If an institution purchases mortgage leads or uses a process to collect names, email addresses, and phone numbers would the people whose information was purchased or collected be covered by the institutions privacy policy? I.e. if the info was going to be shared with another party for their own marketing would an opportunity to opt out be in play?

It is unclear to me because the definition of consumer under the privacy reg seems to require that the consumer has initiated some sort of transaction or applied for something which these people have not.

If an institution purchases mortgage leads

I would be much more concerned with the RESPA Section 8 implications.

I get where you are coming from but assuming those implications had already been addressed or are at least being worked through and working down the list to implications under other regulations I have arrived at the privacy question.

I suspect the privacy policy wouldn't cover these individuals and any opt out from sharing would be odd because these people don't even know the bank has their information.