Overview

• President Donald Trump signed the bipartisan Homebuyers Privacy Protection Act on Sept. 5, restricting the sale of credit‑pull–based trigger leads to narrow, permissioned exceptions.
• The law takes effect on March 5, 2026, creating a transition period that lenders and lead platforms say will recalibrate sourcing and outreach tactics.
• Credit data can still be shared only for firm offers or when the requester has consumer consent, is the original originator, is the current servicer, or has an existing banking relationship.
• Executives expect higher servicing retention and a modest lift to mortgage servicing rights valuations, though Rocket Cos. cautions that any valuation impact may be marginal and proven over time.
• Lead aggregators that rely on permission-based models, including LendingTree, foresee improved lead quality and pricing, while open questions persist about enforcement and the rise of alternative data-driven prospecting.