FCRA Prescreen Rules: Firm Offer Requirements, the Prescreen Opt-Out Notice and Credit-Based Digital Ads

What the law requires. The Fair Credit Reporting Act (FCRA) treats marketing as outside the usual permissible purposes for a consumer report. Prescreening is the door Congress left open for unsolicited credit and insurance offers; the other is the consumer's own authorization (15 U.S.C. § 1681b(c)). The process runs in five steps:

1. The lender sets the criteria. It defines the credit and insurability criteria before selection. Any later screen must also be set in advance (§ 1681a(l)(1)).
2. The bureau screens its files. It leaves out consumers with an opt-out election in effect. It also leaves out anyone whose file shows an age under 21, unless that consumer consents (§ 1681b(c)(1)(B)(iii), (iv)).
3. The bureau delivers a thin list. Names and addresses, plus limited non-identifying data, go to the lender (§ 1681b(c)(2)). The bureau may not furnish a record of these inquiries to anyone except the consumer (§ 1681b(c)(3)).
4. The lender sends a firm offer with the notice. Each written solicitation carries the prescreen opt-out notice (15 U.S.C. § 1681m(d)(1)).
5. The lender keeps the criteria. The file must hold the selection and credit criteria for three years (§ 1681m(d)(3)).

An example. A credit union wants to mail a pre-approved auto refinance offer. It asks a bureau for members of the public in its state with no recent delinquencies and a minimum score. The bureau removes opted-out consumers and returns names and addresses. The credit union must then honour the offer for anyone who still meets those criteria when they respond.

What the law requires. The offer must be honoured for anyone who meets the criteria used to select them. The statute allows only three further conditions (15 U.S.C. § 1681a(l)):

• application-based credit criteria, set before selection and for the purpose of deciding whether to extend credit under the offer;
• verification that the consumer still meets the selection criteria, or verification of the application data;
• collateral, if the requirement was set before selection and disclosed in the offer.

What regulators have done. In October 2012 the FTC announced settlements with Equifax Information Services and with Direct Lending Source and related companies. The FTC alleged that Equifax sold prescreened lists to buyers who lacked a permissible purpose and that some lists were resold for uses other than firm offers (FTC, October 2012). Equifax agreed to pay $393,000, and the Direct Lending defendants agreed to a $1.2 million civil penalty, per the FTC's announcement. The settlements did not admit liability.

What practitioners recommend (practice). Lenders usually document the criteria set, the date it was fixed and the post-screen rules before the list is ordered. That file is what § 1681m(d)(3) asks them to keep, and it is the evidence a regulator would ask for.

What the law requires. The statute lists what the notice says (15 U.S.C. § 1681m(d)(1)):

• information in the consumer's report was used;
• the consumer was selected for meeting credit or insurance criteria;
• the offer may not be extended if the consumer no longer qualifies or lacks required collateral;
• the consumer can opt out through the bureaus' notification system.

The notice must also give that system's address and toll-free number (§ 1681m(d)(2)).

The CFPB's Regulation V sets the format in two layers (12 CFR § 1022.54(c)):

Model notices in English and Spanish sit in Appendix D to Part 1022 (eCFR Part 1022). Regulation V's notice rule covers prescreened offers from users other than certain motor vehicle dealers. Those dealers follow the FTC's parallel rule, which since a 2021 amendment applies only to them (16 CFR § 642.1). That FTC rule first took effect on 1 August 2005 (16 CFR Part 642).

Why the electronic wording matters. Section 1022.54 already describes notices "provided electronically". The statute still speaks of each "written solicitation". How those words apply to a banner, a video pre-roll or a social ad is not spelled out in the rule. That gap matters for the digital patterns below.

What the law requires. Each nationwide bureau that sells prescreened lists must keep a notification system with a toll-free number (15 U.S.C. § 1681b(e)(5)). An election takes effect five business days after the consumer notifies the bureau. It covers the bureau's affiliates too (§ 1681b(e)(4)).

How it works in practice. The nationwide bureaus run the shared system at OptOutPrescreen.com and the number 1-888-5-OPT-OUT (OptOutPrescreen.com, accessed 9 November 2026). The site could not be accessed, so we confirmed the operator and number through the bureaus' and FTC's consumer pages as indexed by search. An opt-out removes a consumer from prescreened lists. It does not stop a lender from marketing to its own customers, and it does not reach marketing lists built from other sources.

What the law requires. A "trigger lead" is a prescreened list built from the fact that a consumer just applied for credit. Since 2026, a mortgage-related inquiry can feed such a list only if the offer is firm and the buyer of the list meets one of three tests (15 U.S.C. § 1681b(c)(4)(B)):

• it has documented the consumer's authorization; or
• it originated or services the consumer's current residential mortgage; or
• it is an insured depository institution or credit union that holds a current account for the consumer.

Status. Congress enacted the change as the Homebuyers Privacy Protection Act, Public Law 119-36, on 5 September 2025. It took effect "180 days after the date of enactment", which by our count is 4 March 2026 (15 U.S.C. § 1681b, statutory notes; 15 U.S.C. § 1601 notes). We found no CFPB or FTC rule implementing it as of 9 November 2026.

