Do I Still Need to Opt Out After the New Law? The Homebuyers Privacy Protection Act took effect March 5, 2026.
What has changed, what has not, and exactly what to do to protect yourself right now.
📅 March 10, 2026⏱ 8 min read🏷 HPPA · Trigger Leads · OptOutPrescreen
Short Answer
Yes. Opting out still matters. The law dramatically reduced the problem. It did not eliminate it. Significant legal exceptions remain, and this post explains every one of them.
Mar 5 2026: law fully in effect
3 legal exceptions still in force
1 in 6 U.S. mortgages held by Rocket + Mr. Cooper
5 min to opt out at OptOutPrescreen.gov
For years, applying for a mortgage meant bracing for impact. Within hours of a lender pulling your credit, the calls would start. From companies you had never heard of, armed with your name, phone number, and the knowledge that you were actively shopping for a home loan. That practice, known as trigger lead solicitation, is now severely curtailed under federal law. But "severely curtailed" and "eliminated" are not the same thing. Here is what every homebuyer, refinancer, and homeowner needs to understand.
How the Trigger Lead System Worked and Who Benefited From It
To understand what has changed, it helps to understand the architecture of what existed before. When a mortgage lender pulls your credit, the inquiry is recorded by all three major credit reporting agencies: Equifax, Experian, and TransUnion. Under the old rules of the Fair Credit Reporting Act (FCRA), that simple act of applying for a mortgage immediately made your personal financial profile available for purchase by virtually any other lender willing to pay for it. These were called "trigger leads," and the market for them was enormous.
The leads were sold in real time, often within minutes of the inquiry hitting the bureaus. Lenders, insurance companies, lead aggregators, and marketing firms would purchase lists of consumers who had recently applied for mortgages. Those consumers would then receive a flood of unsolicited phone calls, text messages, and mailers, all from companies that knew, with precision, that they were in the market for a home loan. Many buyers, already overwhelmed by the homebuying process, assumed these callers were affiliated with their actual lender. Some were financially harmed by accepting worse loan terms as a result.
⚠️ The Predatory Angle
Beyond the annoyance factor, trigger leads created genuine consumer harm. Lenders who purchased them were often targeting financially stressed borrowers under time pressure, people who might accept a higher rate or unfavorable terms simply because they were overwhelmed and did not know better. Consumer advocates spent nearly a decade fighting to end the practice.
It Was Not Just Lenders. Here Is Who Else Used Trigger Lead Data.
Mortgage lenders were the primary buyers, but they were far from the only ones. Because buying a home triggers a cascade of related financial decisions, trigger lead data was valuable across multiple industries.
Homeowners and title insurance companies were among the most active participants, as anyone buying a home is an immediate, legally required insurance customer. The moment your credit was pulled, insurance agents knew you would need coverage soon.
Auto insurers were also active buyers. A new home purchase frequently correlates with auto policy changes, including a new garage address and updated bundling needs. Insurers purchased trigger leads to get in front of buyers at exactly this moment.
Personal finance and credit card companies leveraged the data on the premise that someone taking on a large mortgage might need updated credit products, balance transfer opportunities, or personal loan products for furnishing and renovations.
Home warranty companies specifically target new buyers, and trigger leads gave them a direct line to those buyers days before closing.
Third-party lead aggregators, perhaps the most opaque players in this ecosystem, would purchase trigger lead data in bulk, repackage it, and resell it multiple times over, meaning a single mortgage application could result in a consumer's information circulating through dozens of companies.
🔴 The Worst-Case Scenario
Because so many unsolicited callers possessed accurate personal information, many buyers could not distinguish legitimate lenders from scammers. Some callers would deliberately impersonate the buyer's actual lender, creating security risks on top of the privacy violation. Consumer complaints to the CFPB about unsolicited mortgage solicitations numbered in the hundreds of thousands annually.
The Homebuyers Privacy Protection Act: What It Actually Does
On September 5, 2025, President Trump signed the Homebuyers Privacy Protection Act (HPPA) into law. The legislation passed with remarkable bipartisan unity, with unanimous approval in both the House Financial Services Committee and the Senate, reflecting how broadly unpopular trigger leads had become across the political spectrum. The law took full effect on March 5, 2026, exactly 180 days after enactment.
The HPPA amends the FCRA to fundamentally invert the default. Where the old system was opt-out by default (your information was shared freely unless you actively stopped it), the new law is opt-in by default. Credit bureaus may not furnish trigger lead data to a third party in connection with a residential mortgage transaction unless one of a narrowly defined set of conditions is met.
✅ What the Law Prohibits: Effective March 5, 2026
Credit reporting agencies may no longer sell or furnish trigger leads to any third party in connection with a residential mortgage inquiry unless the requestor has an existing qualifying relationship with the consumer, or the consumer has explicitly opted in. The cold-call free-for-all from companies with no prior connection to you is now a federal violation subject to CFPB enforcement and civil liability under the FCRA.
"The days of the credit bureaus monetizing a homebuyer's most vulnerable moment are over."
