For the past two years, the mortgage industry’s fair-lending debate has focused almost entirely on underwriting: adverse action notices, model explainability, Shapley values, and Regulation B (Reg B) compliance after the April 22, 2026 amendment. Those issues dominate the working groups, webinars, and governance toolkits. Meanwhile, the systems that bring borrowers into the funnel in the first place (e.g., paid social, lookalike modeling, AI-curated lead lists, and programmatic retargeting), operate on platforms the lenders don’t control, under rules the lender marketing teams may never have read, and with audit trails stored on third-party servers. Further, while federal regulators have been litigating these issues with Meta since 2019, the mortgage industry has barely been auditing them for a year.
The Federal Pullback Did Not Save Marketing AI
The April 22, 2026 final rule amending Reg B — effective July 21, 2026 — changed two things that matter for marketing AI. First, the CFPB removed Reg B’s effects-test framework and adopted the Bureau’s view that ECOA does not authorize disparate-impact claims. That interpretation is significant, but courts remain the final arbiters of what ECOA permits. Second, the rule narrowed the anti-discouragement prohibition under 12 C.F.R. § 1002.4(b) by tying it to an oral or written statement, including spoken words, written words, and visual images, that the creditor knows or should know would lead a reasonable person to believe credit would be denied or offered on less favorable terms on a prohibited basis. Affirmative targeting of one group is no longer treated as discouragement of another. However, the rule narrowed discouragement; it did not eliminate it. Discriminatory ad copy, scripts, imagery, chatbot statements, and signage all remain active risks.
If the only doctrines that mattered for mortgage marketing were ECOA discouragement and ECOA disparate impact, the marketing-AI risk picture would be substantially smaller after July 21, 2026. However, as they are not the only doctrines that matter, the risk picture merely shifted and not shrunk.
The Reg B amendment did not change the Fair Housing Act. 42 U.S.C. § 3604(c) prohibits making, printing, or publishing any notice, statement, or advertisement with respect to the sale or rental of a dwelling that indicates a preference, limitation, or discrimination based on a protected characteristic. 42 U.S.C. § 3605 separately governs residential real-estate-related transactions, including the making and purchasing of loans secured by residential real estate. For mortgage lenders, both provisions matter. 24 C.F.R. § 100.75(c)(3) reaches the selection of media or locations for housing advertising in a way that denies a segment of the housing market information about housing opportunities on a protected basis. Neither provision requires a discouraging statement. Neither provision requires intent. Neither provision was touched by the April 22 rule.
HUD’s 2013 disparate-impact rule at 24 C.F.R. § 100.500 500 remains in effect as of mid-June 2026, although HUD proposed rescinding it on January 14, 2026, with the comment period closing February 13. Even if that proposed rescission is finalized, the doctrine survives in the courts under Texas Department of Housing & Community Affairs v. Inclusive Communities Project, Inc., 576 U.S. 519 (2015). FHA disparate impact is statutory law; it does not depend on HUD’s pleading regulation, and private plaintiffs or state attorneys general can still invoke it. Inclusive Communities cuts both ways, and a careful lender should know which way. It preserved the cause of action, but it also fenced it: a plaintiff must identify a specific policy, satisfy a robust causality requirement at the pleading stage, confront the defendant’s substantial, legitimate, nondiscriminatory interests, and address any less-discriminatory alternative. Those limits create a meaningful defense, but not a basis to assume the theory has disappeared.
One current-status point matters and is easy to miss. HUD’s 2024 guidance on applying the Fair Housing Act to advertising through digital platforms and AI was withdrawn effective September 17, 2025, through a Federal Register notice published April 6, 2026. That guidance should not be cited as operative HUD policy. But the withdrawal does not erase the statute, § 100.75(c)(3), § 100.500 while it remains in effect, Inclusive Communities, or the Meta settlement. Rather, it does change how carefully counsel should describe the current federal guidance environment.
