TL;DR

  • A mortgage “trigger lead” is a prescreened lead generated the moment a consumer applies for a mortgage. When a lender pulls a borrower’s credit, the credit bureau records a “hard inquiry” — and, historically, could sell the fact of that inquiry to competing lenders who then flood the borrower with offers within hours.
  • The Homebuyers Privacy Protection Act (HPPA) amended the Fair Credit Reporting Act to sharply limit that practice. Effective March 5, 2026, a consumer reporting agency may no longer furnish a trigger lead tied to a residential-mortgage inquiry unless the recipient certifies it has the consumer’s authorization or already holds a defined relationship with that consumer.
  • The HPPA is an FCRA rule about who may receive the lead, layered on top of the TCPA rule about who may call or text it. Clearing one does not clear the other. A trigger lead obtained lawfully under the HPPA still cannot be autodialed or texted without prior express written consent.
  • For buyers, the practical shift is that provenance now has two questions to answer, not one: was this lead furnished lawfully under the FCRA, and is there a consent record that authorizes the contact under the TCPA?
  • The failure mode is a lead that looks clean on price but carries no evidence of either — no authorization certification, no consent record. In 2026, that is not a cheap lead. It is an uninsured liability.

Overview: A Decades-Old Practice, Newly Constrained

For more than twenty years, the mortgage industry ran on a quiet arbitrage. When a borrower applied for a home loan, the lender pulled credit. That credit pull created a hard inquiry at the bureaus, and the bureaus — permitted under the “prescreening” provision of the Fair Credit Reporting Act — could package and sell that inquiry as a trigger lead: a real-time signal that a specific, named consumer was actively shopping for a mortgage right now.

Competing lenders bought those signals in bulk and called immediately. From the borrower’s side, the experience was jarring: apply for one mortgage on Monday morning, field a dozen unsolicited calls and texts by Monday afternoon from lenders they had never contacted. The practice was legal, lucrative, and deeply unpopular — with consumers, with the originating lenders whose applicants were being poached, and eventually with Congress.

The Homebuyers Privacy Protection Act changed the rules. It did not ban trigger leads outright, but it closed the default that made them a free-for-all. As of March 5, 2026, the fact of a mortgage credit inquiry can no longer be sold to just anyone — the recipient has to earn the right to receive it. This guide explains what the HPPA actually says, how it interacts with the TCPA consent regime that governs the contact itself, and what a buyer now has to be able to prove to touch a mortgage lead safely.

What a Trigger Lead Actually Is

A trigger lead is not a form fill. It is not a consumer who visited a rate-comparison site and requested quotes. It is a byproduct of the credit-reporting system.

Here is the mechanism. A consumer applies for a mortgage with Lender A. Lender A requests the consumer’s credit report from a consumer reporting agency — Equifax, Experian, or TransUnion — in connection with that credit transaction. That request is logged as a hard inquiry. Under FCRA § 604(c) (15 U.S.C. § 1681b(c)), consumer reporting agencies have long been permitted to furnish reports for “prescreening” — that is, to identify consumers who meet certain credit criteria so that lenders can make firm offers of credit. The bureaus used that authority to sell the existence of the mortgage inquiry, in near real time, to other lenders. Those lenders — Lenders B through Z — receive a signal that says, in effect, this named consumer just applied for a mortgage.

That is the trigger. The consumer never asked to hear from Lenders B through Z. They never submitted a form to them, never saw a disclosure naming them, and in most cases have no idea their application generated a salable data point at all. The lead exists purely because the credit-pull created it.

This is what makes trigger leads legally distinct from ordinary purchased leads, and it is why they needed their own statute. An ordinary lead at least originates in a consumer action directed at a lead form. A trigger lead originates in the plumbing of the credit system, entirely outside the consumer’s awareness or intent.

What the HPPA Actually Requires

The Homebuyers Privacy Protection Act amends FCRA § 604(c) by adding a new paragraph that governs “prescreening report requests” connected to residential mortgage loans. The operative rule is a default prohibition with narrow exceptions.

