Mortgage privacy rules for credit reports

Summary#

The Homebuyers Privacy Protection Act is an enacted federal law that amends the Fair Credit Reporting Act and requires a Government Accountability Office (GAO) study. Its stated goal is to limit when consumer reporting agencies can share reports after someone applies for a residential mortgage loan. The sharing limits take effect March 4, 2026.

  • A consumer reporting agency may not use a mortgage-related report request to furnish a report to another person under the Fair Credit Reporting Act’s prescreening rules unless the transaction involves a firm offer of credit or insurance and the recipient meets one of the law’s tests.
  • One test is that the recipient has sent the agency documentation certifying that it has the consumer’s authorization.
  • Alternatively, the recipient must have originated or service the consumer’s current residential mortgage loan, or be an insured depository institution or credit union that holds a current account for the consumer.
  • The GAO must study the value of mortgage “trigger leads” received by text message, with input from specified regulators, lenders, financial institutions, consumer reporting agencies, and consumers, and report to Congress within 12 months of enactment.

What it means for you#

  • People applying for a mortgage: A mortgage-related request for your consumer report cannot, by itself, be used under these prescreening rules to furnish your report to another person unless that person meets the law’s conditions. The law does not ban all mortgage marketing or all sharing of consumer reports.
  • Mortgage lenders and other report recipients: To receive a report through this route, a recipient must meet one of the listed authorization or existing-relationship tests. The firm-offer condition also applies.
  • Consumer reporting agencies: They must follow the new limits when furnishing reports under the prescreening rules.
  • The public: The GAO must study the value of text-message trigger leads and report to Congress. The Act does not require the GAO to recommend a particular policy.

Money#

No publicly available information on estimated costs.

  • The law requires the GAO to conduct a study, but does not state its cost or provide a specific funding amount.
  • The law gives no cost estimate for consumer reporting agencies or other affected businesses.

What is unclear#

  • The amendment does not explain how agencies should check or process the recipient’s authorization documentation.
  • It does not define “current” for a mortgage loan or account in this provision.
  • The amendment does not set out application procedures, timelines, appeals, or special enforcement rules for these restrictions.
  • The full Fair Credit Reporting Act was not supplied, so the existing rules that remain in place alongside this amendment could not be checked.
  • The materials do not say whether the GAO submitted its report by the deadline.

Case for#

  • A mortgage report request can lead to reports being furnished to other businesses. Restricting that use could reduce sharing tied to a person’s mortgage shopping.
  • The law allows report sharing when the recipient has the consumer’s authorization or one of the listed existing financial relationships, rather than allowing the mortgage request alone to be the basis.
  • The GAO study could give Congress information about the value of text-message trigger leads.

Case against#

  • The law limits one route for furnishing reports; it does not stop all marketing or report sharing. Its effect on the amount of contact consumers receive is therefore uncertain.
  • The amendment does not spell out how agencies should verify certifications or handle disputes, which could leave important practical details unresolved.
  • The law requires a GAO study but does not provide a cost estimate or specify funding for it.