State UDAP statutes pick up whatever the federal retraction sets down. New York’s FAIR Business Practices Act, signed by Governor Hochul on December 19, 2025, amends General Business Law § 349 to extend the Attorney General’s authority beyond deceptive practices to also reach “unfair” and “abusive” conduct, using definitions that track Section 5 of the FTC Act and the CFPA respectively, with extraterritorial reach against non-New York businesses whose conduct affects New York residents. A national lender running paid social campaigns into New York ZIP codes is now within the Attorney General’s reach for unfair or abusive marketing practices, full stop, whether or not those practices would have survived a § 1002.4(b) discouragement claim under the prior standard. New York is not alone: California, Illinois, Massachusetts, and other states already have UDAP statutes that can reach this conduct.
ECOA itself did not disappear on July 21. The amended rule removes the effects test, but it preserves disparate-treatment liability, including liability for facially neutral criteria that functions as a proxy for a protected characteristic when it is designed or applied with the intent to advantage or disadvantage on a prohibited basis. A lookalike audience built deliberately on a proxy, or a bid modifier chosen because it tracks a protected class, is not insulated by the disparate-impact retraction. It lives on the disparate-treatment side of the line.
The new rule HMDA creates another exposure point. Marketing AI does not file the HMDA-LAR, but it shapes who appears in it. The geographic distribution of a lender’s applications relative to its market is the raw material of every redlining theory the DOJ and state regulators have run for a decade, and paid social that steers spend toward some census tracts and away from others writes that distribution before a single application is taken. A redlining analysis does not need the lender’s ad-targeting parameters to make its case; it needs the lender’s own HMDA data and a map. Geo-targeted marketing is where the application pattern is set, and HMDA is where it becomes visible.
The federal pullback redistributes risk. It does not eliminate it.
What the Federal Government Has Already Sued For
The marketing-AI enforcement record is not theoretical; it is seven years deep.
HUD charged Facebook with violations of the Fair Housing Act on March 28, 2019. The Secretary, U.S. Department of Housing and Urban Development, on behalf of the Assistant Secretary for Fair Housing & Equal Opportunity v. Facebook, Inc., FHEO No. 01-18-0323-8 (Mar. 28, 2019). The charge alleged that Facebook permitted advertisers to exclude users from housing ads by drawing a red line around neighborhoods on a map, by toggling off men or women, by excluding non-English speakers, and by excluding users classified as parents, non-American-born, non-Christian, interested in accessibility, or interested in Hispanic culture — categories alleged to be protected characteristics or protected-class-correlated proxies. The charge separately alleged that Facebook’s own personalization algorithms used protected-class-correlated signals to determine who would see housing ads regardless of what the advertiser specified.
After Facebook elected federal-court review, HUD referred the matter to the Department of Justice, which filed United States v. Meta Platforms, Inc. f/k/a Facebook, Inc., No. 1:22-cv-05187 (S.D.N.Y.) on June 21, 2022. The settlement was entered six days later, on June 27, 2022. Meta agreed to retire the Special Ad Audience tool — a lookalike modeling product that delivered ads to users who “look like” the advertiser’s source audience. Meta also agreed to stop offering housing-ad targeting options that directly describe or relate to FHA-protected classes. Meta then agreed to build what the parties called the Variance Reduction System: a separate machine-learning layer that monitors the gap between an ad’s targeted audience and its actual audience along sex and estimated race and ethnicity, then adjusts delivery to close the gap. Pursuant to 42 U.S.C. § 3614(d)(1)(C)(i), as modified by 28 C.F.R. § 85.5, Meta paid the maximum civil penalty of $115,054. By the end of 2023, Meta was required to bring variances to less than or equal to ten percent for 91.7 percent of housing ads measured for sex and 81 percent measured for estimated race and ethnicity, with court oversight running through June 27, 2026.
The DOJ complaint identified three theories of liability that translate diectly to mortgage marketing, including as follows:
- Trait-based targeting. Advertiser-selected categories that act as proxies for protected characteristics.
- Lookalike targeting. Algorithmic construction of an audience that resembles the advertiser’s source audience along dimensions the advertiser cannot see.
- Personalization algorithms. The platform’s own delivery optimization, which adjusts who sees an ad based on predicted relevance using protected-class-correlated signals. All three theories are agnostic to the advertiser’s intent. The advertiser is a mortgage lender. The platform is the tool. The lender owns the housing ad.