The default: if a person requests a consumer report in connection with a credit transaction involving a residential mortgage loan, the consumer reporting agency may not, based on that request, furnish a report about that consumer to another person under the prescreening provision.

The exceptions: the agency may furnish the lead only if the other person either —

  1. Has submitted documentation certifying consumer authorization — that is, the recipient has certified to the bureau that it has, pursuant to FCRA § 604(c)(1)(A), the authorization of the consumer the report relates to; or
  2. Already holds a defined relationship with that consumer — specifically, the recipient (a) originated the consumer’s current residential mortgage loan, (b) services the consumer’s current residential mortgage loan, or (c) is an insured depository institution or credit union that holds a current account for that consumer.

In plain terms: after March 5, 2026, a lender cannot buy a mortgage trigger lead about a stranger. It can receive one only if the borrower authorized it, or if it already has a lending, servicing, or banking relationship with that borrower. The Act defines its key terms — “residential mortgage loan,” “servicer,” “insured depository institution,” “credit union” — by cross-reference to the S.A.F.E. Mortgage Licensing Act, RESPA, the Federal Deposit Insurance Act, and the Federal Credit Union Act, so the categories are precise rather than colloquial.

The effective date is set by the Act itself: the amendment took effect 90 days after enactment, which lands on March 5, 2026. There is no phase-in and no grandfathering of existing trigger-lead arrangements.

The Layer the HPPA Does Not Touch: The TCPA

Here is the point most easily missed. The HPPA governs whether a bureau may furnish the lead. It says nothing about whether you may then call or text the consumer. Those are two separate legal regimes, and satisfying one does not satisfy the other.

Assume a lender clears the HPPA — it certifies consumer authorization and lawfully receives a trigger lead. It now holds a name and a phone number for a consumer actively shopping for a mortgage. Before it dials that number with an autodialer or sends a marketing text, it still has to satisfy the Telephone Consumer Protection Act. Under 47 U.S.C. § 227 and the implementing rules at 47 C.F.R. § 64.1200, calls and texts made with an autodialer or an artificial or prerecorded voice, for marketing purposes, require prior express written consent — a clear and conspicuous disclosure and an unambiguous, affirmative act by the consumer authorizing that contact from that party.

The “authorization” the HPPA requires and the “prior express written consent” the TCPA requires are related in spirit but not interchangeable in proof. A certification to a credit bureau that you hold FCRA authorization is not, by itself, the consent record a TCPA defendant must produce in litigation. The caller still carries the burden of proving TCPA consent as an affirmative defense — and courts have been unforgiving about what that burden actually requires.

In Bradford v. Sovereign Pest Control of Texas, Inc., No. 4:18-cv-00197 (S.D. Tex. 2019), a defendant that could not produce the specific rendered disclosure the plaintiff actually encountered — as opposed to a general form template — lost on summary judgment. In Van Patten v. Vertical Fitness Group, LLC, 847 F.3d 1037 (9th Cir. 2017), the Ninth Circuit held that consent must be commensurate with the communications it is used to justify: consent for one relationship does not authorize unrelated marketing. And in the mortgage context specifically, a trigger-lead call is the hardest kind to defend, because the consumer never directed any action at the caller. The caller’s entire relationship to the consumer began with a data purchase.

Two Supreme Court developments make this exposure sharper, not softer. In Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024), the Court ended reflexive judicial deference to agency interpretations. In McLaughlin Chiropractic Associates, Inc. v. McKesson Corp., 606 U.S. ___ (2025), it held that district courts may interpret the TCPA independently of FCC guidance. Together they mean a caller can no longer point to a single national interpretation as a safe harbor — what satisfies a TCPA consent defense can now vary from one federal district to the next, over a lead the consumer never volunteered.

