Home Lending Expanded Data Sharing

What it is

If you apply for a home loan through Wealthfront, a broader set of third parties, including underwriters and servicers, will receive your most sensitive personal information including your Social Security number, credit history, and financial data.

Why it matters (compliance & governance perspective)

Home lending clients are subject to a wider data sharing network than standard investment clients, and consent to this sharing is embedded in the agreement to begin a loan application, not a separate affirmative opt-in.

Consumer impact (what this means for users)

Consumers who begin a Wealthfront home loan application consent to sharing their Social Security number, credit history, financial details, and work history with multiple third parties involved in the lending process, including post-closing servicers, as a condition of the service.

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages RESPA (Real Estate Settlement Procedures Act), which requires disclosure of settlement service provider relationships; FCRA, which governs the sharing and use of consumer credit information; GLBA and its implementing regulations for financial institutions handling nonpublic personal information; and CCPA for California residents. The CFPB is the primary enforcement authority for RESPA, FCRA, and GLBA in the consumer mortgage context. (2) GOVERNANCE EXPOSURE: Medium. The breadth of third parties receiving highly sensitive data, including SSN, credit reports, and work history, is operationally standard for mortgage lending but requires robust vendor management and data use agreements. The consent to this sharing is embedded in the act of beginning a loan application rather than a standalone disclosure, which may warrant review under TILA/RESPA integrated disclosure requirements. (3) JURISDICTION FLAGS: California creates heightened exposure because CCPA applies to mortgage data not fully preempted by GLBA, and California's financial privacy laws impose additional opt-out requirements for certain data sharing. FCRA restrictions on permissible purpose must be verified for each third-party recipient category. (4) CONTRACT AND VENDOR IMPLICATIONS: Each third-party recipient (underwriters, servicers, credit agencies) should have data use agreements limiting use to the stated permissible purposes. Post-closing servicers receiving consumer data represent an ongoing data sharing relationship that may continue for the life of the loan and should be addressed in vendor contracts. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that all home lending data sharing is covered by appropriate RESPA disclosures and FCRA permissible purpose analyses for each recipient category. A data flow map specific to the home lending product should be maintained separately from the investment product data map, given the distinct regulatory framework applicable to mortgage lending.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Client Data Deletion Restriction medium
• Ongoing Third-Party Account Credential Re-Access Authorization medium
• Biometric Data Collection and Vendor Destruction Requirement medium
• No Selling or Trading of Personal Information low
• Data Transfer in Merger or Asset Sale medium
• Cross-Device Tracking and Browsing Activity Matching medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.