This PRIVACY NOTICE FOR RESIDENTS OF CALIFORNIA, VIRGINIA, COLORADO, CONNECTICUT, AND UTAH supplements the information contained in the Privacy Policy of the FEDERAL HOME LOAN MORTGAGE CORPORATION ("Freddie Mac," "we," "us," or "our") and applies solely to those individuals who reside in the aforementioned states ("consumers" or "you"). We are issuing this Notice in compliance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (together "CCPA"), the Virginia Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), and other applicable privacy laws (the “Applicable Laws”). Any terms used in this Notice that are not defined in the Notice itself have the same definitions as used in the Applicable Laws. Residents of California, who are Freddie Mac employees or candidates for employment can find privacy information specific to those roles at our notices for California-Resident Employees and California-Resident Employment Candidates.

Definition of Personal Information

We collect certain "personal information" from consumers. The CCPA defines personal information as information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household or device. The CPA, CTDPA, UCPA, and VCDPA define personal information or personal data as any information that is linked or reasonably linkable to an identified or identifiable individual. Personal information does not include:

  • Publicly available information from government records.
  • De-identified or aggregated information.
  • Information excluded from the scope of the Applicable Laws, like:
    • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
    • personal information covered by certain other privacy laws, like the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) and California Financial Information Privacy Act (FIPA).

What Personal Information We Collect

We have collected the following categories of personal information from consumers within the last twelve (12) months:

Category Examples Collected
A. Identifiers. Real name, alias, postal address, personal and work phone number, unique personal identifier, online identifier, Internet Protocol address, personal photograph/image, personal and work email address, account name, and other similar identifiers. YES
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). Name, signature, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, or health insurance information. Some personal information included in this category may overlap with other categories. YES
C. Protected classification characteristics under California or federal law. Age (40 years or older), physical or mental disability, veteran or military status, genetic information (including familial genetic information). YES
D. Commercial information. Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. YES
F. Internet or similar network activity. Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement, broad geolocation (not precise). YES
G. Sensitive Personal Information, with your consent where required. Your Social Security number, driver's license number, passport number, state identification card, racial or ethnic origin, biometric data (genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait or other physical patterns, and sleep, health or exercise data); combination of email address, financial account, debit card, or credit card with security or access code, password, or other credentials allowing access to your account, medical information, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation or EEOC monitoring information (ethnicity, religion, gender and sexual orientation). YES
H. Sensory data. Audio, electronic, visual, thermal, olfactory, or similar information. YES
I. Professional or employment-related information. Current or past job history, responsibilities, memberships or performance evaluations, national identification information, travel-related records, background check and screening results, references. YES
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. YES
K. Inferences drawn from other personal information. Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. NO

Categories of Sources

We obtain the categories of personal information listed above:

  • from the companies from which we buy or consider buying loans (our “customers”) or their agents, from our loan servicing agents and from our service providers in connection with the purchase and securitization of loans and the resecuritization and sale of such securities.
  • from our Seller/Servicers and other entities that sell or seek to sell us mortgages or to have us securitize their mortgages.
  • from credit bureaus and other vendors who provide credit and other background information on individuals for credit and due diligence purposes.
  • from activity on our websites or mobile application (for example, from submissions to our mobile application or through our website portals, or from automatically collected website or mobile application usage details).
  • from borrowers and loan applicants.
  • from third parties from whom we obtain products or services.

How We Use Personal Information

We may use or disclose personal information we collect for one or more of the following business purposes:

  • To fulfill a request or satisfy the reason for which the information is provided. For example, if a mortgage broker provides us with personal information in order for us to consider buying a loan, we use that information to assess the loan and, if we buy it, to service it and securitize it. As another example, if you provide your personal or financial information through our mobile application, we organize, store and retain that information, making the information available to the housing counselor so the counselor can determine your readiness to purchase a home and get your finances and credit profile ready for success in the mortgage application process.
  • In connection with activities related to buying mortgages, securitizing them and selling the securities (our secondary market-related activities). For example, we use personal information to evaluate loans that we are considering buying or guaranteeing and to monitor the performance of loans that we own or guarantee. As another example, we use this information to evaluate the value of properties collateralizing these loans and to predict default.
  • To establish and manage our relationships with brokers, third party loan originators, and other entities with whom we conduct business, such as information about these entities’ employees, agents, principals, officers and guarantors. This may include names, photographs/images, email addresses, phone numbers and other contact information for the employees of these entities with whom we are dealing.
  • If you send us an email or message and provide your name or other personal information, we may use this information to research your question, to send an answer to your question and to deliver the requested information or service to you. We also may use this information to provide you with information in which we believe you will be interested; however, at any time, you may request that we stop doing this by contacting us in the manner described in the "How to Contact Us" section of this Notice.
  • To provide our customers with email alerts, event registrations and other notices concerning our products or services, events, news, or other items that may be of interest.
  • With regard to website visitor information, to measure the number of visitors to different pages on the website, conduct statistical modeling and evaluate, modify and enhance our websites, our services and our business. We also use this information to monitor network traffic and to identify unauthorized access or unusual activity on the website.
  • The mobile application will also capture information about your mobile device and your usage of the application, including device type, browser, general location, session duration and similar data. We use this to help refine the application.
  • For purposes of testing, research, analysis, modeling and product development related to our public mission, business and websites. We may publish the results of our research, but we will not publish personally identifiable information about you as part of the publication.
  • To carry out our obligations and enforce our rights arising from any loan documents or other contracts we have entered into, including for collections.
  • To evaluate or conduct a restructuring, reorganization, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
  • As necessary or appropriate to protect the rights, property or safety of us, our customers or others.
  • As required by applicable laws, regulations and court orders, and requests from Congress, our regulators, or our conservator.
  • To respond to law enforcement requests.
  • For security or the prevention, detection, or investigation of fraud, suspected or actual illegal activity, or other misconduct.
  • To establish or defend legal claims and allegations.
  • To seek advice from lawyers, auditors and other professional advisers.
  • As described to you when collecting your personal information or as otherwise set forth in the CCPA.

We do not do the following things with your personal information:

  • We do not sell or share personal information to third parties for advertising or marketing products and services to you, or to third parties whose purpose in acquiring the information is to sell your personal information to others for advertising or marketing purposes.
  • We will not collect additional categories of personal information or use the personal information we collect for materially different, unrelated, or incompatible purposes without first providing you notice in the manner specified in the “Changes to this Notice” section of this Notice.

We may disclose your personal information to third parties for business-related purposes. Before we disclose personal information for a business purpose, we enter into a contract that describes the purpose and requires the recipient not to use or disclose the information except for purposes specified in the contract (typically to perform services for us).

In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose:

  • Category A: Identifiers.
  • Category B: California Customer Records personal information categories.
  • Category C: Protected classification characteristics under California or federal law.
  • Category D: Commercial information.
  • Category I: Professional or employment-related information.
  • Category J: Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C.§ 1232g, 34 C.F.R. Part 99)).

Third Parties to Whom We Disclose Personal Information

We disclose your personal information to the following categories of third parties:

  • Service providers.
  • Third parties to whom you or your agents authorize us to disclose your personal information in connection with activities we perform or services we provide to you or in connection with your loan.
  • Third parties who assist us with this or our other websites, or our applications. This may include information you provide as part of voluntary surveys about application or website-related issues taken while or after visiting the site.
  • Third parties as part of our secondary market-related activities and other aspects of our business, including to loan servicers, consumer reporting agencies, workout companies, attorneys, and technology providers who enable us or third parties to perform business, professional, and technical support functions for us or you. For example, we may disclose personal information to third parties to administer or protect our interest in a loan.

We also may disclose personal information to our regulators, our conservator and as otherwise required by applicable laws, regulations and court orders.

In the twelve (12) months preceding the date of this Notice, we have not sold or shared any personal information other than as specified in this Notice.

Retention Period

We may retain your personal information for up to seven (7) years after we finish providing you services, complying with our legal obligations, resolving disputes, and enforcing our agreements. In each case, we will retain your information for no longer than is reasonably necessary.

Your Rights and Choices under the CCPA

The CCPA provides California residents with specific rights regarding their personal information. This section describes consumers’ CCPA rights and explains how to exercise those rights.

Access to Specific Information and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Before we disclose information to you, we will ask you for information to verify your identity. Once we receive and confirm your verifiable consumer request, we will disclose to you:

  • The categories of personal information we collected about you.
  • The categories of sources for the personal information we collected about you.
  • Our business or commercial purpose for collecting or sharing that personal information.
  • The categories of third parties with whom we share that personal information.
    • If we disclosed your personal information for a business purpose, the business purpose and the categories of personal information that each category of recipient received.

Additionally, if you have requested it and have provided sufficient identifying information to enable us to do so, we will disclose the specific pieces of your personal information that we collected about you. We will provide a copy of personal information we have obtained about you in a portable and, to the extent technically feasible, readily usable format.

Please note that we may not disclose the information you have requested if we are unable to verify your identity. In addition, we may not disclose certain information that is covered by one or more of the exemptions from the CCPA, as outlined in the CCPA.

Deletion Request Rights

You have the right to request that we delete personal information that we collected and retained. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. If we deny your deletion request, we will inform you and explain the basis for our denial.

Correction Request Rights

You have the right to request that we correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing. Once we receive and confirm your verifiable consumer request, we will correct your personal information from our records, unless an exception applies. If we deny your correction request, we will inform you and explain the basis for our denial.

