# Trigger Leads After the Homebuyers Privacy Protection Act: What an AI Outreach Agent Can Buy, Call, and Text in 2026

*September 1, 2026 · 7 min read · Pranay Shetty*

> The Homebuyers Privacy Protection Act amended FCRA 604(c) and took effect March 5, 2026. Here is the eligibility gate an AI outreach agent has to run before it dials a prescreened mortgage lead, the exceptions that still let you contact your own borrowers, and the audit file that proves the lead was legal.

## The Lead Source That Just Became a Liability

A borrower applies for a mortgage. Within hours, their phone starts ringing with offers from lenders they never contacted. That borrower did not consent to any of it. The lender that pulled their credit generated a hard inquiry, the credit bureau sold the fact of that inquiry as a prescreened list, and a dozen competitors bought it. The industry calls these trigger leads, and for two decades they were a legal, if resented, way to buy intent at the exact moment a consumer was shopping.

That model changed on March 5, 2026. If you are running an AI outreach agent against purchased mortgage lists, the eligibility question is no longer "did we scrub against the DNC and honor TCPA consent." It is now "was this lead legal for us to receive at all." Those are different questions, and the second one has to be answered before the first.

## What FCRA 604(c) Always Allowed, and What Changed

Prescreened offers live in [FCRA section 604(c), 15 U.S.C. 1681b(c)](https://www.law.cornell.edu/uscode/text/15/1681b). A consumer reporting agency can furnish a consumer report in connection with a credit transaction the consumer did not initiate, but only if the user of the report makes a firm offer of credit and the consumer has not opted out through the mechanism in [section 615(d), 15 U.S.C. 1681m(d)](https://www.law.cornell.edu/uscode/text/15/1681m) (the 1-888-5-OPTOUT / optoutprescreen.com system). That framework is how trigger leads were legal in the first place: a mortgage inquiry met the bureau's prescreen criteria, the buyer extended a firm offer, and the consumer's failure to opt out was treated as permission.

The [Homebuyers Privacy Protection Act](https://www.congress.gov/bill/119th-congress/senate-bill/1467/text), signed September 5, 2025 and effective after a 180-day implementation window, narrowed 604(c) specifically for mortgage trigger leads. A consumer reporting agency may no longer furnish a trigger lead generated by a residential mortgage inquiry unless the recipient falls into a defined relationship category or the consumer has consented. The statute's own text is the control language every marketing team should read, because it draws the line the AI agent has to enforce.

The categories that still let you receive and act on a mortgage trigger lead reduce to these. You originated the consumer's current residential mortgage loan, meaning the loan already on your books, not the new application they just submitted to someone. You are the servicer of the consumer's current residential mortgage, using the servicer definition in section 6(i) of RESPA. You are an insured depository institution or credit union holding a current account for the consumer. Or the consumer authorized the consumer reporting agency to furnish the report to you, which is the FCRA authorization standard the Act incorporates, not a general marketing opt-in. Everything outside those boxes is now a lead you cannot lawfully buy for solicitation. The statute is [Public Law 119-36](https://www.congress.gov/bill/119th-congress/senate-bill/1467/text), and its exact category language is what your eligibility rule has to track.

## Why This Is an AI Problem, Not a List-Buying Problem

The instinct is to treat this as a procurement change: stop buying trigger lists, done. It is not that simple, because the same institution that cannot buy a stranger's trigger lead can still contact its own borrowers, its own depositors, and consumers who consented. A large bank running an AI outreach agent has a legitimate pipeline (portfolio retention calls to existing mortgage customers, cross-sell to deposit holders, follow-up to consumers who opted in on the bank's own site) sitting right next to a now-illegal pipeline (purchased mortgage triggers). The agent has to tell them apart on every single record before it initiates contact.

We handle this the same way we handle the OFAC screening gate and the TCPA consent gate: as a hard, deterministic eligibility check that runs before the agent is allowed to dial, and that fails closed. A record that cannot prove its lawful basis does not get a "probably fine" pass to the dialer. It gets suppressed and logged.

## The Eligibility Gate the Agent Runs Before It Dials

For every prospective outreach record, the agent has to resolve one question with evidence: what is our lawful basis to contact this consumer about a mortgage. The gate we build evaluates, in order:

- Did we originate the consumer's current residential mortgage loan, the loan already on our books rather than the application they just filed, matched to our servicing or origination system of record? If yes, the originator exception applies.
- Is this consumer a mortgage we currently service, matched on the servicing system of record, not on a purchased file? If yes, the servicer exception applies.
- Does this consumer hold a current deposit or loan account with us, matched against the core, within the account-relationship definition? If yes, that exception applies.
- Did the consumer authorize the consumer reporting agency to furnish this report to us, the FCRA written-authorization standard the Act incorporates, with that authorization stored and retrievable? A general marketing or contact opt-in does not meet this bar. If yes, authorization is the basis.
- None of the above? Suppress. The record does not reach the dialer, and the suppression reason is written to the audit log.

