No. Mortgage trigger leads are still legal, but since early March 2026 a credit bureau may sell one only to the lender that made or services the borrower’s current mortgage, a bank or credit union where the borrower has a current account, or a buyer that certifies it has the borrower’s authorization. That is the Homebuyers Privacy Protection Act, Public Law 119-36. The GAO’s report of 6 October 2026 estimates that before it, at most 3.5% of homebuyers may have got their loan through an offer based on a trigger lead. I read every source quoted here on 19 October 2026.
When I searched the question, Google’s AI Overview began: “Yes, mortgage trigger leads are largely illegal under federal law.” That reading would send a loan officer looking for a new list. The law is narrower. It closed the bureau to strangers, left it open to whoever already holds the borrower, and says nothing about how anyone may call.
The law did not end the trigger lead. It handed it to the lender who already has the borrower.
Key numbers
| Item | Number |
|---|---|
| Homebuyers Privacy Protection Act (signed 5 September 2025) | Public Law 119-36 |
| Restrictions in force from (180 days after signing) | Early March 2026 |
| Kinds of buyer a bureau may still sell a trigger lead to (originator, servicer, bank or credit union, authorized buyer) | 4 |
| Homebuyers who applied to more than one lender (2022 to 2024 survey) | About 30.3% |
| Homebuyers who also picked a lender that reached out first (at most 3.5%) | About 3.0% |
| Homebuyers who seriously considered only one lender | 45.0% |
| Messages after a mortgage application (100 or more in some cases) | 30 or more |
| CFPB complaints the GAO linked to trigger leads | More than 100 |
| States with trigger-lead rules of their own (the ones described require disclosures) | 13 |
| TCPA damages per unlawful call (up to $1,500 if willful) | $500 |
| Time to honor a STOP reply (at most) | 10 business days |
| Do Not Call exemption for an existing customer (after a transaction; 3 months after an inquiry) | 18 months |
Read on 19 October 2026 from Public Law 119-36 on congress.gov, 15 U.S.C. 1681b, the GAO’s report GAO-27-108874 of 6 October 2026, 47 CFR 64.1200 on eCFR, 47 U.S.C. 227 and the FCC’s ruling of 8 February 2024.
What the Homebuyers Privacy Protection Act says
Public Law 119-36 was signed on 5 September 2025 and took effect 180 days later, in early March 2026. It adds paragraph (4) to section 604(c) of the Fair Credit Reporting Act, 15 U.S.C. 1681b(c). When a lender pulls a borrower’s credit report for a residential mortgage loan, the bureau may not, “based in whole or in part on that request”, furnish a prescreened report to anyone else unless two things are true.
First, the transaction is a firm offer of credit or insurance, which the GAO describes as a loan offer the creditor must honor if the borrower meets the criteria used to select them. Second, the buyer is one of four: the originator of the borrower’s current mortgage, its servicer, an insured bank or credit union holding a current account for the borrower, or a buyer that has certified to the bureau that it has the borrower’s authorization.
Two states tried to ban triggers outright and lost: federal courts blocked Minnesota’s and New Jersey’s laws as preempted by the FCRA. The GAO counted 13 states with trigger-lead rules of their own, and the ones it describes require disclosures, not bans. Arkansas makes a loan officer say in the first contact how they got the borrower’s contact and application information; Georgia makes a trigger buyer say in the first solicitation that it is not affiliated with the lender or broker the borrower applied to.
What the GAO found trigger leads were worth
GAO-27-108874 is the study the Act ordered. In the National Survey of Mortgage Originations for 2022 to 2024, about 30.3% of homebuyers applied to more than one lender, and about 3.0% also chose a lender that made the first contact: the two things a trigger-lead offer needs to work. The top of the GAO’s confidence range on that second number is the 3.5% it leads with. And 45.0% seriously considered only one lender. Per 1,000 homebuyers: about 450 considered only one lender, 303 applied to two or more, and 30 also picked one that reached out first, 35 at most.