Right to Limit Use of Sensitive Personal Information

You have the right to request that we limit the use of your sensitive personal information, which you can exercise as described below.

Opt-Out Preference Signals/Tracking: We use cookies and other technology, such as the web browsers that are used to read our websites, to collect information and to track browsing activity over time and across third-party websites and to deliver targeted advertisements to you. We are working towards enabling Global Privacy Control (GPC) as an additional way for you to submit a request to opt-out of the sale and sharing of your personal information through browsers and/or browser extensions that support such a signal. Until then, you can opt-out of the use of third-party cookies for personalized advertising by setting your cookie preferences on our website, by adjusting your browser’s cookie settings and by clicking on this link Your California and Virginia Privacy Choices .

Your Virginia (starting Jan. 1, 2023), Colorado (starting July 1, 2023) and Connecticut (starting July 1, 2023) Privacy Rights

The VCDPA, CPA and CTDPA provide residents of Virginia, Colorado and Connecticut with specific rights regarding their personal information. This section describes the rights of consumers who are residents of Virginia, Colorado and Connecticut and explains how to exercise those rights.

Access to Specific Information and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of your personal information. Before we disclose information to you, we will ask you for information to verify your identity. Once we receive and confirm your verifiable consumer request, we will disclose to you whether we process your personal information and provide you with access to your personal information. We will provide a copy of personal information we have obtained about you in a portable and, to the extent technically feasible, readily usable format.

Please note that we may not disclose the information you have requested if we are unable to verify your identity. In addition, we may not disclose certain information that is covered by one or more exemptions, as outlined in the VCDPA, CPA and CTDPA.

Deletion Request Rights

You have the right to request that we delete personal information that we collected and retained. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. If we deny your deletion request, we will inform you and explain the basis for our denial.

Correction Request Rights

You have the right to request that we correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing. Once we receive and confirm your verifiable consumer request, we will correct your personal information from our records, unless an exception applies. If we deny your correction request, we will inform you and explain the basis for our denial.

Appeals

If we deny your request, you have the right to appeal our decision. We will respond to appeals from Virginia and Connecticut residents within 60 days. We will respond to appeals from Colorado residents within 45 days.

Your Utah Privacy Rights (starting Dec. 31, 2023)

The Utah Consumer Privacy Act (UCPA) provides Utah residents with specific rights regarding their personal information. This section describes consumers’ UCPA rights and explains how to exercise those rights.

Access to Specific Information and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of your personal information. Before we disclose information to you, we will ask you for information to verify your identity. Once we receive and confirm your verifiable consumer request, we will disclose to you whether we process your personal information and provide you with access to your personal information. We will provide a copy of personal information we have obtained about you in a portable and, to the extent technically feasible, readily usable format.

Please note that we may not disclose the information you have requested if we are unable to verify your identity. In addition, we may not disclose certain information that is covered by one or more exemptions, as outlined in the UCPA.

Deletion Request Rights

You have the right to request that we delete personal information that we collected and retained. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. If we deny your deletion request, we will inform you and explain the basis for our denial.

How to Exercise Your State Privacy Rights

To exercise any of the rights described above, please submit a request to us by either:

You must describe your request with sufficient detail to allow us to properly understand, evaluate, and respond to it. California residents may only make a request for access or data portability twice within any 12-month period.

For California residents, only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make a request related to your personal information. You may also make a request on behalf of your minor child.

As noted earlier in this Notice, we respond only to requests that are verifiable consumer requests. Therefore, when you submit a request to us, we will seek to verify your identity by asking you to provide us with information that enables us to identify you, such as your email address or the last four digits of your social security number. We also may use a third-party verification provider to verify your identity.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a request does not require you to create an account with us. We will only use personal information provided in a request to verify the requestor's identity or authority to make the request.

Response Timing and Format

We endeavor to respond to each verifiable consumer request within 45 days of its receipt. If we require more time, we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We will respond to appeals from Virginia and Connecticut residents within 60 days. We will respond to appeals from Colorado residents within 45 days.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your state privacy rights. Except to the extent permitted by the Applicable Laws, we will not:

  • Deny you goods or services.
  • Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
  • Provide you a different level or quality of goods or services.
  • Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Changes to This Notice

We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will notify you by posting the updated Notice on our website homepage. Please be sure to check back periodically for any updates.

How to Contact Us

If you have any questions or comments about this Notice, our Privacy Policy, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under the Applicable Laws, please do not hesitate to contact us at:

Phone: 877-287-3831

US Mail:
Freddie Mac
Chief Privacy Officer
8200 Jones Branch Drive
McLean, Virginia 22102-3110

Or please contact us by sending an email to: [email protected]

Version Dated: January 1, 2023

California Consumer Request Metrics