Looking Ahead to 2024
States will continue to enact or update their mini-TCPA and consumer-protection laws involving telecommunications and marketing.
We expect lead generators and businesses that rely on lead generators to develop new policies and procedures to comply with the FCC’s new regulations requiring one-to-one consent for lead generation and comparison-shopping websites.
Appellate courts will begin to weigh in on data privacy litigation concerning websites’ use of session replay, a technology that businesses engaged in telemarketing rely on.
In the News
In 2023, the FCC amended the TCPA regulations involving the ability of consumers to consent to calls and text messages from multiple businesses at one time. This and other changes extending the DNC regulations to text messages were the most significant TCPA developments in 2023.
FCC Issues Significant Rule on TCPA Consent
On December 13, the FCC issued significant rulemakings concerning the TCPA, including on the method businesses must use to obtain consent. Specifically, the FCC approved a rule requiring so-called “terminating providers,” as that term is used in 47 C.F.R. § 64.1200(k) and (n), to “block all texts from a particular number or numbers when notified by the [FCC’s] Enforcement Bureau of suspected illegal texts from that number or numbers, unless a provider’s investigation shows the identified texts are legal.”
The FCC also amended the TCPA regulations, 47 C.F.R. § 64.1200, to now require businesses to obtain a consumer’s prior express written consent before placing calls and texts using an automatic telephone dialing system (ATDS), prerecorded message, or artificial voice “a single seller at a time.” The order enacting the rule also emphasizes that a consumer’s consent must follow a “clear and conspicuous disclosure” to the consumer that they will receive calls or texts from the seller and that the content of the subsequent calls or texts must be “logically and topically associated with the website where the consumer gave consent.”
In the same December order, the FCC amended 47 C.F.R. § 64.1200(e) to extend the TCPA’s existing DNC provisions to cover text messages such that a business “must have the consumer’s prior express invitation or permission before sending a marketing text to a wireless number in the DNC Registry.”
The FCC’s new rules on one-to-one consent are likely to significantly affect lead generation and comparison-shopping websites, as well as businesses through which a consumer may consent to receive calls or texts from multiple entities (such as affiliates). By the terms of the order, the amendment to the definition of prior express written consent (47 C.F.R. § 64.1200(f)(9)) will not become effective until 12 months after publication in the Federal Register, which has not yet occurred. The remaining amendments will be effective within 30 days of the order’s publication in the Federal Register.
2023 Litigation Highlights
The number of TCPA lawsuits was up overall from 2022 but still below pre-2021 levels. The states, however, continue to enact “mini-TCPA” laws of their own. And, as we predicted, in 2023, session replay software came into the crosshairs of plaintiffs’ attorneys purportedly seeking to enforce consumer privacy rights.
TCPA litigation was up slightly in 2023, with 1,324 actions filed between January 1, 2023, and September 30, 2023.1 This number is 13.1% higher than it was in 2022, but it is still below the numbers before Facebook, Inc. v. Duguid, 141 S. Ct. 1163 (2021), when there were 1,716 actions for the entire year of 2021 and more than 3,000 lawsuits in both 2020 and 2019. And it is significantly lower than the peak TCPA litigation year of 2016, in which 4,770 actions were filed. Despite the slight uptick from 2022, the relatively lower number of lawsuits suggests that the Duguid holding regarding the definition of an ATDS has indeed reduced the appetite of the plaintiff’s bar for these lawsuits.
Florida Clarifies Mini-TCPA Autodialer Confusion
In May 2023, the Florida governor signed into law an amendment to the Florida Telephone Solicitation Act (FTSA), Fla. Stat. § 501.059, to clarify certain ambiguities in the law. The May 2023 amendment primarily updates FTSA Subsection (8)(a) by updating its prohibitions to apply only to “unsolicited” sales calls and by changing the definition of “automated system” to more closely conform to the TCPA’s definition of an ATDS, as confirmed by the Supreme Court. The amendment also updates significant definitions related to securing prior express written consent for calls and adds new restrictions on commencing a lawsuit based on text message solicitations.
