 | > Connexions > AMC Guide > OREP E&O ★★★★★ “They are knowledgeable, professional, and understand urgency.” – Joe Thweatt |
>> Learn the UAD 3.6 Cheat Code with AppraisalPilot’s webinar next week. Find out how you can say YES to UAD 3.6 orders and ensure your reports come out clean. Click Here to Sign Up!
Certification 25: The 20-Year Fight Over Who Gets to Use Your Data
by Isaac Peck, Publisher
There’s a growing controversy about the new Certification 25 on Fannie Mae and Freddie Mac’s UAD 3.6 appraisal report. Starting in late September 2026, the debate has moved from a podcast episode to the blogs to just about every appraiser forum.
The clock is ticking. UAD 3.6 becomes mandatory on Nov. 2, 2026, with a one-time exception that lets lenders who request it keep submitting legacy 2.6 reports through May 19, 2027. After that, every appraisal delivered to Fannie Mae or Freddie Mac carries this certification.
The criticisms of Certification 25 so far break into two categories. One is about consumer privacy and appraiser liability: Once the report leaves the appraiser’s hands, interior photos and property data can be copied and redistributed indefinitely, and the homeowner never agreed to any of it.
The other argues that signing Certification 25 puts appraisers in violation of USPAP’s Confidentiality section.
Here’s a historical view on the language in the new Certification.
Two Certifications, Side by Side
Let’s start with Certification 21 from UAD 2.6, which appraisers have signed on every 1004 since the forms became mandatory on Nov. 1, 2005:
(UAD 2.6) 21. The lender/client may disclose or distribute this appraisal report to: the borrower; another lender at the request of the borrower; the mortgagee or its successors and assigns; mortgage insurers; government sponsored enterprises; other secondary market participants; data collection or reporting services; professional appraisal organizations; any department, agency, or instrumentality of the United States; and any state, the District of Columbia, or other jurisdictions; without having to obtain the appraiser’s or supervisory appraiser’s (if applicable) consent. Such consent must be obtained before this appraisal report may be disclosed or distributed to any other party (including, but not limited to, the public through advertising, public relations, news, sales, or other media).
Now let’s look at UAD 3.6’s Certification 25, which opens with the same list of recipients.
(UAD 3.6) 25.: The lender/client may disclose or distribute this appraisal report to: the borrower; another lender at the request of the borrower; the mortgagee or its successors and assigns; mortgage insurers; government sponsored enterprises; other secondary market participants; data collection or reporting services; professional appraisal organizations; any department, agency, or instrumentality of the United States; and any state, the District of Columbia, or other jurisdictions. Any of the foregoing persons or entities who receive this appraisal report may choose to store, copy, reproduce, analyze, use and distribute the data in the appraisal report for internal or external purposes without having to obtain the appraiser’s or supervisory appraiser’s (if applicable) consent. Consent must be obtained before this appraisal report may be disclosed or distributed to any other party (including, but not limited to, the public through advertising, public relations, news, sales, or other media). A person or entity who receives a copy of an appraisal report does not become an intended user, unless the appraiser identifies such person as an intended user. The appraiser and supervisory appraiser (if applicable) shall have no liability for any use of this appraisal report not related to the mortgage finance transaction and related activities for which this appraisal report was prepared.
The bolded section is what has some appraisers up in arms.
Read the verbs in that first sentence. Store, copy, reproduce, distribute. Those are the rights the Copyright Act reserves to the owner of a work: reproduction and distribution.
“Use… for internal or external purposes” goes further. It reads as if written to capture any non-copyright claims an appraiser might have left to protect their work product: such as breach of an implied contract, unjust enrichment or misappropriation.
So, one way to read this new Certification is that the GSEs are writing themselves a license to use the data as they see fit and put an end to the copyright debate that has long simmered within the appraisal community.
The 2005 Debate
There’s a 20-year backstory and a long-running debate around this copyright issue that many appraisers may not recall.
As Fannie Mae’s 2005 forms were about to go into use, Working RE published a piece by Denise Siegel that called item 21 “one of the biggest concerns for appraisers” and the list of recipients “mind-boggling.”
Her questions are the ones appraisers are asking again this month, more than 20 years later. She wrote: “How will the general public feel about their home information being given out to telemarketers or other data collection agencies? How will non-disclosure states see this issue? Will your client be charging a fee to supply that report to another party? How will your errors and omissions carrier feel about liability?”
