On October 2, 2019, California Governor Gavin Newsom signed Senate Bill 208 (“SB 208”), the Consumer Call Protection Act of 2019. The law seeks to protect consumers from fraudulent robocalls. SB 208 adds Section 2893.5 to the Public Utilities Code, which requires telecommunications service providers, on or before January 1, 2021, to implement Secure Telephone Identity Revisited (STIR) and Secure Handling of Asserted information using toKENs (SHAKEN) protocols, or comparable or superior alternative technology, to verify and authenticate caller identification for calls carried over an internet protocol network. A “good faith effort” to comply with this requirement will be a defense to a claim for violating Section 2893.5.

SB 208 also authorizes the Public Utilities Commission and the Attorney General (AG) to bring an action pursuant to Telephone Consumer Protection Act, 47 U.S.C. § 227 (TCPA). The Commission may, at the request of the AG, work with the AG to enforce subdivisions (e) and (g) of Section 227 of the TCPA.

The law does not require a telecommunications service provider to employ call block, does not limit any rights otherwise permitted by law and does not otherwise expand the Commission’s power.

There is not yet a federal regulatory scheme set up to ensure that companies are deploying the STIR/SHAKEN framework. It remains to be seen whether other states will follow California’s footsteps, and, if so, whether a variety of state regulatory schemes will create a complicated compliance regime for companies doing business throughout the country.

Before January 1, 2021, telecommunications service providers doing business in California should work with relevant vendors to make sure that they implement STIR/SHAKEN protocols, or other comparable technology. Given that the new law allows the AG to call upon the Public Utilities Commission to help enforce Section 227(e) and (g) of the TCPA—which provide for forfeiture and civil penalties—companies can expect to see increased TCPA enforcement attempts.