fee, or government-affiliation claim used to capture the lead must carry the substantiation and disclosures the advertising rule requires. The lead form is an advertisement, not just a consent capture.
Deliver a GLBA-compliant privacy notice at collection. The form collects nonpublic personal information; the privacy notice and opt-out framework attach at the point of capture and downstream sharing.
Capture the rendered form, not the template. Comparison-rate forms change and A/B test constantly. The record needs to reflect what the specific consumer saw at the specific moment of consent, retrievable on demand.
Tie the consent to the phone number and the session. Bind the affirmative consumer action to the number provided and to a session identifier that survives the rate-shopping collision problem.
Build state-conditional disclosures. Florida, Oklahoma, Washington, Maryland, and New York consumers should receive the state-specific disclosure language and consent format at render time.
Document the revocation channel. An accessible opt-out is required, and revocation must be honored across the entire downstream distribution within the FCC’s rule windows.
Retain records for the longest applicable window. TCPA: at least four years; RESPA, GLBA, and state mini-TCPA windows vary; default to five years for any record touching a mortgage lead.

Common Failure Modes in Mortgage Lead Compliance

The same handful of fact patterns recur across mortgage dockets and CFPB matters:

Disclosure drift. The form produced in discovery does not match what the consumer saw. Without version history and a rendered-form artifact tied to the specific consent event, the defendant cannot establish that the consumer saw the required language — under either the TCPA or Regulation N.
Affiliate consent. The consumer agreed to be called by “lending partners” but not specifically by the lender whose loan officer called. Post-2023 order, this is the single most common point of failure in nationwide mortgage programs.
Rate-shopping collision. The same number carries competing consent records from simultaneous submissions to multiple lenders. The defendant cannot prove its record, not the competitor’s, authorized the call it placed.
Referral-fee recharacterization. A per-lead arrangement is recharacterized as compensation for referrals under RESPA Section 8 because the payment was contingent on closed loans or not tied to a bona fide service of commensurate value.
Triggering-claim advertising. The lead form advertised a rate or payment to capture the consent without the substantiation Regulation N requires, breaching the advertising rule in the same artifact that established consent.
Number substitution. Enrichment or household-append services replaced the consumer’s original number, breaking the chain of custody to the dialed number.
Bare database records. The defendant produces a CRM row with a consent timestamp but cannot produce the form, the disclosure, or the affirmative action. The record fails the proof burden because the event cannot be reconstructed.

Each of these is preventable at the point of consent capture, not at the point of litigation.

Key Takeaways

Mortgage is one of the few lead verticals governed by two federal regulators at once. The FCC’s TCPA framework governs whether the call may be placed; the CFPB’s RESPA, Regulation N, and GLBA rules govern the transaction the call is trying to start. A program can satisfy one and breach the other in the same consent artifact.
The federal TCPA floor — 47 U.S.C. § 227 and 47 C.F.R. § 64.1200 — applies to every autodialed or prerecorded mortgage campaign, and the 2023 Lead Generators Order made seller-specific consent structural. Generic participating-lender disclosures no longer satisfy the rule.
RESPA Section 8 makes mortgage lead payment a regulated arrangement, not a routine media cost. Fees contingent on referrals or closed loans, or untethered to a bona fide service at fair market value, raise kickback exposure that does not exist in non-settlement-service verticals.
Regulation N governs the lead form as a commercial communication, and GLBA governs the data the form collects and shares. Both attach at the same moment as the TCPA consent event. A defensible record reflects all three.
Rate-shopping is the structural driver of mortgage TCPA exposure. The same number routinely carries competing consent records from simultaneous submissions; the defensible record is the one that ties a specific rendered disclosure, affirmative action, immutable timestamp, named seller, and session to the number actually dialed.

Mortgage lead compliance is the recordkeeping problem common to every regulated vertical, compounded by a second regulator and a borrower population that shops several lenders at once. The rules across the FCC and CFPB regimes are stable enough; what changes case to case is whether the defendant can reproduce, years after the fact, what the borrower saw and agreed to at the moment of consent, and whether that same artifact satisfied the advertising and data-sharing rules that attached to it.

If you are evaluating a mortgage lead program — as a lender, a broker, an aggregator, or a publisher serving any of them — the practical question is whether the record you would produce in discovery would let an independent third party reconstruct the borrower’s consent experience and confirm that the RESPA, advertising, and privacy constraints were satisfied at the same moment. If it would not, the program is exposed regardless of which contract terms or compliance attestations sit upstream of it.