On April 25, 2023, DOJ Civil Rights, CFPB, FTC, and EEOC issued a Joint Statement on Enforcement Efforts Against Discrimination and Bias in Automated Systems, and in April 2024 HUD, Labor, Education, HHS, DHS, and DOJ’s Consumer Protection Branch joined the effort. The Joint Statement is not a statute, rule, or final agency action; its significance is enforcement posture and theory alignment. It identifies three risks that map cleanly to mortgage marketing AI: unrepresentative or biased training datasets, opaque models that frustrate diligence, and unanticipated uses of third-party tools by downstream deployers. Although the CFPB Bureau leadership has changed since the Joint Statement issued, the federal statutes the Statement enforces have not.
No public 2025–2026 state attorney-general settlement has been verified that squarely involves AI-driven mortgage marketing. The state-risk argument is therefore forward-looking, grounded in adjacent AI and fair-lending enforcement as well as state UDAP authority. The Massachusetts Attorney General’s 2025 Earnest settlement, which involved AI underwriting models in student lending, shows state enforcement interest in AI-driven credit risk, but it is not a mortgage-marketing precedent.
The Mortgage Marketing Stack the Industry Has Not Inventoried
A typical national lender’s marketing AI stack contains six layers, each with its own exposure profile. Those layers sit on two legally distinct surfaces, and the distinction governs what a lender can actually do about each. The first is the platform surface, which includes platforms like Meta, Google, LinkedIn, X, where the lender contracts on non-negotiable adhesion terms and its only real levers are configuration discipline, delivery monitoring, and testing. The second is the negotiable-vendor surface, which includes mortgage-specific marketing vendors, CRM providers, lead aggregators, where the lender holds an actual master services agreement and can demand terms. Conflating the two produces governance that asks the impossible of the platforms and too little of the vendors.
The first layer is paid social with lookalike and predictive-audience modeling. Meta’s current public materials say lookalike audiences are limited or unavailable for some ads about financial products and services, employment, or housing opportunities. LinkedIn describes Predictive Audiences as combining advertiser data with LinkedIn’s predictive AI and engagement signals to find likely converters, and requires anti-discrimination notice language for advertisers using its targeting tools. TikTok’s April 2026 Housing, Employment, and Credit policy requires a Special Ad Category toggle for covered ads and restricts age, gender, ZIP code, marital/parental status, and protected-class-related targeting. Most lenders use one or more of these products. Most lenders have not asked their agency what source audience the model is built from. If the source audience is the lender’s existing closed-loan book and that book is racially skewed — as most mortgage books are, because of the historic distribution of homeownership in the United States — the model imports that skew at scale.
The second layer is search engine marketing with audience signals. Google’s personalized-advertising policy for housing, employment, and consumer-finance ads in the United States and Canada restricts age, gender, marital status, parental status, and ZIP-code targeting and exclusions. Consumer finance includes credit and lending products. The mortgage CMO selecting bid modifiers may not realize that customer match, in-market signals, automated bidding, broad-match keywords, landing-page signals, and conversion optimization can still create delivery or pricing disparities correlated with protected characteristics under 24 C.F.R. § 100.75(c)(3) — even where the obvious protected-class and ZIP targeting is already restricted.
The third layer is AI-driven CRM and lead scoring. Salesforce Einstein, HubSpot AI, Total Expert, and a dozen mortgage-specific CRM platforms now offer predictive lead scoring that ranks inbound leads by likelihood to close. The model is typically trained on the lender’s historical conversion data. If the historical conversion data reflects loan-officer assignment patterns, geographic concentration, or product steering that correlates with protected class, the model will rank leads in a way that perpetuates that pattern. The lender does not see the weights. The vendor often will not produce them.
The fourth layer is AI-generated and AI-curated outreach content. Generative AI that drafts ad copy, email subject lines, or SMS text messages now sits inside most mortgage marketing platforms. Without guardrails, the model will produce variants tuned to perform best against the historical audience — which is to say, against an audience that itself was constructed by the prior three layers. Performance optimization closes the feedback loop. The variants that perform best are the ones the model generates more of.
The fifth layer is call routing and conversational AI. AI voice agents handling inbound mortgage calls now decide which callers reach a licensed loan officer and which are routed to a pre-qualification chatbot. The decision logic is typically a vendor black box. The TCPA exposure under FCC 24-17, CG Docket No. 23-362 (Feb. 8, 2024) is the obvious risk. The fair-housing exposure — what protected-class signal the routing model picks up from caller ID, voice characteristics, geography, language, or prior interaction history — is the less-discussed one.
