States Where Federal Compliance Isn't Enough

Do federal laws preempt state mortgage trigger-lead restrictions, and how should lenders manage state compliance overlays in 2026? No, the federal Homebuyers Privacy Protection Act does not preempt state laws that impose stricter consent, disclosure, or recordkeeping requirements on mortgage trigger leads. Multi-state lenders designing compliance programs around federal statutes alone risk seven-figure class-action exposure and state attorney general investigations where private rights of action exist. Lenders must conduct annual compliance mapping to account for unique state-level variations and enforcement mechanics, making it vital to address the three compliance holes most lenders are still operating in before evaluating specific state exposure.

The states that had laws before the federal statute

Several states enacted trigger-lead restrictions before the federal law took effect. Public commentary identifies Rhode Island, Connecticut, Kansas, Kentucky, Maine, Texas, Utah, Wisconsin, Idaho, and Arkansas among them. The specific provisions vary materially state to state. Some impose stricter consent requirements. Some define “existing relationship” more narrowly. Some require specific disclosures in the outreach itself. Some create private rights of action with statutory damages.

A lender that complies with the federal statute in each of these states is not automatically compliant with the state statute. The state statute must be read and applied on its own terms.

What to map

A useful state-overlay map answers seven questions for each state in which the lender originates or services:

Does the state have a trigger-leads-specific statute?
If so, does it require affirmative consent? Express written consent? Opt-out, or opt-in?
How does the state define “existing relationship,” and is it narrower than the federal definition?
Does the state impose specific disclosure requirements on outreach generated from trigger leads?
Does the state impose recordkeeping requirements?
What are the penalties? Are they administrative, criminal, or both?
Is there a private right of action, and if so, what are the statutory damages?

The states most likely to enforce

Enforcement intensity varies. Some state AGs treat trigger-lead violations as a priority. Others do not have the resources. In our experience, the states most likely to bring early enforcement actions in 2026 and 2027 are those that have both an established consumer-protection enforcement record and a recent trigger-lead-specific statute. Texas, in particular, has expanded state-specific data collection on the quarterly NMLS Mortgage Call Report beginning in 2026, which gives the Texas regulator more visibility into lender outreach activity than it previously had.

Other states to watch closely are those with active mortgage industry seminars and regulatory engagement programs, where the state regulator’s posture is publicly visible and consistently strict.

The class-action layer

Private rights of action are the more significant enforcement risk for most lenders. State AGs target a small number of high-profile violators. Plaintiffs’ counsel target many violators with statutory-damage exposure that compounds across the affected consumer population. A single mass outreach campaign that touches several thousand consumers in a state with a private right of action and statutory damages can produce class-action exposure in the seven figures from a single legal misstep.

The class-action bar is currently building infrastructure to identify and pursue these claims. Lenders should assume the first wave of class filings will hit in 2027, on outreach that occurred in 2026.

The compliance question for the C-suite

Compliance with the federal trigger-leads ban is not a sufficient defense to a state-law claim. Compliance with the state-law overlays is required separately. The compliance program should reflect that. The vendor agreements should reflect it. The outreach scripts should reflect it. The recordkeeping should reflect it.

None of that is exotic compliance work. All of it is routine. The cost of doing it now is a small fraction of the cost of defending the first state AG investigation or class-action complaint.

Goldsmith Associates represents depository institutions, non-bank lenders, fund managers, loan servicers, and broker-dealers in connection with the purchase, sale, servicing, and financing of whole loans and mortgage servicing rights. If you are facing any of the issues raised in this article, or if you are pricing a trade, negotiating a purchase agreement, defending a repurchase demand, or working through a counterparty event, we are on call and at the ready 24/7. Call 844-4-GOLDSMITH, email info@goldsmithpllc.com, or visit goldsmithpllc.com.