On September 5, 2025, President Trump signed into law H.R. 2808, the Homebuyers Privacy Protection Act (Act). The Act amends section 604(c) of the Fair Credit Reporting Act (15 U.S.C. § 1681b(c)) “to prevent consumer reporting agencies from furnishing consumer reports under certain circumstances.”
The Act applies to “trigger leads” in connection with a credit transaction involving a residential mortgage loan. “Trigger leads” are generated when a consumer applies for a residential mortgage loan, for example, and consumer reporting agencies then sell that consumer’s information (credit report) to any number of lenders, enabling them to solicit the consumer for loans. This practice has historically led to a flood of unsolicited offers, raising privacy concerns.
The Act prohibits credit reporting agencies from furnishing trigger leads. Consumer reporting agencies may still provide consumer credit reports for transactions related to residential mortgage loans when the request comes from a credit union, insured depository institution, residential mortgage loan lender, or servicer that holds current accounts or loans with said consumer.
It is important to note that there is a private right of action for violations of 15 U.S.C. § 1681b. There is nothing in the text of the Act that appears to change that right. When addressing violations of section 1681b, some courts have held that this is not a strict liability statute. That means that in order to recover, a consumer plaintiff must prove that the credit reporting agency acted willfully and/or negligently per sections 1681n and 1681o of the FCRA.
Courts also routinely find that when there is a bare procedural violation and the consumer plaintiff cannot demonstrate an injury in fact, they cannot establish Article III standing to bring an FCRA claim. However, because the Act is grounded in providing additional privacy rights for consumers, it is possible that courts may interpret allegations of an invasion of privacy to be sufficient to confer Article III standing. See Persinger v. Sw. Credit Sys., L.P., 20 F.4th 1184, 1193 (7th Cir. 2021) (invasion of privacy “is a concrete injury because it is analogous to the common law tort of intrusion upon seclusion.”).
The Act goes into effect on March 5, 2026.