The output of the gate is not a boolean. It is a basis code and a pointer to the evidence for that basis, attached to the record for the life of the campaign. When the examiner or plaintiff's counsel asks why this consumer was contacted, the answer is a record, not a recollection.

## Firm Offer of Credit Still Has Teeth

For the records that remain eligible, 604(c) has not gone away, and its firm-offer-of-credit requirement still governs any prescreened contact. A firm offer has to be honored if the consumer meets the preselection criteria, and it has to carry the [section 615(d)](https://www.law.cornell.edu/uscode/text/15/1681m) opt-out disclosure in the required form. Courts have spent years on what makes an offer "firm" enough to survive, and an offer of "rates as low as" with no actual extension of credit behind it is the kind of thing that draws litigation.

The AI agent's script and the offer behind it are one artifact for compliance purposes. We version the offer terms, the preselection criteria, and the opt-out language together, and the agent reads from the approved version. It does not improvise an offer. If the offer terms change, that is a change-control event with a compliance sign-off, the same as a policy update to a servicing agent.

## The TCPA Layer Sits On Top, Not Instead

Getting the FCRA eligibility right does not make the call legal. It makes the call permissible to attempt under the credit-reporting rules. The consumer's telephone consent under the TCPA is a separate gate, and it runs after the FCRA gate, not instead of it. We covered the TCPA architecture for AI voice outreach in our [2026 field guide on TCPA compliance](/blog/tcpa-ai-voice-mortgage-banking-2026-field-guide), and the core requirements still apply: prior express written consent for autodialed or prerecorded telemarketing to a wireless number, prompt honoring of revocation, the calling-time windows, and the wireless-number treatment. One thing that is not a current federal requirement is the FCC's one-to-one consent rule, which would have forced separate consent for each seller. The Eleventh Circuit vacated it in [Insurance Marketing Coalition v. FCC](https://law.justia.com/cases/federal/appellate-courts/ca11/24-10277/24-10277-2025-01-24.html) in January 2025 and the FCC then removed it, so a per-seller consent policy is now an internal control a lender may choose, not a rule the law imposes. A lead that clears FCRA and fails TCPA does not get dialed. The two gates are additive.

The practical failure we watch for is a team that solves one and forgets the other. Before March 2026, plenty of trigger-lead operations were TCPA-clean and are now FCRA-illegal. The reverse also happens: a portfolio-retention list is FCRA-eligible under the servicer exception but was never scrubbed for revoked consent. The agent has to pass both gates on every record, every time.

## A Failure Mode Worth Naming

The first thing that breaks in a bank of any size is identity matching. The exceptions all depend on correctly recognizing that a lead is your own customer. A purchased or aggregated file that says "John Smith, 123 Main St" is not the same as a confident match to your servicing system, and treating a fuzzy match as an exception is how a bank ends up contacting a stranger under a servicer exception that does not apply to them. We tune the matching threshold conservatively on purpose. A false match here is not a data-quality nuisance, it is contact with a consumer you had no lawful basis to reach. When the match confidence is below threshold, the record is suppressed, not contacted, and the ambiguity is resolved before the next campaign, not during it.

## What the Audit File Has to Contain

When a state attorney general, the CFPB, or a plaintiff's firm asks how a consumer came to be on your outreach list, the file we produce holds:

- The lawful-basis code for every contacted record, with the pointer to the originating application, servicing record, account relationship, or consent artifact
- The suppression log for every record the gate rejected, with the reason
- The firm-offer terms and preselection criteria in effect at contact time, versioned
- The section 615(d) opt-out disclosure as delivered, with the delivery record
- The TCPA consent state at contact time, and the revocation history
- The change log for every offer, script, and eligibility-rule update with the compliance sign-off

A bank that can produce this file has a defensible answer. A bank running purchased mortgage triggers through an AI dialer after March 2026 without a basis code on each record has an enforcement problem waiting for a slow news week. The Government Accountability Office was directed to report to Congress on trigger-lead practices, and the supervisory attention that follows a fresh statute tends to arrive within the first exam cycle.

## What We Tell Lenders Building Retention Outreach

The lawful pipeline is bigger than most teams assume once they stop thinking about purchased leads. Your own servicing portfolio is full of consumers whose rate, term, or life situation makes a refinance or a home-equity conversation genuinely useful to them, and reaching those consumers is squarely inside the servicer exception. An AI outreach agent pointed at your own book, gated on the exceptions above and on TCPA consent, does more revenue than a purchased-trigger operation ever did, because the contact is welcome and the basis is clean. The teams that will feel the new law as a loss are the ones that were renting intent. The teams that will grow are the ones that were already sitting on the relationship.

We built the eligibility gate as a fail-closed control because in regulated finance the cost of one wrongful contact is not the cost of one call. It is the finding, the look-back, and the remediation across the whole campaign. Get the gate right first, and the outreach that remains is both legal and better.

---

_Source: [https://www.seiright.com/blog/trigger-leads-homebuyers-privacy-protection-act-ai-mortgage-outreach](https://www.seiright.com/blog/trigger-leads-homebuyers-privacy-protection-act-ai-mortgage-outreach) · Sei AI_