Mortgage and lending marketing data sits at the intersection of two powerful federal laws — the Fair Credit Reporting Act (FCRA) and the Gramm-Leach-Bliley Act (GLBA) — that govern how consumer financial information can be collected, shared, and used. Marketers in this space must understand the framework. This article explains, in general educational terms, how these laws shape mortgage-applicant marketing. It is not legal advice.

The two laws that govern this space

Mortgage and lending marketing data is regulated more heavily than ordinary consumer data because it involves sensitive financial information and can touch credit data. The Fair Credit Reporting Act (FCRA) governs the collection, use, and sharing of consumer credit information. It’s central to mortgage marketing because of a specific mechanism: prescreened offers (also called “firm offers of credit”). The FCRA permits using credit-based criteria to identify consumers for prescreened offers of credit or insurance — but only under strict conditions, including that the offer must be a genuine “firm offer” and consumers have the right to opt out of prescreened offers. Using credit data outside these rules is a serious violation. The Gramm-Leach-Bliley Act (GLBA) governs how financial institutions handle consumers’ nonpublic personal information — requiring privacy notices, limiting sharing with non-affiliated third parties, and giving consumers certain opt-out rights. It shapes what financial institutions can do with the data they collect and how it can flow to marketers. Together, these laws mean mortgage-applicant marketing operates in a tightly regulated zone. The use of credit-based data triggers FCRA obligations (especially the firm-offer requirement for prescreened offers), and the handling of financial information triggers GLBA obligations. This is a domain where compliance is mandatory and the rules are technical — squarely requiring legal counsel.

Common questions

What is a mortgage applicant list?

A mortgage applicant list is a dataset containing information about people who have applied for, received, or otherwise shown interest in mortgage credit. Depending on how the list was created, it may contain names, addresses, loan information, application details, credit-related information, or contact information. Because mortgage application data can involve sensitive financial information, buyers should establish the source, legal basis, permitted use, and applicable restrictions before using such a list for marketing.

Does the FCRA apply to mortgage applicant lists?

It can. The Fair Credit Reporting Act regulates consumer reports and their use for specified purposes. If a mortgage applicant list contains information that constitutes a consumer report obtained from a consumer reporting agency, the recipient generally needs a permissible purpose to obtain and use that information. The CFPB emphasizes that FCRA permissible purposes are specific and that consumer reports cannot simply be obtained or used because the information would be commercially useful.

Can mortgage lenders buy a list of consumers who recently applied for a mortgage?

Not simply as an ordinary marketing list. The legal treatment depends on how the list was compiled, what information it contains, who supplied it, and how the recipient intends to use it. If the information constitutes a consumer report, FCRA permissible-purpose requirements become important. Prescreened consumer reports can be used for certain firm offers of credit, but that process carries specific FCRA requirements, including consumer opt-out mechanisms.

What is a prescreened mortgage marketing list?

A prescreened list is generally created using consumer-report information to identify consumers who meet specified criteria for a firm offer of credit or insurance. The FCRA permits certain prescreening activity when the statutory requirements are satisfied. A lender should not assume that purchasing a commercially labeled “prequalified” or “mortgage-ready” list automatically creates a compliant prescreening program. The underlying source, permissible purpose, firm offer, and required notices all matter.

How does GLBA affect mortgage applicant data?

The Gramm-Leach-Bliley Act’s privacy provisions can restrict how financial institutions collect, disclose, and reuse nonpublic personal information (NPI). The FTC specifically identifies applying for a loan as an example of a consumer relationship covered by the Privacy Rule and explains that information supplied on a financial application can constitute NPI. The rules can also restrict the reuse and redisclosure of NPI received from another financial institution.

Can a mortgage company sell applicant information to a third-party marketer?

It depends on the information, the relationship, the disclosure, and applicable exceptions. GLBA generally limits disclosures of NPI to nonaffiliated third parties and can require privacy notices and an opportunity to opt out when an applicable exception does not apply. There are exceptions for certain service providers, joint marketing arrangements, and activities necessary to process or administer financial transactions.

Can a data vendor resell mortgage applicant information?

A vendor should not assume that receiving mortgage applicant information from a financial institution gives it unrestricted rights to resell or reuse the information. GLBA specifically addresses restrictions on the reuse and redisclosure of NPI received from nonaffiliated financial institutions. If the information is also a consumer report, FCRA restrictions can create an additional layer of requirements. Buyers should obtain clear documentation about the source, permitted uses, contractual rights, and applicable compliance obligations before purchasing.

What should mortgage marketers verify before buying an applicant list?

At minimum, verify where the data came from, whether it contains consumer-report information, the vendor’s permissible purpose, whether the list is prescreened, how opt-outs are handled, whether the information is NPI, what GLBA permissions apply, and exactly what marketing uses the license permits. Ask for documentation rather than relying on statements such as “FCRA compliant” or “GLBA compliant.” For mortgage marketing, legal and compliance review is particularly important because multiple federal and state requirements can overlap.

How this applies to your business

If you market mortgage or lending products, build your approach on the FCRA and GLBA framework from the start. The use of credit-based data for prescreened offers triggers the FCRA’s firm-offer and opt-out requirements; the handling of consumers’ financial information triggers GLBA obligations. This is a tightly regulated domain where compliance is structural, not optional — treat it accordingly rather than as ordinary consumer marketing. Work with qualified legal counsel familiar with financial-services marketing regulation throughout. The questions that matter most — what data can be used, whether prescreening rules apply, what qualifies as a firm offer, how GLBA obligations are met — are legal determinations with serious consequences if wrong. Keep the division clear: marketing handles audience and messaging; legal handles the FCRA/GLBA compliance structure. This article is general educational information, not legal advice; consult an attorney for your specific situation. Source mortgage-related data carefully and within the legal framework your counsel establishes. The sensitivity of financial and credit-derived data, and the penalties for misuse, make sourcing diligence and compliant use essential. Treat such data as operating under federal financial regulation, with counsel guiding what’s permissible. Iscope Digital’s Specialty Lists & Data Cards service provides specialty financial-vertical data used within the regulatory framework your counsel establishes. For the broader category of specialty list pricing and sourcing, see Specialty list pricing: why some verticals cost 10x more than others and on reading the data cards behind regulated lists, What is a data card and how do you read one?