State Privacy Notice for Residents of California, Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia

This PRIVACY NOTICE FOR RESIDENTS OF CALIFORNIA, COLORADO, CONNECTICUT, MONTANA, OREGON, TEXAS, UTAH, and VIRGINIA (“Notice”) supplements the information contained in the Privacy Policy of the FEDERAL HOME LOAN MORTGAGE CORPORATION ("Freddie Mac," "we," "us," or "our") and applies solely to those individuals who have consumer privacy rights under the following laws ("consumers" or "you"): the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (together "CCPA"), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Montana Consumer Data Privacy Act (“MTCDPA”), the Oregon Consumer Data Privacy Act (“OCDPA”), the Texas Data Privacy and Security Act (“TDPSA”), the Utah Consumer Privacy Act (“UCPA”) and the Virginia Consumer Data Protection Act (“VCDPA”).

Definition of Personal Information

We collect certain "personal information" from consumers. For purposes of this notice, personal information is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

“Sensitive personal information” is a subcategory of personal information. It includes information that reveals a consumer’s racial or ethnic origin, religious beliefs, mental or physical health history or condition, sex life or sexual orientation, citizenship, or immigration status, genetic or biometric data used to identify an individual, precise geolocation data, and data of a child. Freddie Mac only processes sensitive personal information of consumers as permitted by state law.

What Personal Information We Collect

Much of the personal information that Freddie Mac collects and processes is exempt from state law requirements. For example, personal information that we collect in connection with purchasing and securitizing residential mortgages from financial institutions is not subject to the rights described in this notice. The personal information we collect and process not subject to an exemption is listed in the table below. As you review the table please note:

• Some personal information included in one category may overlap with other categories.
• We do not knowingly sell or share the personal information of consumers under 16 years of age.

Categories of Sources

We obtain the categories of personal information listed above:

• from the companies from which we buy or consider buying loans (our “customers”) or their agents, from our loan servicing agents and from our service providers in connection with the purchase and securitization of loans and the resecuritization and sale of such securities.
• from our Seller/Servicers and other entities that sell or seek to sell us mortgages or to have us securitize their mortgages.
• from credit bureaus and other vendors who provide credit and other background information on individuals for credit and due diligence purposes.
• from you when you provide it to us (e.g., where you contact us via email or telephone, or by any other means) and from your activity on our website (for example, from submissions through our website portals or from automatically collected website usage details).
• from borrowers and loan applicants.
• from third parties from whom we obtain products or services.

How We Use Personal Information

We may use or disclose personal information we collect for one or more of the following business purposes:

• To fulfill a request or satisfy the reason for which the information is provided. For example, if a mortgage broker provides us with personal information in order for us to consider buying a loan, we use that information to assess the loan and, if we buy it, to service it and securitize it.
• In connection with activities related to buying mortgages, securitizing them, and selling the securities (our secondary market-related activities). For example, we use personal information to evaluate loans that we are considering buying or guaranteeing and to monitor the performance of loans that we own or guarantee. As another example, we use this information to evaluate the value of properties collateralizing these loans and to predict default.
• To establish and manage our relationships with brokers, third party loan originators, and other entities with whom we conduct business, such as information about these entities’ employees, agents, principals, officers, and guarantors. This may include names, photographs/images, email addresses, phone numbers and other contact information for the employees of these entities with whom we are dealing.
• If you send us an email or message and provide your name or other personal information, we may use this information to research your question, to send an answer to your question and to deliver the requested information or service to you. We also may use this information to provide you with information in which we believe you will be interested; however, at any time, you may request that we stop doing this by contacting us in the manner described in the "How to Contact Us" section of this Notice.
• To provide our customers with email alerts, event registrations and other notices concerning our products or services, events, news, or other items that may be of interest.
• Regarding website visitor information, to measure the number of visitors to different pages on the website, conduct statistical modeling and evaluate, modify, and enhance our websites, services, and business. We also use this information to monitor network traffic and to identify unauthorized access or unusual activity on the website.
• For purposes of testing, research, analysis, modeling, and product development related to our public mission, business, and websites. We may publish the results of our research, but we will not publish personally identifiable information about you as part of the publication.
• To carry out our obligations and enforce our rights arising from any loan documents or other contracts we have entered, including for collections.
• To evaluate or conduct a restructuring, reorganization, or other sale or transfer of some or all our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
• As necessary or appropriate to protect the rights, property or safety of us, our customers, or others.
• As required by applicable laws, regulations and court orders, and requests from Congress, our regulators, or our conservator.
• To respond to law enforcement requests.
• For security or the prevention, detection, or investigation of fraud, suspected or actual illegal activity, or other misconduct.
• To establish or defend legal claims and allegations.
• To seek advice from lawyers, auditors, and other professional advisers.
• As described to you when collecting your personal information.

