State Consumer Privacy Act Laws - FAQ
Do you have any questions about your state’s consumer privacy law? You have come to the right place! Below are our state-required disclosures in an easy-to-read (and understand) Q&A format. So, let’s get to it.

For starters, which states have consumer data privacy laws?
California enacted the California Consumer Privacy Act (CCPA) in 2018, and Oregon enacted the Oregon Consumer Privacy Act (OCPA) in 2023. Those laws grant rights to residents of the respective states regarding their personal information. The following information is the privacy policy and Notice at Collection for Nationstar Mortgage LLC, d/b/a Mr. Cooper (“Mr. Cooper”).

Other states—including Colorado, Texas, Virginia, and several others—have enacted similar consumer data privacy laws. However, those states’ laws do not apply to financial institutions like Mr. Cooper, which are already required to comply with federal financial privacy laws. Therefore, this notice does not cover those laws and does not apply to residents of those states. If you live in any state other than California or Oregon, please click on the “General” tab at the top of the page for information about how we collect, protect, and use your information.
What information is covered by my state’s law?
Generally, state consumer data privacy laws cover personal information, which is anything that identifies, relates to, describes, or could be associated with you. Beyond your name, phone number, or email address, it includes the kind of device or which web browser you're using to read this. Personal information also includes biometric data, your geolocation, and even your perceived preferences.

There are exceptions to that coverage though. Any information that is publicly available through a government entity or mass media is excluded. As is any information Mr. Cooper has that is already covered by certain federal privacy laws. If you have a mortgage or an application with us, the information we have about you is protected under federal privacy laws—such as the Gramm Leach Bliley Act and the Fair Credit Reporting Act. It is therefore excluded from state privacy laws, and not covered by the disclosures below.
Do you have or use any of my personal information?
In order to conduct our business, we collect and process a variety of information about our customers and people who visit our website. Which information we collect and process depends on how you interact with our website. For example, whether you input your personal information into a webform to receive information about mortgage financing options. But in general, we may collect and process: name, phone number, email address, mailing address, approximate location, technology habits (e.g. what browser you use, if you are using a tablet or mobile phone, and internet activity), and commercial information like the products/services you’ve purchased from us.

Below are categories of personal information we collect, process, and disclose, and the business purpose(s) for how we use it:
Category of Personal Information
Business Purpose(s)
Identifiers (name, address, email, etc.)
Providing financing decisions; protecting against fraud; marketing and advertising; monitoring website performance; debugging website
Sensitive information (Social Security Number and bank account numbers)
Protecting against fraud and providing financing decisions(We do not collect, process, or disclose your sensitive personal information for any other purposes.)
Commercial info (products/services considered or obtained)
Marketing and advertising
Internet activity (browsing history and interactions with our advertisements)
Providing online products and services; marketing and advertising; monitoring website performance; debugging website
Geolocation data
Detecting security incidents or fraud; monitoring website performance; debugging website
Professional or employment-related information
Providing financing decisions
Inferences about your consumer preferences
Providing financing decisions and marketing and advertising
Note: Mr. Cooper is a financial institution and does not sell the personal information of minors. Additionally, Mr. Cooper does not collect or process “sensitive data” as that term is defined in the Oregon Consumer Privacy Act.
How do you collect personal information?
We collect information from a variety of sources. For individuals who are not our customers, we gather information from cookies, webforms, advertising networks, and other online tools and technology. However, we only identify you by name when you submit a webform with your personal information or sign in to/register for your Mr. Cooper online account. In other words, we collect some information about our anonymous website visitors, but we do not attempt to identify anonymous visitors by name or profile.

