Certified Information Privacy Professional (CIPP): US Telephone Consumer Protection Act TCPA Robocalls Text Messages

CIPP/US – Telephone Consumer Protection Act (TCPA) – Robocalls & Text Messages

What This Is

The TCPA (47 U.S.C. §§ 227 and 227b) is a federal statute that restricts telemarketing calls, prerecorded messages, and automated text messages sent to U.S. consumers. It requires prior express written consent for most outbound calls/texts and gives consumers the right to block calls via the National Do‑Not‑Call Registry.

Real‑world scenario: A U.S. retailer launches a “Flash Sale” campaign and uploads a list of 200,000 phone numbers to an autodialer to deliver a prerecorded promotional message. Because the retailer never obtained written consent from those consumers, the FCC and FTC can impose statutory damages of up to $1,500 per illegal call—potentially a multi‑million‑dollar exposure.

Key Terms & Provisions

• Autodialer (or “Automatic Telephone Dialing System” – ATDS): Any equipment that can store or produce a telephone number and dial it automatically, or that can produce a prerecorded voice message. The FCC’s 2021 definition includes “predictive dialers” that place calls before a live agent is available.
• Prior Express Written Consent: The consumer must sign (physically or electronically) a clear, conspicuous agreement authorizing the specific type of call or text (e.g., “I consent to receive promotional SMS from XYZ”). Consent must be written, not merely oral or implied.
• Do‑Not‑Call (DNC) Registry: A national list maintained by the FTC. Telemarketers must scrub outbound call lists against the DNC at least every 31 days and must honor any consumer’s request to stop receiving calls within 30 days.
• Statutory Damages: The TCPA allows a private right of action for $500 per violation, which the court may increase to $1,500 per willful or knowing violation. Each call or text counts as a separate violation.
• Robocall Rule (FCC): The FCC’s 2021 “Robocall Enforcement” rule requires carriers to block calls that appear to be illegal and imposes steep penalties for non‑compliant carriers.
• TRAC Act (2019): The “Telephone Robocall Abuse Criminal Enforcement and Deterrence” Act criminalizes willful violations of the TCPA, adding up to 5 years imprisonment and fines up to $500,000 for repeat offenders.
• Text Message Exception – “Informational” Calls: Non‑marketing texts (e.g., appointment reminders, shipping updates) are permissible without prior express written consent if they are purely informational and the consumer has provided a phone number for that purpose.
• State‑Level Preemption: Many states have their own telemarketing statutes (e.g., California’s Rosenthal Act). The TCPA preempts state law only when the state law is less protective; more protective state statutes remain enforceable.
• Emergency Calls & Political Calls: Calls made for emergencies, health‑care notifications, or political/charitable purposes are exempt from the prior‑consent requirement, but they still must not use an autodialer to deliver a prerecorded message without consent.
• Opt‑Out Mechanism: Every telemarketing call/text must provide a clear, easy way for the consumer to stop future messages (e.g., “Press 1 to opt out”). The opt‑out must be processed within 30 days and the consumer’s request must be honored for at least 30 days thereafter.

Step‑by‑Step Process Flow (Compliance Checklist)

1. Identify the Campaign Type – Determine whether the outreach is marketing (requires consent) or informational (may be exempt).
2. Inventory the Dialing Technology – Confirm if the system qualifies as an ATDS (autodialer). If yes, treat every outbound call/text as a TCPA‑regulated transmission.
3. Obtain & Document Prior Express Written Consent – Capture consent via signed paper forms or electronic signatures (e‑signature records must include the date, the consumer’s phone number, and the specific purpose).
4. Scrub Against the National DNC List – Run the consumer list through the FTC’s DNC database at least every 31 days; remove any numbers that are on the list or have opted out.
5. Implement an Opt‑Out Mechanism – Embed a “reply STOP” or “press 1 to opt out” option in every message; log opt‑out requests and suppress those numbers for 30 days (or longer if the consumer requests).
6. Monitor & Document – Keep detailed logs of each call/text (date, time, number dialed, consent status, opt‑out status). Conduct periodic audits to ensure compliance and be ready for FTC/FCC investigations.

Common Mistakes

CIPP Exam Insights

1. ATDS Definition is a “yes/no” test – The exam often asks whether a particular technology (e.g., a predictive dialer) qualifies as an autodialer. Remember the FCC’s 2021 definition: any device that can store a number and dial it automatically, or produce a prerecorded voice.
2. Consent Must Be Written, Not Implied – A frequent trap is confusing “opt‑in” (required) with “opt‑out” (allowed for certain non‑marketing calls). For TCPA‑covered marketing calls/texts, prior express written consent is mandatory.
3. Statutory Damage Calculation – The exam may present a scenario with multiple illegal calls. Recall: $500 per call (or $1,500 if the violation is willful/knowing). Multiply by the number of calls/texts to get the exposure.
4. FTC vs. FCC Jurisdiction – The FTC enforces the TCPA’s consumer‑protection provisions (including private right of action), while the FCC enforces carrier‑level rules (e.g., the Robocall Rule). Knowing which agency handles which aspect can be tested.

Quick Check Questions

1. Scenario: A health‑clinic sends appointment reminders via SMS to patients who have provided their mobile numbers during registration. No marketing language is included.
   Answer: Permissible – The messages are purely informational; no prior express written consent is required under the TCPA.

2. Scenario: A political campaign uses a predictive dialer to deliver a prerecorded “Vote for Candidate X” message to 10,000 phone numbers. No consent was obtained.
   Answer: Violation – Even political calls must not use an autodialer to deliver a prerecorded message without prior express consent; each call could incur $500–$1,500 in damages.

3. Scenario: A retailer sends a promotional text (“20% off today!”) to a list of numbers that were previously opted‑in for email newsletters but never signed a consent form for SMS.
   Answer: Violation – Prior express written consent for SMS is missing; the retailer is liable for statutory damages per text sent.

Last‑Minute Cram Sheet (10 One‑Liners)

1. TCPA § 227(b) – Autodialer definition – Any device that stores numbers and dials automatically or plays a prerecorded voice. ⚠️ If you’re unsure, assume “yes.”
2. Prior Express Written Consent – Must be signed (paper or e‑signature) and specific to the type of call/text.
3. Statutory damages: $500 per violation; $1,500 if willful/knowing.
4. DNC Scrub Frequency: Every 31 days; failure = additional violations.
5. Opt‑Out Deadline: Must process STOP requests within 30 days and honor them for at least 30 days thereafter.
6. TRAC Act (2019): Criminal penalties up to 5 years imprisonment and $500,000 fine for repeat TCPA violators.
7. FTC vs. FCC: FTC handles consumer‑action and private lawsuits; FCC enforces carrier‑level “Robocall Rule.”
8. Exempt Calls: Emergency, health‑care, political, charitable – but still cannot use an ATDS for a prerecorded message without consent.
9. Text Message Exception: Purely informational texts (e.g., shipping updates) are exempt; any promotional content triggers consent.
10. State Preemption: TCPA preempts only less protective state laws; more protective statutes (e.g., California’s Rosenthal Act) remain enforceable.

Keep this sheet handy on exam day—each bullet is a potential multiple‑choice stem!