If you buy leads to fill your showroom, you have probably heard talk of a trigger leads ban and wondered whether your lead flow is about to dry up. Here is the straight answer. In 2025, Congress passed the Homebuyers Privacy Protection Act, and it restricts how credit bureaus can sell trigger leads. But the law was written for the mortgage business, not for auto retail. That distinction matters, and getting it wrong could cost you either way. This guide walks through what actually changed, when it takes effect, what it covers for car dealers, and why the direction things are moving should shape how you build your lead strategy now.
What the Homebuyers Privacy Protection Act Actually Does
The Homebuyers Privacy Protection Act was introduced as H.R. 2808 in the 119th Congress and signed into law on September 5, 2025, as Public Law 119-36. You can read the bill and its status directly on Congress.gov.
The law amends the Fair Credit Reporting Act, the federal statute that governs how consumer credit information gets bought and sold. Under the amendment, a consumer reporting agency can no longer sell a mortgage trigger lead to a third party unless that party already has a defined relationship with the consumer. As the law firm Hunton Andrews Kurth summarized in its analysis, permitted recipients are essentially the lender that originated the consumer’s current mortgage, the current servicer, or a bank or credit union that already holds an account for that person. Everyone else is shut out unless the consumer opts in.
In plain terms: the moment someone applies for a home loan, the bureaus can no longer resell that application signal to a crowd of competing lenders who have no prior relationship with the borrower.
The timeline you need to know
The signing date was September 5, 2025. The operative restrictions do not take effect immediately. They kick in 180 days after enactment, which lands on or around March 4, 2026. Several trade and compliance sources cite early March 2026 as the compliance deadline. So for most of the industry, the practical start date is spring 2026.
Why This Is a Mortgage Law, Not an Auto Law
This is the part dealers keep getting wrong, so read it carefully. The Homebuyers Privacy Protection Act was drafted and negotiated by the mortgage industry to solve a mortgage problem: homebuyers getting buried in calls and texts the day they apply for a loan. The statutory language is tied to residential mortgage inquiries.
It does not cover auto loans. It does not cover credit cards or personal loans. Multiple legal analyses confirm the scope is limited to mortgage transactions. If a shopper has their credit pulled at a dealership or by an auto lender, the new mortgage restrictions do not reach that inquiry.
So if you are buying auto trigger leads today, this particular law does not outlaw them. That is the honest answer, and anyone telling you the trigger leads ban wiped out auto lead buying overnight is overstating it.
What FCRA still requires for any trigger lead
Here is the catch that predates this new law and still applies to you. The Fair Credit Reporting Act has always required that a prescreened solicitation, which is what a trigger lead is, come with a firm offer of credit. You cannot legally buy a list of credit-triggered names and hit them with generic marketing. The recipient has to extend a genuine, firm offer of credit to the consumer, and the consumer keeps the right to opt out of prescreened offers.
That requirement did not go away. If your current lead process leans on trigger data without a firm offer behind it, you already have a compliance exposure that has nothing to do with the 2026 changes.
Why the Direction of Travel Should Worry Lead Buyers
Just because auto is not covered today does not mean it stays that way. Look at where the momentum is pointing.
- The precedent is set. Congress has now decided, on a bipartisan basis, that selling a consumer’s credit-application signal to strangers is a privacy problem worth legislating. That reasoning is not unique to mortgages.
- Auto is the obvious next target. Industry commentators have already floated auto and credit card trigger leads as the next area regulators or lawmakers could address.
- Consumer sentiment is not on your side. The whole reason this law passed is that people hate the wall of calls that follows a credit inquiry. That frustration does not stop at the mortgage.
If your lead engine depends on hard-inquiry trigger leads, you are building on ground that regulators are actively reshaping. Even if the law never touches auto, the reputational cost of cold-calling someone who just got their credit pulled somewhere else is real, and buyers are getting savvier about where those calls come from.
Why a Soft-Pull Foundation Is More Durable
This is where the distinction between hard-inquiry trigger leads and soft pull triggers actually matters for your business. They are not the same thing, and the difference is the whole point.
Traditional trigger leads fire off a hard credit inquiry, sold to whoever pays, with no relationship to the consumer. Soft pull triggers work differently. A soft credit pull does not ding the consumer’s score, does not require the same hard-inquiry mechanics, and is built around consumers who are actually in-market. We cover the full breakdown in our guide on soft pull triggers versus trigger leads, but the short version is this: one model markets to people at their most exposed moment, and the other identifies genuine buying signals from a compliant, permission-based foundation.
A soft-pull approach is more durable for a simple reason. It does not depend on the one practice that lawmakers just decided to restrict. When you build lead flow on soft credit activity and your own database rather than on resold hard inquiries, you are not exposed to the next version of this bill. You are running a system designed to hold up regardless of which way the regulatory wind blows.
That is the case for treating soft pull triggers as a new category rather than a variation on the old one. Learn how the model works on our Soft Pull Triggers page, or see the bigger picture on our homepage.
A Note on Legal Advice
This article is general information for dealers trying to understand a changing landscape. It is not legal advice, and it is not a compliance opinion for your specific operation. FCRA obligations, state privacy laws, and the exact reach of the Homebuyers Privacy Protection Act can turn on facts we do not know about your business. Before you change how you buy, use, or store credit-triggered leads, run your process past a qualified compliance attorney who knows FCRA and your state’s rules.
Frequently Asked Questions
Does the trigger leads ban apply to auto dealers?
Not directly. The Homebuyers Privacy Protection Act restricts mortgage trigger leads under the Fair Credit Reporting Act. Auto loans, credit cards, and personal loans are outside its scope. That said, standard FCRA rules, including the firm-offer-of-credit requirement, still apply to any prescreened or trigger-based auto solicitation.
When does the Homebuyers Privacy Protection Act take effect?
It was signed into law on September 5, 2025. The core restrictions take effect roughly 180 days later, on or around March 4, 2026. Compliance sources point to early March 2026 as the deadline mortgage lenders and bureaus are working toward.
Are auto trigger leads still legal?
As of now, yes, provided you follow existing FCRA requirements, including making a firm offer of credit and honoring opt-outs. The new mortgage-specific law does not outlaw auto trigger leads. But the legislative direction suggests auto could face similar scrutiny, so it is worth planning ahead.
What is the difference between soft pull triggers and trigger leads?
Trigger leads come from hard credit inquiries resold to third parties. Soft pull triggers use a soft credit pull that does not affect the consumer’s score and are built around real in-market buying signals rather than resold application data. See our full comparison in the soft pull triggers versus trigger leads guide.
Build on Ground That Holds
The trigger leads ban is a mortgage law today, but it is a clear signal about where privacy regulation is heading. Dealers who anchor their lead strategy to resold hard inquiries are betting that the rules stay frozen. Dealers who build on a soft-pull foundation are not making that bet. If you want exclusive, real-time leads pulled from genuine soft credit activity, with one dealer per market and automated mailers doing the follow-up, take a look at Soft Pull Triggers and see how a durable lead engine is supposed to work.