The cost to borrowers was volume. The GAO cites the CFPB putting the messages after a mortgage application at 30 or more, and a lender at 100 or more in some cases; industry groups told it a large number could arrive within hours. Among the more than 100 CFPB complaints it linked to trigger leads is a borrower who replied STOP to a text and then received another text and 54 calls.
Trigger leads are now a retention tool
Industry participants told the GAO that since the Act, some lenders and brokers send lists of their current customers to the bureaus and pay to be alerted when one applies for a new mortgage. That is the Act’s relationship exception, used as written. The same survey shows homebuyers rating lender reputation and an existing banking relationship as important in choosing a lender, which the GAO reads as a sign they may answer offers from lenders they already know.
So the trigger did not disappear. It lost its strangers. If a borrower on your book applies elsewhere, you can be alerted and make a counteroffer; a lender with no relationship and no authorization cannot buy that alert.
Buy another list, load the dialer and let the AI voice work it.
The bureau is closed to buyers with no relationship or authorization, and an AI sales call needs written consent for each number.
Watch your own borrowers and let the AI call only the ones who gave written consent.
Industry participants told the GAO that lenders already pay bureaus to alert them when a customer applies elsewhere.
Why a trigger lead is not permission to call
The Act decides who may buy the report. The Telephone Consumer Protection Act decides how you may call, and being the borrower’s servicer does not exempt an AI sales call from its consent rule.
On 8 February 2024 the FCC ruled unanimously that calls made with AI-generated voices are “artificial” under the TCPA. Under 47 CFR 64.1200(a)(2) and (a)(3), a telemarketing call with an artificial voice to a mobile or home line needs prior express written consent: a signed agreement, electronic signatures included, that authorizes your company to call that number with an artificial voice and says signing is not a condition of buying anything. A refinance or rate offer to your own borrower is telemarketing. Your relationship still exempts the call from the Do Not Call Registry for 18 months after a transaction or three months after an inquiry, but it does not replace that consent, which is why AI calls to past customers need it first. A call that breaks those rules can cost $500 in statutory damages, up to $1,500 if willful or knowing, under 47 U.S.C. 227(b)(3).
What I would build instead
I have built inbound and outbound calling for more than 200 businesses. For a lender, the AI belongs on leads where you hold the consent. Four moves:
Turn on the retention alert for your own book
If you originate or service mortgages, or hold deposit accounts, ask your bureaus about alerts on your current customers. It must still be a firm offer, so set the credit criteria before the first alert arrives.
Collect written consent where the borrower already says yes
Put a prior express written consent line, with the disclosure the rule requires, on your application, rate-quote and servicing forms, naming your company and the number. The alert says when to call; only the consent decides whether an AI voice may.
Write the first message for the strictest state you call
Say how you got the borrower’s information and, when you are not the lender they applied to, that you are not affiliated with it. Those are the Arkansas and Georgia rules in the GAO’s list.
Make STOP end everything
A STOP reply revokes consent, and the FCC’s rule as it reads today gives you at most ten business days to honor it. The 54-call complaint is now in a federal report.
The first call I would automate is to the borrower who just asked you for a rate: they came to you, and the consent can sit on the form they filled in. That is the AI speed-to-lead for mortgage lenders we build, with the consent, DNC and opt-out layer underneath. If you would rather run a platform yourself, compare six AI voice agent platforms on all-in cost first. What the agent may say once the borrower answers is a separate line: it can call your mortgage leads but cannot quote them.
The bottom line
The Act shut the bureau to strangers and left the borrower’s lender, servicer and bank holding the alert. By the GAO’s estimate, trigger-lead offers may have won at most 3.5% of homebuyers before it. If you have a book, the trigger is now a retention tool, and the call that follows still needs written consent before an AI voice makes it. I am not a lawyer, and this is not legal advice.