Digital channels did not change the statute. They changed how a list becomes an impression. A prescreened list can be matched to a hashed email or device ID and pushed to a demand-side platform (DSP). Separately, data companies sell third-party data audiences that use credit-related attributes without any firm offer. The law treats these two patterns very differently.

What a court has held. In Trans Union Corp. v. FTC, the FTC had found that TransUnion's target marketing lists, built from credit file data, were consumer reports and "could no longer be sold for target marketing purposes". The D.C. Circuit denied TransUnion's petition for review on 13 April 2001 (Trans Union Corp. v. FTC, 245 F.3d 809, via CourtListener). The case predates programmatic advertising. It remains the leading appellate decision we found on credit-based marketing lists.

What the CFPB proposed, and then withdrew. In December 2024 the CFPB proposed a Regulation V rule on data brokers (89 FR 101402, 13 December 2024). It described bureaus that deliver a merchant's ads to consumers picked from credit files without handing over the file. The proposal would have treated that as furnishing a consumer report. It also asked whether credit data aggregated at a ZIP or ZIP+4 level should count as a consumer report.

The CFPB withdrew the proposal on 15 May 2025, saying that "legislative rulemaking is not necessary or appropriate at this time" (90 FR 20568, 15 May 2025). Three days earlier it had withdrawn its July 2022 advisory opinion on permissible purposes, among 67 guidance documents (90 FR 20084, 12 May 2025). Neither document states current CFPB policy. The statute and the Trans Union decision are unchanged.

What platforms require (platform policy, not law). Google bars age, gender, parental status, marital status and ZIP code targeting for consumer finance ads in the United States and Canada (Google Ads policy, accessed 9 November 2026). Meta says it disallowed gender and age targeting and set a minimum 15-mile location radius for credit ads (Meta, 21 June 2022). Meta also reported extending its Variance Reduction System to US credit ads in October 2023 (Meta, update of 26 October 2023).

Two adjacent rule sets sit beside this table. Sharing the lender's own customer data with an ad platform is a GLBA question, covered in GLBA joint marketing exception and marketing opt-out. Choosing who sees a credit ad, including lookalike audience expansion, is a fair lending question, covered in fair lending advertising rules for targeted ads.

Prescreen criteria are credit criteria. The Equal Credit Opportunity Act (ECOA) bars creditors from discriminating against applicants on bases that include race, sex, marital status and age (15 U.S.C. § 1691(a)). A list built on criteria that act as proxies for those bases raises the same questions as any other credit decision. The 2026 changes to Regulation B, which narrow how ECOA treats targeted marketing, are explained on the fair lending advertising page.

1. Digital "written solicitations". Whether a display, video or social ad built from a prescreened list is a written solicitation under § 1681m(d). If it is, how the short notice's placement and type-size rules translate to it.
2. Firm offers in programmatic delivery. Whether an ad seen by a person who was not on the list, for example through household or device matching, is still part of a prescreened transaction.
3. Aggregated credit attributes. When ZIP+4 or household-level credit data is information "bearing on" an individual consumer. The CFPB raised the question in 2024 and withdrew the proposal in 2025.
4. Vendor roles. Whether an onboarding or matching vendor that receives the list is the lender's agent or a separate recipient.

The wider rule set for bank advertising is mapped in bank advertising rules and the ad tech compliance hub. The GLBA side of a bank's ad program, including state opt-in laws, is in GLBA and advertising with bank customer data.

1. 15 U.S.C. § 1681a, Definitions, including (l) firm offer (Cornell LII, accessed 9 November 2026). https://www.law.cornell.edu/uscode/text/15/1681a
2. 15 U.S.C. § 1681b, Permissible purposes, including (c) and (e), with statutory notes on Pub. L. 119-36 (Cornell LII). https://www.law.cornell.edu/uscode/text/15/1681b
3. 15 U.S.C. § 1681m, Requirements on users, including (d) (Cornell LII). https://www.law.cornell.edu/uscode/text/15/1681m
4. 15 U.S.C. § 1601, notes: short title of the Homebuyers Privacy Protection Act (Cornell LII). https://www.law.cornell.edu/uscode/text/15/1601
5. 12 CFR § 1022.54, Duties of users making written firm offers (Regulation V, Cornell LII). https://www.law.cornell.edu/cfr/text/12/1022.54
6. 12 CFR Part 1022, Regulation V, including Appendix D model notices (eCFR, up to date as of 5 November 2026). https://www.ecfr.gov/current/title-12/chapter-X/part-1022
7. 16 CFR Part 642, Prescreen Opt-Out Notice (eCFR, up to date as of 5 November 2026). https://www.ecfr.gov/current/title-16/chapter-I/subchapter-F/part-642
8. 16 CFR § 642.1, Purpose and scope (Cornell LII). https://www.law.cornell.edu/cfr/text/16/642.1
9. 12 CFR § 1022.21, Affiliate marketing opt-out (Cornell LII). https://www.law.cornell.edu/cfr/text/12/1022.21
10. Trans Union Corp. v. FTC, 245 F.3d 809 (D.C. Cir. 13 April 2001), CourtListener. https://www.courtlistener.com/opinion/185510/trans-union-corp-v-federal-trade-commission/