Homebuyers Privacy Protection Act

Consumers seeking mortgages will face fewer unsolicited offers based on their credit report requests. Sharing is generally limited to businesses with the consumer’s permission or an existing financial relationship.

What the law does ​

• Bars credit reporting agencies from using mortgage credit report requests to share consumer reports unless specified conditions are met.
• Requires resulting offers to be firm offers of credit or insurance.
• Limits eligible recipients to consumer-authorized persons, current mortgage originators or servicers, and banks or credit unions where the consumer has an account.
• Directs the Government Accountability Office to study mortgage sales leads sent by text and report to Congress within 12 months of enactment.
• Takes effect 180 days after its September 5, 2025 enactment.

Who it affects ​

• Consumers applying for or seeking mortgages.
• Credit reporting agencies and businesses that buy mortgage-related leads.
• Mortgage originators, servicers, banks, and credit unions.

Breakdown ​

Homebuyers Privacy Protection Act ​

The Homebuyers Privacy Protection Act limits when credit reporting agencies may share a consumer’s information after a mortgage-related credit report request generates a sales lead. It generally allows sharing only for firm offers of credit or insurance involving a person authorized by the consumer, the consumer’s current mortgage lender or servicer, or a bank or credit union where the consumer has an account. It also requires a federal study of mortgage-related leads sent by text message.

Key takeaways

• Credit reporting agencies generally may not use a mortgage credit report request to provide the consumer’s report to other businesses unless specified conditions are met.
• Any resulting offer must be a firm offer of credit or insurance.
• Eligible recipients are limited to persons authorized by the consumer, the originator or servicer of the consumer’s current mortgage, or a bank or credit union where the consumer has a current account.
• The Government Accountability Office must study the value of mortgage-related sales leads received by text message and report its findings to Congress within 12 months after enactment.
• The law takes effect 180 days after its September 5, 2025 enactment.