Where This Leaves Lead Buyers

For anyone buying mortgage leads, the HPPA turns a one-question diligence problem into a two-question one. It is no longer enough to ask whether a lead has consent behind it. Now the questions stack:

Question one — FCRA/HPPA: Was this lead lawfully furnished? If it is a trigger lead, does the seller’s chain show that the recipient certified consumer authorization or held a qualifying relationship? A trigger lead furnished in violation of the amended § 604(c) is defective at the source, regardless of what happens downstream.

Question two — TCPA: Is there a consent record that authorizes this contact by this party? Even a lawfully furnished trigger lead cannot be autodialed or texted for marketing without prior express written consent tied to the specific consumer and number.

A lead that answers neither question — the cheapest kind, sold in bulk with no authorization trail and no consent record — is now the most dangerous kind. It carries FCRA exposure for the furnishing and TCPA exposure for the contact, and in a fragmented post-McLaughlin landscape, it defends poorly in front of any court.

The buyers who come out ahead are the ones who treat provenance as evidence, not attribution. That means insisting on a record that shows, for each lead: the lawful basis on which it was furnished, the disclosure the consumer actually saw, the affirmative action they took, the party they authorized, and an unbroken, authenticatable link from that consent event to the exact number being dialed. When a lead cannot produce that record, the safe assumption is that it does not exist.

A Mortgage Trigger-Lead Compliance Checklist

Use this to pressure-test any mortgage lead-buying program against the post-HPPA landscape.

  • Know whether a lead is a trigger lead. Distinguish credit-inquiry-derived leads from consumer-initiated form fills — they carry different legal baggage and different diligence requirements.
  • For trigger leads, confirm the HPPA basis. The seller’s chain should show the recipient certified consumer authorization or held a qualifying origination, servicing, or depository relationship under the amended FCRA § 604(c).
  • Never treat FCRA authorization as TCPA consent. They are separate proofs. A bureau certification does not substitute for the prior-express-written-consent record a TCPA defense requires.
  • Preserve the rendered disclosure the consumer actually saw — the named party, the scope, the date — not just a form template.
  • Bind consent to the exact number ultimately dialed, and make sure that binding survives normalization, enrichment, and transfer.
  • Log the full intermediary chain so there is no unexplained gap between the credit inquiry, the furnishing, and delivery to the caller.
  • Make records authenticatable — independent timestamps, write-once storage, tamper-evident hashing — so the proof is not merely a self-serving CRM row.
  • Match consent scope to the contact. Under Van Patten, consent for one relationship does not authorize unrelated marketing; a trigger lead the consumer never directed at you is the hardest scope to establish.
  • Retain across the full limitations window plus a buffer — at least four years federally, longer where state mini-TCPA private rights of action apply.
  • Quarantine leads that fail either test. A trigger lead with no HPPA basis or no TCPA consent record is an unconsented lead. Treat it as one.

Key Takeaways

  • A mortgage trigger lead is generated by a credit inquiry, not a consumer form fill. The consumer never directed any action at the buyers who receive it — which is exactly why it needed its own statute and why it is the hardest lead to defend.
  • The Homebuyers Privacy Protection Act amended FCRA § 604(c) effective March 5, 2026, replacing the old sell-to-anyone default with a prohibition: a bureau may furnish a mortgage trigger lead only if the recipient certifies consumer authorization or already holds a defined origination, servicing, or depository relationship.
  • The HPPA governs furnishing; the TCPA governs contact. They are separate regimes. Clearing the FCRA does not clear the TCPA, and a bureau certification is not the consent record a TCPA defense requires.
  • After Loper Bright and McLaughlin v. McKesson, TCPA interpretation is fragmenting across districts. A trigger-lead call — over a lead the consumer never volunteered — defends poorly in that landscape without concrete, portable evidence.
  • Diligence now has two questions: was the lead lawfully furnished, and is there a consent record that authorizes the contact? A lead that answers neither is not a bargain. It is an uninsured liability wearing a low price tag.

Trigger leads raise the stakes on provenance: the lawful basis for furnishing and the consent behind the contact both have to be provable, per lead. See how independent, authenticatable consent records preserve the link between authorization and contact across the mortgage lead supply chain.