Mortgage and lending marketing data sits at the intersection of two powerful federal laws — the Fair Credit Reporting Act (FCRA) and the Gramm-Leach-Bliley Act (GLBA) — that govern how consumer financial information can be collected, shared, and used. Marketers in this space must understand the framework. This article explains, in general educational terms, how these laws shape mortgage-applicant marketing. It is not legal advice.

The two laws that govern this space

Mortgage and lending marketing data is regulated more heavily than ordinary consumer data because it involves sensitive financial information and can touch credit data. The Fair Credit Reporting Act (FCRA) governs the collection, use, and sharing of consumer credit information. It’s central to mortgage marketing because of a specific mechanism: prescreened offers (also called “firm offers of credit”). The FCRA permits using credit-based criteria to identify consumers for prescreened offers of credit or insurance — but only under strict conditions, including that the offer must be a genuine “firm offer” and consumers have the right to opt out of prescreened offers. Using credit data outside these rules is a serious violation. The Gramm-Leach-Bliley Act (GLBA) governs how financial institutions handle consumers’ nonpublic personal information — requiring privacy notices, limiting sharing with non-affiliated third parties, and giving consumers certain opt-out rights. It shapes what financial institutions can do with the data they collect and how it can flow to marketers. Together, these laws mean mortgage-applicant marketing operates in a tightly regulated zone. The use of credit-based data triggers FCRA obligations (especially the firm-offer requirement for prescreened offers), and the handling of financial information triggers GLBA obligations. This is a domain where compliance is mandatory and the rules are technical — squarely requiring legal counsel.

Common questions

What is a “prescreened” mortgage offer?

A prescreened offer is a credit or insurance offer made to consumers selected using credit-based criteria, permitted under the FCRA. The defining requirement is that it must be a genuine “firm offer of credit” — a real offer the consumer will receive if they respond and continue to meet the criteria, not merely an advertisement. The FCRA permits using credit data to identify candidates for these firm offers, but the firm-offer requirement and consumers’ right to opt out of prescreened offers are strict conditions that must be met.

How does the FCRA affect mortgage marketing lists?

The FCRA governs whether and how credit-based data can be used to build marketing lists. When a list is selected using credit criteria for prescreened offers, the FCRA’s firm-offer requirements and opt-out provisions apply. Marketing lists that incorporate credit-derived information fall under FCRA rules, which restrict how such data can be used and require that prescreened offers meet the firm-offer standard. Using credit-based data for marketing outside the FCRA’s permitted mechanisms is a serious violation — this is core legal-counsel territory.

What does GLBA require of mortgage marketers?

GLBA governs how financial institutions handle consumers’ nonpublic personal information — requiring privacy notices that disclose information-sharing practices, limiting sharing of financial information with non-affiliated third parties, and giving consumers opt-out rights for certain sharing. For mortgage marketers, GLBA shapes what data financial institutions can share and how, and what obligations attach to handling consumers’ financial information. Compliance involves privacy notices, sharing limitations, and honoring opt-outs, structured according to the law’s technical requirements.

Can I buy a list of recent mortgage applicants?

Data related to mortgage and lending activity exists in the marketing data ecosystem, but how such data can be sourced, sold, and used is constrained by the FCRA, GLBA, and related rules — particularly when it involves credit-derived or nonpublic financial information. The permissibility depends heavily on the data’s nature and source and the intended use. Because this involves sensitive financial data under federal regulation, sourcing and using such lists should be structured with legal counsel. This is general information, not legal advice.

What’s the “firm offer of credit” requirement?

Under the FCRA, when credit-based criteria are used to select consumers for prescreened offers, the offer must be a genuine “firm offer of credit” — meaning the consumer will actually receive the credit (or insurance) if they respond and continue to meet the pre-established criteria. It can’t be a bait-and-switch or a mere ad dressed up as an offer. This requirement is fundamental to the FCRA’s prescreening mechanism and getting it right is essential, which requires legal guidance on what qualifies as a firm offer.

What are the consequences of getting FCRA or GLBA compliance wrong?

Serious. Both laws carry significant penalties for violations, including regulatory enforcement and potential liability. Because these laws involve sensitive consumer financial information and credit data, the consequences of misuse are substantial — both legally and reputationally. This elevated risk is exactly why mortgage and lending marketing should be conducted under qualified legal counsel familiar with the FCRA, GLBA, and related financial-marketing regulations, rather than approached as ordinary consumer marketing.

Where does the marketer’s role end and the lawyer’s begin?

Marketers can help define audiences, craft compliant messaging, and execute campaigns — but the determination of what data can be used, whether FCRA prescreening rules apply, how GLBA obligations are met, and whether an offer qualifies as a firm offer are legal questions requiring counsel familiar with financial-services regulation. Given the sensitivity and the penalties, marketers in mortgage and lending should work hand-in-hand with legal throughout, treating compliance as a structural foundation rather than a final check.

How this applies to your business

If you market mortgage or lending products, build your approach on the FCRA and GLBA framework from the start. The use of credit-based data for prescreened offers triggers the FCRA’s firm-offer and opt-out requirements; the handling of consumers’ financial information triggers GLBA obligations. This is a tightly regulated domain where compliance is structural, not optional — treat it accordingly rather than as ordinary consumer marketing. Work with qualified legal counsel familiar with financial-services marketing regulation throughout. The questions that matter most — what data can be used, whether prescreening rules apply, what qualifies as a firm offer, how GLBA obligations are met — are legal determinations with serious consequences if wrong. Keep the division clear: marketing handles audience and messaging; legal handles the FCRA/GLBA compliance structure. This article is general educational information, not legal advice; consult an attorney for your specific situation. Source mortgage-related data carefully and within the legal framework your counsel establishes. The sensitivity of financial and credit-derived data, and the penalties for misuse, make sourcing diligence and compliant use essential. Treat such data as operating under federal financial regulation, with counsel guiding what’s permissible. Iscope Digital’s Specialty Lists & Data Cards service provides specialty financial-vertical data used within the regulatory framework your counsel establishes. For the broader category of specialty list pricing and sourcing, see Specialty list pricing: why some verticals cost 10x more than others and on reading the data cards behind regulated lists, What is a data card and how do you read one?