intended use of the data collected from consumers.
§ Disclose and outline the practice of data collection, usage, and sharing. Data Practices should be easy to find, easy to read and easy for consumers to act upon.
- Do not hide fields without consumer disclosure.
- For both simple and custom offer types, if the Lead Generation Company chooses not to show one or more fields, it should either:
o Include clear and conspicuous notice prominently on the offer page or via a prominently displayed link indicating which fields will be collected and shared with the loan originator(s), or
o Include text next to each offer on the page that specifically lists each field that will be collected and shared with the purchaser of the lead.
- The Lead Generation Company should not sell data that the consumer has provided during registration or on an advertised offer form to other companies to use to market itself to the consumer without the consumer’s knowledge or choice.
- The Lead Generation Company should disclose if the data collected will be shared with third parties.
- No sharing of NPI with 3rd party marketers for the purpose of sending email, without the consumer’s consent.
- Loan originators that use third parties to manage their email list should have a formal data licensing agreement.
- Loan originators working with list management partners should also create a review process to monitor their partners’ activity.
- Loan originators should appoint a compliance manager who is knowledgeable in Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM) and additional privacy law and standards to oversee the review process.
- The Lead Generation Company should allow consumers to easily skip offers if they do not want to share the data being requested by the loan originator or if they are no longer interested in the offer.
- The Lead Generation Company should ensure that the skip function is clear and conspicuous and is not hidden or difficult to locate on the offer. In addition, the skip function should be displayed in equal prominence to the submit function.
- In a webpage set-up, a Lead Generation Company may pre-select loan originator offers on a multi-listing page to present consumers with offers they believe may best fit their needs. Pre-selected offers are acceptable for custom offers where additional data is collected, but should be considered opt-out. Importantly, offers made based on the Fair Credit Report Act (FCRA) require very careful implementation and only after thorough review by a risk management professional.
- Simple offers - usually not asking for additional information or custom form fields and generally characterized by only a “yes/no” answer or opt-in box - should not be pre-selected. Note: The practice of pre-selecting the “yes” or the opt-in box - which, in effect, automatically signs up the consumer for that offer without the consumer having to take any further affirmative action - is considered to be an opt-out offer and therefore should not be used.
- The Lead Generation Company should use clear language when using pre-selected custom offers; and it should not insinuate that the consumer must select an offer in order to continue through the registration process.
- The Lead Generation Company and/or the loan originator may request that consumers download software applications that can connect through the Internet to their computer or mobile device. Any such download should only be initiated after affirmative consent from the consumer.
- After completion of the download, Internet-connected software applications should:
o Only launch with the consumer’s knowledge; that is, be visible to the consumer and not run invisibly in the background, until such time as a consumer configures options to allow such behavior;
o Clearly indicate the name and contact information of the loan originator and provide a reasonable method to obtain further information about the loan originator; and
o Provide functionality that enables an average consumer to completely uninstall the application from his/her computer or mobile device without any negative impact on the consumer’s device.
- After submission, the lead data should be transferred from the Lead Generation Company in real-time or batch in a standard, secure format.
- Prior to accepting any consumer information, the terms and conditions must be clearly and conspicuously disclosed so that a reasonable consumer may understand the essence of the proposed exchange. The terms and conditions should be compiled, reviewed and updated by a risk management professional who is knowledgeable about, among other things, consumer disclosure mandates.
- Terms and conditions should be accessible and prominent during the registration or offer selection process.
- When using the term “free” or “complimentary” or other similar terms, the loan originator should ensure proper disclosures are made in proximity to the term, if some form of obligation is needed by the consumer to receive the offer. Note: such terms are considered “trigger terms” under the Truth in Lending Act. Seek professional guidance prior to using any incentive language.
- Loan originators should include a summary of consumer obligations and requirements. Note: the summary of obligations and requirements is used to additionally educate consumers and not to replace a detailed terms and conditions link that should be prominently displayed for consumers.
- The Lead Generation Company must disclose directly on the registration page exactly what the consumer needs to do in order to receive the reward.
- A summary of key requirements of the consumer should be disclosed on the first registration page.
- If the consumer must sign up for various offers to qualify for the reward, the Lead Generation Company should disclose to the consumer the cost associated with each offer presented.
- If there is some form of monetary obligation needed to qualify for a gift, the Lead Generation Company should, at a minimum, provide the consumer with a representative estimate of such costs.
Planning for the Bureau’s visit