We disclose the following categories of personal information to third parties for a business purpose:

• Category A: Identifiers
• Category B: Personal information unique to individuals
• Category C: Protected classification characteristics
• Category D: Commercial information
• Category I: Professional or employment-related information
• Category J: Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C.§ 1232g, 34 C.F.R. Part 99))

Third Parties to Whom We Disclose Personal Information

We disclose your personal information to the following categories of third parties:

• Service providers.
• Third parties to whom you or your agents authorize us to disclose your personal information in connection with activities we perform or services we provide to you or in connection with your loan.
• Third parties who assist us with this or our other websites, or our applications. This may include information you provide as part of voluntary surveys about application or website-related issues taken while or after visiting the site.
• Third parties as part of our secondary market-related activities and other aspects of our business, including loan servicers, consumer reporting agencies, workout companies, attorneys, and technology providers who enable us or third parties to perform business, professional, and technical support functions for us or you. For example, we may disclose personal information to third parties to administer or protect our interest in a loan.

We also may disclose personal information to our regulators, our conservator and as otherwise required by applicable laws, regulations, and court orders.

Retention Period

We intend to retain your personal information for up to seven (7) years after we finish providing you services, complying with our legal obligations, resolving disputes, and enforcing our agreements.

Your Rights

Consumers have the right to access and control certain aspects of your personal information as described below.

Access to Specific Information and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of your personal information. Before we disclose information to you, we will ask you for information to verify your identity. Once we receive and confirm your verifiable consumer request, we will disclose to you, as applicable to your request:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting, selling, or sharing that personal information.
• Information about third parties to whom we disclosed that personal information.
• If we disclosed your personal information for a business purpose, the business purpose and the categories of personal information that each category of recipient received.
• The specific pieces of your personal information that we have about you.

We will provide this information in a portable and readily usable format.

Deletion Request Rights

You have the right to request that we delete personal information that we have about you. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. If we deny your deletion request, we will inform you and explain the basis for our denial.

Correction Request Rights

You have the right to request that we correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing. Once we receive and confirm your verifiable consumer request, we will correct your personal information in our records, unless an exception applies. If we deny your correction request, we will inform you and explain the basis for our denial.

Non-Discrimination

We will not discriminate against you for exercising any of your state privacy rights. Specifically, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you with a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
• Retaliate against you in your role as an employee, applicant, or independent contractor.

Right to Opt Out of Sale

You have the right to opt out of the sale of your personal information. Freddie Mac does not sell personal information of consumers for monetary consideration. However, certain disclosures of information that benefit Freddie Mac may be construed as a sale under state law. 

Right to Opt Out of Sharing with Third Parties for Cross-Context Behavioral Advertising, also Referred to as Targeted Advertising

We use cookies and other technology, such as the web browsers that are used to read our websites, to collect information and to track browsing activity over time and across third-party websites and to deliver targeted advertisements to you. You have the right to opt out of the processing of your personal information for targeted advertising. 

Right to Revoke Consent

If you have provided consent to our collection and use of certain information, you have the right to revoke your consent. Click on this link Revoke Consent and select the request type Revoke Consent.

How to Exercise Your State Privacy Rights

To exercise your rights to access, deletion, or correction of your information, you, or someone you authorize may submit a request to us by either:

• Calling us at 877-287-3831; or
• Clicking on this link Your Privacy Choices.

You may also make a request on behalf of your minor child.

You must describe your request with sufficient detail to allow us to properly understand, evaluate, and respond to it. We will only use personal information provided in a request to verify the requestor's identity or authority to make the request.

To exercise your rights to opt out of sale and processing for targeted advertising, you can opt-out of the use of third-party cookies for personalized advertising by setting your cookie preferences on our website, by adjusting your browser’s cookie settings, or by using an opt-out preference signal. 

Opt-Out Preference Signals

We have enabled the Global Privacy Control (“GPC”) on Freddie Mac’s websites to operate in a frictionless manner. If you download a browser or extension that supports the signal and then visit a Freddie Mac website, the website will automatically recognize the GPC as your request not to sell your personal information or share it for purposes of targeted advertising. When our websites recognize the signal, you will immediately have performance and targeting cookies blocked so that third parties cannot collect information about you on our websites to target advertising to you.

Verification of Consumer Requests

When you submit a request to us for access, deletion, or correction, we will seek to verify your identity by asking you to provide us with information that enables us to identify you, such as your email address or the last four digits of your social security number. We also may use a third-party verification provider to verify your identity. If you authorize someone to make a request on your behalf, we will both verify the identity of that person and that they have appropriate authority from you to make the request.

We will not disclose the information you have requested if we are unable to verify the identity or authority of the person making the request.

Response Timing and Format

We endeavor to respond to each verifiable consumer request within 45 days of its receipt. If we require more time, we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option.

Appeals

If we deny your request, you may have the right to appeal our decision. Click on this link Appeals and select the request type Appeal. We will respond to appeals from Virginia, Connecticut, Montana, and Texas residents within 60 days. We will respond to appeals from Colorado and Oregon residents within 45 days.

Changes to This Notice

We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will notify you by posting the updated Notice on our website homepage. Please be sure to check back periodically for any updates.

How to Contact Us

If you have any questions or comments about this Notice or the ways in which we collect and use your personal information, please do not hesitate to contact us at:

Phone: 877-287-3831

Email: [email protected]

Last updated: October 1, 2024

Metrics

California Consumer Request Metrics