Before You Let an Appraiser Into Your House, Read Certification 25

WARNING. THIS IS NOT A CHANGE COMING SOMEDAY. It is already happening, and it may have already happened to you.

If you are not prepared for it, this can open you and everyone living in your home to a real privacy problem. Not a theoretical one. Photographs of your bedrooms, leaving your house, into systems you will never see. Everyone should read this, whether you own the home, rent it, or have family under your roof.

Since January 26, 2026, every lender in the country has been permitted to submit appraisals under the new UAD 3.6 standard. Fannie Mae's own announcement that day put it plainly: "All lenders are now permitted to submit UAD 3.6 appraisal reports to the Uniform Collateral Data Portal." Some lenders and some appraisers made the switch months ago. On November 2, 2026 it stops being optional and applies to all new submissions.

So the appraisal on your home, the one scheduled for next week, or the one that already happened this year, may well be under it. Every one from November 2 forward will be.

Under that standard the appraiser is required to photograph every bedroom in the house. Every bathroom. Every kitchen. Those images leave the property inside a file that can run 60 megabytes, and a line in that report says the parties who receive it may store, copy, reproduce, analyze, use and distribute the data for internal or external purposes.

Nobody who lives in the house signs that line. The appraiser signs it.

And note who this reaches. Not just owners. If you rent the home, or your parent lives there, or your adult child does, the photographs are of their rooms and their belongings too, and they are even further from the transaction than you are. Owner or occupant, the camera does not distinguish.

Here is the plain version of what changed, and what did not.

The provision is called Certification 25. It says the lender or client may disclose or distribute the appraisal to a long list of recipients: the borrower, another lender at the borrower's request, the mortgagee and its successors and assigns, mortgage insurers, government sponsored enterprises, other secondary market participants, data collection or reporting services, professional appraisal organizations, any department or agency of the United States, and any state or other jurisdiction.

That list is not new. I want to be fair about this, because it matters.

Word for word, that same list has been sitting in Certification 21 of the old Form 1004 since March 2005. If you have financed a home in the last twenty years, it already applied to your appraisal. Anyone telling you UAD 3.6 invented it is wrong, and you should discount the rest of what they tell you.

What is new is the sentence that follows it:

"Any of the foregoing persons or entities who receive this appraisal report may choose to store, copy, reproduce, analyze, use and distribute the data in the appraisal report for internal or external purposes without having to obtain the appraiser's or supervisory appraiser's (if applicable) consent."

The old certification governed who could receive the report. This one governs what they may do with the data once they have it. Store it. Copy it. Reproduce it. Analyze it. Distribute it. For internal or external purposes.

The old form said nothing about any of that.

So the fair question is not whether something was taken from homeowners this year. The fair question is what "external purposes" means, and who decides.

I am not claiming any particular use is happening today. I am saying the language is broad, it is new, it is live right now, and the people whose rooms are in those photographs are entitled to know what laws, contracts and policies actually limit it.

That question gets sharper when you see what UAD 3.6 actually transmits.

An appraisal is now delivered to the Uniform Collateral Data Portal as a ZIP package of up to 60 megabytes. Inside it: the structured XML data, a PDF of the report, and a folder named Images holding every associated photograph. Fannie Mae's own portal requirements spell this out, including that the images must sit in that dedicated folder rather than being embedded in the data file.

And the required interior photographs go further than most people expect. Fannie Mae's photo requirements job aid lists as required: all kitchens, all bathrooms, and the main living areas of the property, which it defines as including the living room, family room, dining room, and all bedrooms. Recent remodeling or renovation is required too. Below-grade rooms and accessory dwelling interiors are conditionally required.

All bedrooms. That is the part worth sitting with.

Photographs of every bedroom in a house will sometimes catch things that have nothing to do with what the home is worth. Family photographs. Medications on a nightstand. A laptop. A gun safe. Security equipment. Whatever your kids left on the floor that morning.

Most of us have already received a notice that our password, our card number or our medical record was exposed somewhere. Once a detailed visual record of the inside of a home exists across multiple institutional systems, the questions follow on their own.

Where are the photographs stored? Who can access them? How many copies exist? How long are they kept? Who may they be passed to? What happens if one of those systems is breached years from now?

There are legitimate reasons to collect and analyze much of this. Underwriting, fraud detection, appraisal review and collateral risk analysis are real functions that protect real people, borrowers included. Saying so is not a concession. It is just true.

It also does not answer the privacy question.

Now the part that matters most, and the part almost nobody is saying clearly.

Certification 25 is signed by the appraiser. Not by you, and not by whoever lives in the house.

It is a certification about the appraiser's consent. The appraiser is the one agreeing that no further permission needs to be sought from the appraiser. You are not a party to it, you do not sign it, and you do not waive anything through it. So it is not a homeowner consent form, and anyone framing it that way is overstating it.

That cuts both ways, and here is the uncomfortable half.

It also means the person whose house it is, whose door was opened, and whose rooms were photographed is not at the table at all. Your existing protections still stand. Federal financial privacy law, data security obligations and your state's privacy statutes are not erased by a line in an appraisal form, and a certification cannot override a statute. But those protections live outside this document, and this document is the one setting expectations for an industry moving millions of home interiors into standardized, machine readable records.

The homeowner owns the house. The homeowner opens the door. The property generates the data.

Nobody living in that house is signing Certification 25.

So here is what I would actually do.

If you have an appraisal coming, ask your lender one question before it happens: is this appraisal being done under UAD 3.6? You are entitled to know, and the answer tells you which rules apply to the photographs of your bedrooms.

Then read Certification 25 yourself. You are entitled to a copy of your appraisal, and in most mortgage transactions secured by your home the lender is required to give you one. Read the certifications page at the back, not just the number on the front. If your appraisal was done earlier this year, go pull it and look.

Then ask the follow up: who receives my appraisal data, what are they permitted to do with it, how long do they keep it, and how is it protected?

You may get a good answer. You may get a blank stare. Either one tells you something.

I am a REALTOR and an Associate Broker, not an attorney, and this is not legal advice. It is a prompt to go read a document about your own home and ask a question you have every right to ask.

Where is all of this data going?

Thank you to Ryan R. Bailey, MRED, an Arizona certified general real estate appraiser, for bringing this to my attention. ryanrbailey.com

Sources, so you can check me rather than take my word for it:
Fannie Mae, "Available Now in Broad Production: UAD 3.6 and Forms Redesign," January 26, 2026
Fannie Mae UCDP FAQs, submission package contents and the 60 MB limit
Fannie Mae, UAD 3.6 Photo and Image Requirements job aid
Fannie Mae Form 1004, March 2005, Appraiser's Certification 21
Fannie Mae and Freddie Mac UAD 3.6 FAQs, November 2, 2026 mandate
Discussion of Certification 25 at appraisersblogs.com, and Voice of Appraisal E276: https://youtu.be/mwfGFSe3oGo
Ryan R. Bailey, MRED, ryanrbailey.com

Jon Hegreness, REALTOR / Associate Broker, Howe Realty
(623) 826-0888 / JonHegreness@gmail.com / License BR540940000
9059 W Lake Pleasant Pkwy, B-200, Peoria, AZ 85382
previewarizonahomes.com