The sixth layer is partner and referral networks. Real estate referral pipelines, builder partnerships, and lead aggregators each apply their own routing logic. Many now describe that logic as AI-enabled. The lender’s name is on the loan estimate. The lender owns the outcome under the FHA whether or not the lender wrote the routing rules.
Six layers mean six sets of vendor and platform contracts and six audit trails, most controlled by vendors or platforms, rarely shared with the lender, and almost never reviewed by the lender’s general counsel.
What Defensible Marketing AI Governance Looks Like
The mortgage industry has spent the last six months building origination-side AI governance frameworks under Freddie Mac Bulletin 2025-16 and Fannie Mae LL-2026-04. Those frameworks are not advertising rules and should not be cited as platform-specific marketing guidance. But their scope is not limited to underwriting. Fannie Mae and Freddie Mac use broad “origination” and “in connection with origination” language that may reach, or at least inform, lead-generation, borrower-facing CRM, call-routing, document-intake, and marketing-to-application handoff tools. Marketing AI should be evaluated inside or adjacent to the same governance file.
A defensible marketing AI program has eight components. Treat this as the checklist a fair-lending examiner, state AG, investor, GSE counterparty, or plaintiff could reasonably ask about, because each one will.
- Marketing AI inventory. A list of every AI-enabled tool in the marketing stack, every vendor, every platform, every model the vendor uses, and every audience signal each model consumes. Include embedded AI features in tools the marketing team forgot were AI — most major mortgage CRMs added them in 2024 and 2025 without a vendor notice that triggered any compliance review.
- Source-audience audit. For every lookalike, predictive, or audience-expansion workflow, document the source audience and assess whether it imports protected-class skew. If the source is the lender’s closed-loan book and the closed-loan book is materially imbalanced against the lender’s market demographics, the audience strategy is suspect. The fix is usually to rebuild the source from a balanced or counterfactual set, not to abandon audience expansion entirely.
- Targeting parameter review. Every targeting parameter, audience overlay, exclusion rule, and bid modifier in active campaigns, mapped against the proxy list the DOJ identified in Meta: ZIP code, language, education, parental status, accessibility interest, cultural affinity, age band, household composition. Any parameter that carries material protected-class proxy risk comes off.
- Delivery variance monitoring. Where the platform exposes advertiser-facing delivery composition data, pull it for every housing ad campaign. Note the limit: the Meta VRS produces compliance reports to DOJ and an independent reviewer, not advertiser-level variance reports to lenders on demand. Lenders should preserve the advertiser-facing data the platform does expose and contract for delivery and outcome data from negotiable vendors. Variance data is the closest analog to a fair-lending statistical test on the marketing side.
- Lead-scoring fairness testing. For predictive lead-scoring models, run the same disparate-treatment and outcome testing you run on your underwriting models. If the vendor will not produce the necessary inputs, the answer is not to give up the testing. The answer is to renegotiate the contract or move vendors.
- Generative content guardrails. Prompt-level controls on what generative AI is permitted to produce, output-level review for protected-class signals or affinity language, and version control on every prompt template. Treat every prompt and every output as a discoverable litigation artifact. Electronically stored information — which prompts and AI outputs plainly are — is discoverable under Federal Rule of Civil Procedure 34(a)(1)(A), and federal courts have already ordered production of AI interaction logs in litigation. The prompt library a marketing team treats as ephemeral is the evidentiary record a plaintiff will read back to it.
- Two-surface contract and control architecture. The platform surface and the vendor surface require different instruments, and a program that uses one instrument for both will fail on the larger surface. For the negotiable-vendor surface — CRM, lead-scoring, conversational-AI, and mortgage-specific marketing vendors — the master services agreement should obligate the vendor to (i) disclose any AI or ML feature in the product, (ii) produce delivery and outcome data on request, (iii) cooperate in fair-housing audits, (iv) indemnify for AI-driven fair-housing claims to the extent the vendor’s design caused the exposure, and (v) flow each term down to its sub-processors. Most contracts do none of this; the renewal cycle is where you fix it. For the platform surface — Meta, Google, LinkedIn, X — those terms are not on offer. There the controls are operational, not contractual: lock down campaign configuration, pull every delivery-variance report the platform exposes, contract for variance data through an enterprise agreement where one exists, and run your own fair-housing tester audits to generate the evidence the platform will not hand you. The platform will not indemnify you, and you own the housing ad regardless. Govern accordingly.