The addition of “unsolicited” to Subsection (8)(a) clarifies that the statute does not prohibit calls placed to a consumer (1) in response to an express request, (2) in connection with an existing debt or contract, (3) with whom the caller has an existing business relationship, or (4) by a newspaper publisher in connection with its business. Such restrictions now apply only to calls involving “an automated system for the selection and dialing of telephone numbers.” This change to the conjunction reduces the universe of possible telephony technology covered under the law and more closely matches the TCPA’s definition of an ATDS, which similarly requires the technology to first generate the telephone number and then dial the telephone number.
The amendment also restricts a plaintiff’s ability to seek damages for “text message solicitations.” Before filing such an action, “the called party must notify the telephone solicitor that the called party does not wish to receive text messages from the telephone solicitor by replying ‘STOP’ to the number from which the called party received text messages . . . .” The person or entity that was sending marketing text messages then has 15 days “after receipt of such notice” to “cease sending text message solicitations to the called party,” with the notable exception of a confirmation text. After responding “STOP,” the consumer may then bring an action under the FTSA only if “the telephone solicitor continues to send text messages to the called party 15 days after the called party provided notice.”
In general, these changes may scale back the significant uptick in litigation that we have seen under the FTSA since the law was overhauled in 2022 post-Duguid.
States Continue to Play a Role in Telemarketing Law Through Mini-TCPA Statutes
This year saw significant updates to other states’ mini-TCPA laws, including New York and Maryland. Also, consumer litigation in West Virginia showed the reach of existing consumer protection laws over marketing.
New York
In March 2023, an amendment to New York Gen. Bus. Law § 399-z went into effect that requires telemarketers to give customers the option to be added to a company’s internal DNC list at the beginning of a call, immediately after callers identify themselves. Then in September, a further update to the law became effective, raising the penalty for violating the statute (enforceable by the state) from up to $11,000 per violation to up to $20,000 per violation.
Maryland
On January 1, 2024, the “Stop the Spam Calls Act of 2023” became effective. The law prohibits certain caller ID-blocking technology and the use of prerecorded or artificial voice and automated systems to make solicitation calls without the prior express written consent of the called party. Notably, Maryland’s definition of “automated systems” is potentially broader than the definition of an ATDS under the TCPA, particularly because it defines an autodialer as any “automated system for the selection or dialing of telephone numbers.” The law also sets permissible “calling hours” to between 8 a.m. and 8 p.m. and establishes a cap on the number of calls per 24-hour period (three maximum), both of which are more restrictive than federal law, which allows calls until 9:00 p.m. and provides no cap on the number of calls.
We noted the trend of state mini-TCPA statues in our 2023 Year in Review (YIR), and given the strength of these changes, we anticipate further mini-TCPA updates in 2024, including from Michigan and other states.
Session Replay Technology Challenged
As Goodwin previewed in last year’s YIR, “session replay” technology has faced challenges from consumers alleging that the use of such technology violates their privacy. This technology is commonly used to validate TCPA consent obtained through a website.
Over the past several months, courts around the country — but predominantly in California, Pennsylvania, and Massachusetts — have seen an increase in litigation involving businesses’ use of session replay technology on their consumer-facing websites. This recent litigation trend has been driven by court decisions, not by any specific change to statutory frameworks. After a period of uncertainty, the law surrounding the applicability of wiretapping statutes to a website’s use of session replay for feedback on consumers’ experiences is still amorphous. Courts have differed in their approach to the necessary “injury” for Article III standing, what allegations are required for a plaintiff to have statutory standing under the various statutes, and the types of information protected by the statutes, among other issues. Inconsistencies in recent decisions from California, Pennsylvania, and Massachusetts federal courts have done little to clarify the law.
Notably, the challenges to session replay are being brought against the session replay providers themselves as well as the companies whose websites are alleged to be operating the third-party provider’s technology. These third-party liability cases allege that the websites “aid and abet” the session replay providers in illegally “eavesdropping” on consumer’s interactions with the website without the consumer’s consent.
The case law in this area continues to evolve, creating uncertainty in the short term. We expect lawsuits against consumer-facing websites alleging violations of various wiretapping and other privacy statutes over the use of session replay technology to continue in 2024 while the courts grapple with applying old statutes to new technology.
[1] Data as of September 2023, per WebRecon.
[View source.]