Sound familiar?
On Nov. 17, 2005, a la mode published an article on its blog titled “Fannie Mae’s new URAR Appraiser’s Certification doesn’t force you to give up your ownership rights.”
At the time, there had been a massive debate amongst appraisers around why the GSEs would add the caveat that the lender/client “may disclose or distribute” the appraisal report to the list of usual suspects.
a la mode’s blog argued that the 2.6 language of “disclose or distribute” did not mean that appraisers were giving up “the right not to have their work inputted into a collateral database by data collection or reporting services.” In other words, the lender disclosing or distributing the appraisal report to a third party did not change the fact that the appraiser owned the intellectual property of the report and had control over “who can use the report for what purpose.”
The certification was not an express written agreement, a la mode argued, so the client got what clients had always gotten from an appraiser: a limited-use license tied to the mortgage transaction. If appraisers wanted to sign those rights away, a la mode suggested they ought to be paid more for it.
That same fall, Working RE also ran a piece by Tim Vining, MAI, about an Oct, 3, 2005 federal judgment in the Eastern District of Washington enjoining the defendants from copying or making unauthorized use of his copyrighted appraisal reports, in which a la mode’s corporate counsel, Jennifer Sides, made the same point: The recipient never owns the work; it holds a license to use it for the intended, limited purpose.
(story continues below)
(story continues)
Copyright Debate
Copyright protects original expression, which in an appraisal report might mean the narrative, the reconciliation, the photographs and the report as a whole.
Copyright does not protect facts or discrete data points. Square footage, year built, room counts, lot size, roof material and the comps’ addresses and sale prices are facts, and anyone with a lawful copy of the report would have a decent legal argument that they can use them.
The gray area is the appraiser’s judgment expressed as data: the value conclusion, the adjustments, the condition and quality ratings. Courts have protected professional estimates in some cases (the Red Book used-car values in CCC v. Maclean Hunter, for one) and declined to in others.
A reasonable reading would be that the appraiser’s claim is strongest on the photos and narrative, debatable on the opinions and weakest on the facts, and the facts are most of the several hundred data elements in a 3.6 report. Any appraiser who has completed a UAD 3.6 report might agree that the GSEs have done a lot to reduce subjective narratives and opinions and have turned much of the report into a fact-based data collection exercise, i.e. more dropdown menus and fewer written narratives.
Let’s be honest, though: The GSEs have been building databases on appraisal data for 15 years, running AI models on appraisers’ photos, reading and categorizing appraisers’ narratives and otherwise doing whatever they like with appraiser data.
Revisiting Floor Plan Litigation
Appraisers may remember the floor plan lawsuit that ran from 2018 to 2025. A Missouri home designer, Designworks Homes, discovered that real estate agents had drawn floor plans of houses built from its copyrighted designs and put them in resale listings. It then sued the brokerages for copyright infringement. The Eighth Circuit initially sided with the designer in 2021 on a narrow point, holding that floor plans don’t fall under the Copyright Act’s exception for pictures of buildings. When the brokerages asked the Supreme Court to take the case in 2022, NAR and 17 other organizations filed a brief on their side, among them the Appraisal Institute, the American Society of Appraisers, REVAA, Clear Capital, CubiCasa, Zillow, Redfin and CoreLogic (now Cotality) and the owner of a la mode. The Court declined, and the case went back to the trial court on fair use. In January 2025, the Eighth Circuit ruled that the agents’ floor plans were fair use: they served an informational purpose the original designs did not, and they did nothing to hurt the market for the designs themselves.
An appraiser suing a GSE over the use of a report would run into the same defense. The GSE would say pulling data out of an appraisal to run a model is informational and doesn’t compete with the report; the appraiser would answer that a model trained on appraisals is built to replace appraisals. Designworks spent nearly seven years and two trips to the Eighth Circuit losing that kind of fight.
Certification 25 means the GSEs can stop worrying about having to make that argument at all. By writing themselves a license inside a document the appraiser “certifies and agrees” to, they also supply exactly the express written agreement a la mode said was missing back in 2005. Taking the historical view, they are just cleaning up the paperwork for what they’ve been doing since UCDP went live in 2011.
The only silver lining here is that the GSEs have specified that recipients do not become intended users and stipulated the appraiser has no liability for uses unrelated to the mortgage transaction. The liability language is helpful, but by no means a “Get Out of Jail Free” card.