- Documented governance owner. A named executive owner for marketing AI risk, parallel to the executive owner Freddie Mac § 1302.8 already requires for AI generally. The owner reviews the inventory annually, approves new tools, and signs the marketing AI section of the lender’s overall AI governance file.
None of this requires a new statute. All of it is implementable inside the AI governance program a lender is already building for the GSEs.
Why This Lands Before Underwriting AI Does
Three reasons the marketing-AI enforcement story arrives ahead of the underwriting-AI enforcement story.
First, the platform theory already has a federal record. Meta’s VRS settlement runs through June 27, 2026, and the public DOJ materials describe a VRS architecture for housing-ad delivery variance that gives regulators and plaintiffs a roadmap for how to plead targeting and delivery-optimization theories. The plaintiffs’ bar has been reading those public materials since 2022. The institutional knowledge of how to litigate a delivery-algorithm case already exists, and it does not exist for underwriting AI cases.
Second, the marketing stack is more visible than the underwriting stack. A plaintiff’s lawyer or a state AG does not need to subpoena the lender’s origination platform to test a marketing AI claim. They can stand up tester accounts on Meta, Google, and TikTok, run controlled fair-housing tests against the lender’s active campaigns, and document differential delivery before they ever file a complaint. Fair-housing testers have been doing exactly this against rental advertisers since 2019. They are now doing it against mortgage advertisers.
Third, the federal pullback on disparate impact concentrates enforcement at the state and private level, and state AGs and private plaintiffs prefer cases they can prove with platform data rather than with internal model artifacts. Marketing AI cases meet that test. Underwriting AI cases do not.
What to Do Tuesday Morning
If your firm has not inventoried its marketing AI stack, do that this week. Have the CMO and the agency produce the list of every AI-enabled tool, every audience overlay, every lookalike or predictive source, every bid modifier, every CRM lead-scoring model, and every platform integration in production. Sort that inventory by surface — what runs on a platform you cannot negotiate with versus what runs on a vendor you can — because the fix differs by surface. Pair the inventory with the same risk-tier classification you applied to your origination AI governance program under Freddie Mac § 1302.8. On the negotiable-vendor side, update contracts on the next renewal cycle to require fair-housing audit cooperation and delivery-variance data. On the platform side, where you have no such leverage, stand up your own configuration review and run a fair-housing tester audit against your paid social before someone else does. Name an executive owner for marketing AI risk and add it to the AI governance file you will produce when Fannie Mae or Freddie Mac asks. Give that owner a real operating model — a fixed review cadence for delivery-variance and lead-scoring fairness data, a written escalation path when a campaign breaches tolerance, and a standing reporting line into whatever committee already owns your origination AI governance — not just a title on an org chart. The hardest part of all of this is not the policy. It is finding out what is actually running, where, and against whom.
The underwriting-AI conversation will continue. It should. It is not the conversation that decides which lender shows up first on a state AG’s quarterly enforcement roundup. The marketing-AI conversation is.
*This article and its contents — including the analytical framework, the six-layer marketing AI stack taxonomy, the two-surface platform-and-vendor architecture, and the eight-component governance checklist — are the original work of the author and are protected under the United States Copyright Act, 17 U.S.C. §§ 101 et seq., and applicable international copyright treaties.
All rights not expressly granted are reserved by the author and Brody | Gapp LLP, including without limitation the rights to reproduce, adapt, syndicate, translate, and incorporate this article into subsequent firm publications, including The Mortgage Bankers AI Governance Guide™ and related works. Permission requests may be directed to [email protected].
This article is provided for general informational purposes and reflects developments as of June 2026. It is not legal advice, is not jurisdiction-specific, and does not create an attorney-client relationship; readers should confirm current authority and consult counsel on their facts. Prepared with the assistance of AI tools under the supervision and review of counsel. Attorney advertising.