National Association of Mortgage Brokers, March 5, 2026
What Has Not Changed: The Three Exceptions You Need to Understand
Here is where the nuance matters, and why opting out remains relevant even under the new law. The HPPA includes three carve-outs that allow trigger lead data to continue flowing to certain parties. These are not loopholes in the pejorative sense; they reflect a deliberate policy judgment that entities with established consumer relationships have a legitimate basis for outreach. But for buyers and refinancers, the practical effect is that unsolicited contact has not been eliminated entirely. It has been concentrated among parties who may represent a significant portion of the market.
Exception 1: Your Current Mortgage Servicer
If a company is currently servicing your existing mortgage loan (the company that collects your monthly payments) they may still receive a trigger lead when you apply for a new mortgage, and they may still contact you. The rationale is that this constitutes a pre-existing financial relationship. The law does not consider that relationship automatically trustworthy from the consumer's perspective, but Congress drew the line there.
This exception is consequential because mortgage servicing rights are heavily concentrated. Your loan may have originated with one lender and been sold to a servicer you have never directly chosen. That servicer, now legally permitted to contact you, may be a very large company operating at national scale.
Exception 2: The Lender Who Originated Your Current Loan
The company or institution that originated your current residential mortgage also retains the right to receive trigger lead data when you apply for a new loan. Again, the theory is that an existing relationship is present. In practice, however, many consumers have little memory of, or affinity for, their original lender, particularly if that loan was originated years ago. Homeowners may have no idea who their originator was, and yet that entity retains rights to their new mortgage inquiry data.
There is also a structural complexity here specific to the broker channel. When a mortgage was originated through a broker, a common scenario, the HPPA as written generally attributes the originator status to the creditor at the loan's closing, not the broker who counseled the consumer. This has drawn criticism from the broker community, who argue the law inadvertently favors institutional lenders over the independent professionals who often built the actual client relationship.
Exception 3: A Bank or Credit Union Where You Hold an Account
Any insured depository institution or federally chartered credit union where you currently hold a deposit or asset account may also receive your trigger lead data. This exception was lobbied for heavily by banking institutions and reflects the longstanding regulatory preference for depository lenders. For consumers, it means that if you bank with a large financial institution, as most Americans do, that institution can still be notified when you apply for a mortgage with someone else and may use that information to solicit your business.
Who Could Contact You: Before and After the Law
PartyBefore HPPAAfter HPPA (March 5, 2026)Any competing mortgage lender (no prior relationship)Allowed
Could freely purchase your trigger leadProhibited
Banned unless you opt inYour current mortgage servicerAllowedStill Allowed
Explicit exception under HPPAYour original mortgage lenderAllowedStill Allowed
Explicit exception under HPPAYour bank or credit union (existing account)AllowedStill Allowed
Explicit exception under HPPAHomeowners / title insurance companiesAllowed
Active trigger lead buyersRestricted
Only if existing insurance relationshipAuto insurersAllowedRestricted
Unless existing policy relationshipThird-party lead aggregatorsAllowed
Could purchase and resell your dataProhibited
No existing relationship, no accessHome warranty / moving companiesAllowedProhibited
No permissible purpose without consentCredit card / personal loan companiesPartial
Could use general prescreeningPartial
Mortgage-specific trigger restricted; general prescreening rules still apply separately
Why the "Existing Relationship" Exception Carries Real Weight
To appreciate how meaningful the servicer exception is, consider the current landscape of the mortgage servicing market. Mortgage servicing rights, which are the contractual right to collect payments on a loan, are frequently bought and sold independently of the loan itself. Many homeowners have no idea their loan has been transferred to a new servicer, and even those who do may have minimal emotional attachment to that servicer relationship.
The concentration of servicing portfolios in the industry means that a significant share of American homeowners are legally contactable under the HPPA's exceptions. Rocket Mortgage, including its recent acquisition of Mr. Cooper which closed in October 2025, now operates a combined servicing portfolio that covers roughly one in every six mortgages in the United States. This is not a criticism of those companies; in fact, Rocket has earned J.D. Power's top servicer satisfaction ranking, and many brokers and lenders work with them productively every day. The point is purely structural: a large and growing share of homeowners who apply for a new mortgage may find that their existing servicer is still legally notified and permitted to reach out.
Other major servicers, including large banks like Chase and Wells Fargo and the rapidly growing nonbank servicer market, hold similarly large books. For a homeowner with a loan at one of these institutions, the cold call from a stranger problem has been solved by the HPPA, but the call from a familiar yet still unsolicited servicer remains a real possibility.
📊 Market Context
Rocket Mortgage originated approximately 361,000 mortgages totaling $97.6 billion in 2024, giving it a roughly 5.9% share of originations and nearly 17% of the refinance market in recent years. Combined with its Mr. Cooper acquisition, the Rocket Companies' servicing portfolio exceeded $2.1 trillion in unpaid principal balance as of late 2025, covering nearly 10 million homeowners. Any of those homeowners applying for a mortgage elsewhere could still be contacted under the HPPA's servicer exception.