USPAP and Confidentiality
One of the arguments being raised is that signing Certification 25 puts an appraiser in violation of the Confidentiality section of the Ethics Rule.
The Ethics Rule says an appraiser must not disclose confidential information or assignment results to anyone other than the client, “parties specifically authorized by the client,” state appraiser regulatory agencies, third parties authorized by due process of law or a duly authorized professional peer review committee.
Desiree Mehbod, in a post on AppraisersBlogs titled “Cert 25 Dilemma: TAF Abdicates Its Role as Ethics Arbiter,” argues that the language under 2.6 was passive, and that the appraiser becomes an active participant under 3.6 by signing a statement about what recipients may do. There is also USPAP’s mandate that appraisers must take “reasonable steps to safeguard access to confidential information and assignment results by unauthorized individuals.”
The catch is that Certification 25 deals with individuals and organizations that are specifically authorized by the lender/client, which would be, by definition, authorized individuals.
The Appraisal Foundation (TAF) weighed in. In a written response that Mehbod posted, TAF said it cannot provide legal advice or interpret a lender’s privacy obligations, and that questions about the scope of Certification 25 belong with Fannie Mae and Freddie Mac. On USPAP, it wrote:
“Regarding USPAP, the Confidentiality section of the ETHICS RULE governs disclosures made by the appraiser. Providing the appraisal report to the client and any other intended users identified as part of the assignment does not, by itself, violate USPAP. A client’s subsequent disclosure or use of the report is not an action by the appraiser and is not governed by USPAP, although the lender/client may be subject to applicable federal or state privacy and data-protection requirements.”
Mehbod rebutted TAF’s statement, writing that Cert 25 “forces an appraiser to actively authorize the release of confidential data to non-intended users” and in doing so, creates “a direct violation of the USPAP Ethics Rule.”
The lender/client’s ability to “disclose or distribute” has not changed, though. The release of the appraisal report to non-intended users is built into Certification 21 that appraisers have been signing since 2005.
But in terms of USPAP specifically, TAF’s own reading of the ETHICS RULE is that it governs disclosures by the appraiser only, i.e. if the client decides to share the appraisal report with a third party, that’s the client’s decision.
(story continues below)
(story continues)
What Can Lenders Do With Appraisal Data
One of the concerns raised by Mehbod and other appraisers is: What happens if one of these data companies gets a hold of an appraisal and wants to sell the interior pictures of the home?
This would be a gross violation of the laws governing the lender — putting both the lender and the vendor in breach. Lenders are mired in some pretty steep regulations in terms of what they can do with that information, and any vendor they share that data with is held to those same standards.
The Gramm-Leach-Bliley Act (GLBA) bars lenders from sharing a consumer’s nonpublic personal information with nonaffiliated third parties unless the consumer has received notice and a chance to opt out. An appraisal obtained to make a loan is a good example of nonpublic personal information about the borrower.
The opt-out requirements don’t apply when the lender provides nonpublic personal information to a nonaffiliated third party (like a data collection company, etc.) to perform services or functions on its behalf, provided it gives the initial privacy notice and signs a contract barring the third party from disclosing or using the information other than to carry out those purposes.
For example, the lender cannot sell the contact information of a borrower unless the privacy notice disclosed the sharing and the borrower didn’t opt out (or, in California and Vermont, opted in). Likewise, a data vendor that gets the appraisal as the lender’s service provider cannot lawfully resell the homeowner as an alarm-company lead. By law, it may use the information only to carry out the purpose for which it was hired.
Two caveats to note here. First, the GSEs are not vendors in this sense. They receive the appraisal as a secondary market participant, which carries no contract requirement and covers a much broader purpose. The purpose limit still applies to them on paper; in practice they get to operate with almost no constraints.
Second, if you strip the property address and the name, GLBA stops applying. That’s how FHFA released an appraisal-level public file, and it’s how a model can be trained on millions of appraisals without a privacy notice or an opt-out.
Liability
At OREP Insurance, our view is that Certification 25 does not increase the chances of a claim against the appraiser, but it removes the appraiser’s “I didn’t authorize that specific use” defense, if a claim were ever to surface.
Keep in mind, though, that the lender/client has had the right to share your appraisal with the list of usual suspects for the last 20 years. OREP serves more than 10,000 appraisers per year, and in 20 years of claims we have not seen a single claim around this issue.
