Why do VOW passwords expire

VOW passwords expire because the licence behind the data demands it. Boards attach a maximum password lifetime to the VOW feed — 90 days under TRREB’s terms, 30 days on Vancouver’s tri-board MLS®, as of mid-2026 — so that access to sold and off-market data remains tied to a live broker–consumer relationship instead of quietly becoming a public database with a login page in front of it. The expiry isn’t your website being forgetful. It’s a compliance feature, and a board audit expects to find it working.

The rule, and where it comes from

The cap is a condition of the VOW framework itself. When sold-price display was established in Canada, the permission came shaped as the Virtual Office Website: a member’s site may show registered consumers the gated layer because those consumers have entered a broker–consumer relationship through the VOW agreement’s terms. A password that never expired would let that relationship decay into an open key — registered once in 2019, browsing sold prices forever. Time-limiting the credential forces the relationship to be re-affirmed on a schedule, which is the difference, in the boards’ eyes, between a brokerage serving its clients and a data republisher. The number itself is board-specific licence text, which is why it differs across markets and why an operator can’t round it up.

What expiry protects, concretely

Three things. First, the meaning of registration: the VOW’s legal footing is that gated data flows inside a broker–consumer relationship, so the credential proving that relationship has to be demonstrably current. Second, the data’s boundaries: expiring credentials shrink the window in which a shared or leaked login can feed scrapers and resellers — the redistribution the terms of use prohibit. Third, the audit trail: boards can and do review VOW operations, and password lifecycle is one of the checkable lines in the VOW compliance checklist — registration records are retained even after the password lapses, so expiry removes access without erasing the history the rules require you to keep.

What actually happens at day 90

Expiry re-locks the gate; it doesn’t delete the person. The account remains, the saved homes remain, and the site simply stops serving sold and off-market data until the visitor re-verifies. The implementation gap between platforms is wide, and it’s where the consumer annoyance comes from. The bad version treats expiry as an error: the visitor is dumped to a generic login, fails, resets, sometimes re-registers from scratch — and often just leaves. The good version treats it as lifecycle: warnings before the boundary, a re-verification step measured in seconds — ours emails a one-time code, confirms, and unlocks — and continuity for everything the visitor built up. Same rule, completely different retention curve. One more operational detail matters: the expiry event itself belongs in your records. A board reviewing a VOW wants to see that passwords actually lapse on schedule and that renewals are real verifications rather than silent extensions — so the lifecycle should leave an audit trail, not just a smooth user experience.

The lead-side view for agents

Here’s the reframe worth internalizing: mandatory re-verification is a compliance rule that behaves like a touchpoint. Every expiry is a moment your site legitimately re-engages a property watcher who registered a season ago — the kind of long-cycle researcher that VOW registration turns into pipeline in the first place. Handled badly, the rule sheds exactly those leads; handled well, it resurfaces them quarterly with their saved history intact. When you evaluate a VOW platform, skip the abstract compliance talk and ask the operational question: what exactly does my visitor see on day 91? The answer tells you whether the vendor has treated the boards’ rule as a nuisance or designed for it.