A Note on Enforcement and Why It Is Not Automatic
One thing the HPPA does not do is self-enforce. The law grants the CFPB primary regulatory oversight and preserves the FCRA's existing civil liability framework, meaning consumers harmed by unlawful trigger lead use can pursue private remedies including actual damages, statutory damages, punitive damages for willful violations, and attorney's fees. State attorneys general also retain enforcement authority, and at least ten states, including Texas, Florida, Connecticut, and Utah, had already enacted their own trigger lead restrictions prior to the federal law.
What this means in practice is that deterrence depends on whether institutions believe violations will be caught and prosecuted. For large, publicly traded mortgage companies, the legal and reputational risk is meaningful. For smaller fly-by-night lead vendors and data brokers operating at the margins, enforcement may lag. In the near term, savvy consumers should treat the law as a major improvement, not an absolute guarantee.
The OptOutPrescreen Step-by-Step Guide Still Stands
Even with the HPPA in effect, opting out via OptOutPrescreen.gov remains the single most powerful action you can take to protect your privacy during a mortgage transaction. The opt-out signals your preference directly to the credit bureaus across all categories of prescreened solicitation, including areas the HPPA does not directly govern. For insurance prescreening, credit card prescreening, and other categories of unsolicited firm offers not specifically covered by the law's mortgage provisions, the opt-out continues to function as intended.
Additionally, while the HPPA restricts what credit bureaus may furnish to third parties, it does not prevent those third parties from reaching out through other means if they already possess your information from prior data purchases. Opting out will not retroactively delete your data from companies that already hold it, but it stops the ongoing pipeline.
1
Do This Before Your Credit Is Pulled, Even Under the New Law
The HPPA restricts what the bureaus can sell after the inquiry is made, but your opt-out adds a secondary layer of protection. Getting it done before your lender pulls credit ensures both the federal restriction and your personal opt-out are active simultaneously.
2
Go to the Official Site. Only This Site.
The only legitimate opt-out portal is operated jointly by Equifax, Experian, TransUnion, and Innovis. It is free. It will never ask for payment information.
3
Choose Your Opt-Out Duration
You will see three options. Select "Electronic Opt-Out for 5 Years" for the fastest protection, done entirely online. If you want permanent protection, choose "Permanent Opt-Out by Mail," which requires printing and mailing a signed form, but it does not expire.
optoutprescreen.com
This is exactly what you will see on the site. The "Electronic Opt-Out for 5 years" option is selected. Hit Continue and follow the prompts. The whole process takes under five minutes.
4
Provide Your Identifying Information
You will be asked for your name, address, date of birth, and Social Security Number. This information is submitted directly to the credit bureaus to locate your file and apply the opt-out. You are not interacting with a third party.
5
Allow Up to Five Business Days for Full Effect
The opt-out propagates across all four participating bureaus simultaneously. Do this at least a week before you expect your lender to pull credit. Register your phone number at DoNotCall.gov for an additional layer of protection against unsolicited calls.
What This Means For You Right Now
The Homebuyers Privacy Protection Act is a genuine, meaningful, and long-overdue consumer protection win. The days of your credit inquiry being auctioned off to dozens of strangers the moment you apply for a mortgage are over under federal law. The lead aggregator ecosystem, the cold-calling operations, and the predatory solicitation that left so many buyers confused and vulnerable have been substantially dismantled.
But the law reflects the reality of a market where servicer relationships are widespread, banking relationships are nearly universal, and data sold prior to March 5, 2026 does not disappear on that date. You may still hear from your existing servicer. You may hear from your bank. And in the early days of enforcement, some marginal actors may test whether violations are actually prosecuted.
The smart play remains the same as it was before the law: opt out before your credit is pulled, register on the Do Not Call Registry, and work with a trusted mortgage professional who can tell you exactly what to expect. Five minutes of preparation still buys an enormous amount of peace of mind, and now it is backed by federal law.
Licensed Mortgage Broker · Arizona · NMLS 392202
Ready to Work With Someone Who Actually Explains This Stuff?
I'm Chris Theall, an independent mortgage broker at CT Home Loans. As a broker, I shop multiple lenders to find the right fit for your situation, not just the easiest one. If you are buying, refinancing, or just want to understand your options, text me directly and let's talk.
Text Chris: 602-492-3304I also connect clients with trusted realtors, insurance agents, contractors, and other professionals when the time comes. One text is all it takes.
Disclosure and Notes: This article is for general informational purposes and does not constitute legal or financial advice. The Homebuyers Privacy Protection Act (H.R. 2808) was signed September 5, 2025 and took full effect March 5, 2026. Market share figures are based on 2024 HMDA data. Consumers with FCRA-related complaints may contact the CFPB at consumerfinance.gov or their state attorney general's office. OptOutPrescreen.gov is operated jointly by Equifax, Experian, TransUnion, and Innovis and is always free of charge.