Nevertheless, here are two recommendations to protect yourself from this exposure.
- Add a line to your site-visit communications telling the homeowner that photos and property data become part of a report the lender may share with the GSEs and other third parties. Advise them to put away private documents and family photos before your site visit.
- Photograph the property, not the people in it. Be careful to avoid pictures of people, documents, family photos or any other private information. This is likely the best thing you can do to avoid a privacy claim.
On the insurance side, appraiser E&O policies generally include coverage for “personal injury,” and that definition typically includes invasion of privacy. But E&O coverage is built around claims arising from your professional services, not around privacy claims. A suit that alleged only a violation of a privacy law, with no negligent act or omission in the appraisal itself, would test the limits of OREP’s E&O policy as well as those of our competitors. Bottom line: there is not a clear path to coverage for these kinds of claim under appraiser E&O policies. (I reviewed 6 different appraiser E&O policies while preparing this article.)
If this issue is a serious concern for you, you might consider a separate cyber policy that includes explicit privacy and media liability coverage, and read how it defines a covered privacy event before you rely on it.
What Else to Watch For
First, Certification 25 doesn’t remove the appraiser’s copyright or intellectual property rights to the appraisal with respect to every single third party under the sun. Certification 25 is a limited release to third parties that the lender/client has specifically selected and authorized.
Furthermore, there are a host of other third parties that are continually angling to get their hands on the appraisers’ data. Think report software providers, appraiser portals and new appraisal “tool” developers.
Getting access to home property data, and the homeowner’s data itself, has long been a holy grail for many software companies.
Operating in both the real estate appraisal and the home inspection space, I have personally seen at least half a dozen software company acquisitions where big corporate or private equity will buy a software company and then roll out an “auto opt-in” feature that has the software user forced to “share” their data with the software company or sign away their privacy rights with the company.
Given that TAF has shared their view on whether Certification 25 violates USPAP, appraisers concerned about violating USPAP’s Confidentiality provision would do well to focus on the software they are using.
Confidentiality and privacy have obviously been a big concern with respect to new AI tools like ChatGPT or Claude, where the consumer versions train on your chats unless you go into the settings and turn training off. But the idea of software training on your data or “monetizing” your data applies to your appraisal software and any tool you’re using to run your business.
One case in point: If you’re using ChatGPT or Claude on assignment work, use a business-level account, meaning Team, Business or Enterprise. In my view, that’s the only setup that lets you show you took reasonable steps. Business accounts don’t train on your data by default and come with contractual confidentiality terms. Consumer accounts, even paid ones, give you a privacy toggle and a consumer privacy policy, which is a thin record to stand on if a state board ever asks what you did to protect confidential information.
Software companies and any other business that comes by the appraiser’s data through means other than receiving it from the lender arguably have much greater carte blanche with that data. They are not bound by the lender’s service agreements, GLBA or much else.
In the home inspection space a few months ago, Working RE published “Data Wars: Big Money’s Race to Own Your Clients,” a story about Spectora, a home inspection software provider owned by two brothers that recently sold at a $110 million valuation. One of those brothers recently went on a podcast and explained that their “growth” pitch to private equity was “monetizing the homeowner” and how they painted a picture of growing to a $400 to $500 million company by selling the homeowner alarm systems, property insurance, home warranties, home renovation services and more. (You can read the full story here.)
With so many new report software providers entering the appraisal space this year, as well as a host of new appraisal tools, appraisers would do well to read the user agreements of those software companies and be wary of companies that might want to mine, analyze or use their data.
Certification 25 is a great example of the GSEs finally papering over the “copyright” debate that’s been hanging over their heads for the last 20 years, but, in my opinion, a bigger risk for appraisers is likely copyright abdication and confidentiality breaches hidden in the 50-page user agreements coming from their software vendors.
>>Learn the UAD 3.6 Cheat Code with AppraisalPilot’s webinar next week. Find out how you can say YES to UAD 3.6 orders and ensure your reports come out clean. Click Here to Sign Up!
About the Author
Isaac Peck is the Publisher of Working RE magazine and the President of OREP Insurance, a leading provider of E&O insurance for real estate professionals. OREP serves over 10,000 appraisers with comprehensive E&O coverage, competitive rates, and 14 hours of CE at no charge for OREP Members (CE not approved in IL or AK). Visit OREP.org to learn more. Reach Isaac at isaac@orep.org or (888) 347-5273. CA License #4116465.