Additionally, if you decide to have your credit report pulled as part of the prequalification process, we collect information about you from the credit reporting agencies.
So, what do you do with this personal information?
We primarily use and process personal information to provide mortgage financing and offer you relevant financial products and services. This information helps us make decisions about your financial needs, protect you and us against fraud, and provide you with a better digital experience when you use our mobile app or websites.
With whom do you disclose my personal information?
We disclose information to web developers, data analytics providers, and web performance monitors. We do so to understand how our website is performing, identify problems, make improvements, and deliver a better customer experience. Additionally, as mentioned above, if you decide to have your credit report pulled as part of the prequalification process, we disclose your information to credit reporting agencies to confirm your identity and access your credit report.
Do you sell/share information?
In some circumstances, we share personal information, such as commercial info, internet activity, and inferences, with advertising and social media services to deliver personalized advertisements that are relevant to our website’s visitors. Under California’s and Oregon’s laws, this is considered “selling” or “sharing”, and you have the right to opt out by following the instructions below.
Can I ask you not to use my information for advertising? (Opt-out Preference Signal)
You have the right to opt out of selling, sharing, and processing of personal information for targeted advertising purposes. You can opt out by clicking here, turning off the “Optional Cookies” category, and clicking the “Save Preferences ” button. After opting out, you may still receive advertisements while on our website that are created without the use or processing of personal information.

Additionally, this website honors browser-level opt-out preference signals in a frictionless manner for IP addresses originating from states covered by this state-specific Privacy Policy. If you already use you browser’s opt-out preference signal, you’ll know the website recognized your signal if you see this message when you first arrive on the website: “We’ve detected & honored your "Opt-Out Preference Signal".

If you want to use a browser-level opt-out preference signal, you’ll need to determine if your browser offers one. Most browser-level opt-out preference signals can be activated and deactivated through the Privacy or Security section of the browser’s settings menu.
What if my information is incorrect?
You have the right to request that we correct certain inaccurate personal information that we maintain about you. This is referred to as your “Right to Correct”.

You can submit your request to correct here. You can also call our Customer Service team at 833-685-2565 or chat with us.

Have other information to update? Click here to make changes to your contact information and notification settings.
Can I ask you to delete the personal information you have about me?
This is referred to as your “Right to Delete”. Businesses that collect personal information directly from consumers must delete such information upon request, unless the deletion request is subject to an exception or exemption.

Information we collect or process in connection with providing you a financial product or service, such as your mortgage, is exempt. That’s because your information is already regulated by federal law, and we leverage administrative, physical, and technical methods to safeguard this information.

And even if you’re not a customer of ours, we may need to keep some of your information to complete a transaction, prevent or detect fraud, or comply with a legal obligation. While we may not delete your information, we will always use it for a lawful purpose that aligns with what you would expect given your relationship with Mr. Cooper.

You can submit a Deletion Request here, chat with us, or call our Customer Service team at 833-685-2565.
Can I request a copy of what you’ve collected or processed?
In some cases, yes. This is referred to as your “Right to Know”. But like we mentioned above, most of the information that we collect or process in our role as a financial institution is exempt. As such, we won’t include any of that information in your Right to Know response, but we may have other information that is not exempt.

You can submit a Right to Know Request here, chat with us, or call our Customer Service team at 833-685-2565.
Can I mail in my request?
Unfortunately, no. We have two designated methods for submitting your verifiable consumer request, but we do not currently accept requests via U.S. mail. This is to protect you—and us—from fraudulent activity.
Can my authorized agent submit a request on my behalf?
Yes. In order to process a request through an authorized agent, we will need: (1) written evidence of the agent’s authority and (2) personal information of the authorized agent for verification purposes. Written evidence can include a power of attorney.

Note that the written authorization must be signed by the consumer about whom the request is submitted, notarized, and in compliance with any other requirements under state law.
When Mr. Cooper receives a request, how does it verify the request?
We encourage our mortgage customers to sign in to their online account before submitting a request. Signing in before submitting the request acts as a verification process and will help protect our customers from fraudulent requests.

For non-customers and customers who do not want to sign in to their online accounts, we collect personal information that will help verify the person making the request. We leverage a third-party identity verification service that permits us to cross-check your personal information against a database to ensure that the information supplied is valid and accurate. We will require at least the following information to verify a request: name, home address, phone number, email address, and the last four digits of your Social Security Number or date of birth.
Where can I read more about Mr. Cooper’s privacy practices?
You can learn more about our privacy practices here. You can also chat with us or call us at 833-685-2565 if you have any questions or concerns.
What else should I know?
You should know that no business can discriminate against you for exercising your consumer data privacy rights. You should not receive higher pricing or lower levels of service merely because you opted out of information collection, sharing, or processing or because you submitted a Right to Know, Right to Delete, or Right to Correct request.