On October 3, the Federal Communications Commission (FCC) released a Public Notice[1] seeking comment on the meaning of an “automatic telephone dialing system” or “autodialer” under the Telephone Consumer Protection Act (TCPA). The FCC’s move comes in the wake of a recent ruling by the U.S. Court of Appeals for the Ninth Circuit broadly construing the term, and effectively expanding the scope of the TCPA. The Ninth Circuit’s decision marked a split with other circuits that have considered the issue, which creates uncertainty for any businesses that send automatic text messages or calls. The FCC now requests public comment on several issues raised in the Ninth Circuit’s decision, including whether the statutory language of the TCPA is ambiguous, and which types of devices qualify as an autodialer under a proper reading of the statute.

Two weeks earlier, the Ninth Circuit reached its long-awaited decision in Marks v. Crunch Fitness, an appeal from a dismissed lawsuit against Crunch Fitness alleging violations of the TCPA. In filing the suit, the plaintiff Jordan Marks alleged that he had received three unwanted text messages from Crunch without his consent. The lawsuit also alleged that Crunch’s use of a third-party SMS marketing platform violated the TCPA by using an autodialer to send the messages.

Although the district court determined the SMS marketing platform used by Crunch was not an autodialer under the TCPA, on September 20^th the Ninth Circuit disagreed and vacated the decision. The Marks court also held that an autodialer under the TCPA could include any device that automatically calls or texts phone numbers from a stored list of phone numbers.[2] This broad interpretation expands the applicability of the TCPA, and puts many businesses located within the Ninth Circuit’s jurisdiction at risk of substantial fines—between $500 and $1,500 for every message or call—for failing to gain affirmative consent from recipients.

The Ninth Circuit’s ruling stands in stark contrast to the recent trend away from a broad application of the TCPA to modern technology.  The decision also signals a clear split from the narrow interpretations of an autodialer announced by the Third Circuit[3]  and D.C. Circuit[4] earlier this year. While the FCC has the power to overrule the Ninth Circuit’s interpretation, for now the ruling is legally binding precedent throughout the Ninth Circuit. This circuit split may also spark future interest from the Supreme Court, which could weigh in to push the broad interpretation of the TCPA on businesses across the country.

What are the important takeaways for businesses using this technology?

• Businesses will need to gain express consent for nearly any automated customer contact via phone call or text message. The consent should be documented.
• If using autodialer technology without documented consent, businesses will have to consider halting related promotional campaigns, or run the risk of large monetary penalties.
• For those outside of the Ninth Circuit’s jurisdiction, businesses should understand that the ruling offers an early warning that the TCPA is far from settled law, and could still have teeth in the future.
• There is still time to voice an opinion on this matter. The FCC is actively soliciting comments by October 17, 2018, with reply comments due by October 24, 2018.

Notwithstanding the Marks decision, the FCC’s request for comment signals its interest in intervening on the autodialer issue.  Although no specific timeframe for any FCC rulemaking exists, if the FCC issues new rules as expected, there could be another shift of the TCPA landscape across the country. For now, businesses must consider the potential risks associated with TCPA noncompliance, and plan their automatic messaging or calling campaigns accordingly.

[1]DA/FCC # DA-18-1014, available at https://www.consumerfinancemonitor.com/wp-content/uploads/sites/14/2018/10/DA-18-1014A1.pdf

[2] Marks v. Crunch San Diego, LLC, No. 14-56834 (9th Cir. 2018)

[3] Dominguez ex. rel. Himself v. Yahoo, Inc., 894 F. 3d 116, 120 (3d Cir. 2018)

[4] ACA Int’l v. FCC, 885 F.3d 687 (D.C. Cir. 2018)

Four months after the General Data Protection Regulation (GDPR) burst onto the data privacy scene in May, many businesses are still scrambling to meet the law’s extensive requirements. But now, there’s another looming deadline for many businesses. In June, the California State Legislature passed its own set of privacy regulations named the California Consumer Privacy Act of 2018 (“CCPA”). The CCPA restarts the compliance countdown for many affected businesses still reeling from the GDPR transition. While the CCPA is still being finalized (a technical corrections amendment was recently passed on August 31, 2018), here are six lessons learned from the GDPR compliance struggle that can save your business time and money as you prepare for the CCPA.

1. Compliance will take longer than you think.

Despite the two-year gap between passage of the GDPR and the May 25, 2018 effective date, surveys indicated that only about half of the businesses affected by the GDPR achieved compliance by the deadline. For many small and medium-sized organizations without mature privacy programs, full GDPR compliance can easily take six to eight months to complete. For larger businesses, or businesses with a high volume, complex data processing, the process can take even longer. Even though certain provisions of the CCPA are not slated to take effect until January 1, 2020, companies should begin developing CCPA-compliant protocols sooner rather than later to reach compliance before the deadline to avoid potential fines and lawsuits that could have been otherwise avoided.

2. Getting started early saves money later.

In addition to avoiding costly fines and lawsuits associated with violations of data privacy regulations, businesses that developed an early, intentional compliance strategy for GDPR preparation often reduced their overall transition costs. For example, organizations that gave their compliance team and legal counsel enough time to plan and implement appropriate compliance steps were more likely to avoid unnecessary and inefficient efforts that resulted from a rushed changeover. In addition, strategically planning future ad campaigns, apps, and products to meet GDPR or CCPA compliance standards can help avoid the need to make expensive modifications to these investments in the future.

3. Don’t assume you’re off the hook.

Just because your business isn’t based in the EU doesn’t mean you are free from the GDPR, and likewise, just because your business isn’t physically located in California doesn’t mean you can ignore the CCPA. Many affected companies made the mistake of assuming they didn’t have to worry about the GDPR until it was too late to reach compliance by the deadline. However, both the CCPA and GDPR extend to companies that are based outside of the borders of California and the EU, respectively. Make sure to review and verify the status of your business under the regulations to ensure that you aren’t at risk for regulatory investigations and lawsuits.

4. Confusion and uncertainty are expected.

Both the GDPR and the CCPA represent wholesale changes in data privacy regulation. As a result, some uncertainty and confusion surrounding the interpretation and enforcement of these new regulations is to be expected. This ambiguity lead some businesses to take the risky “wait and see” approach to compliance, without fully understanding the risks they were taking, and without realizing that they could be punished in the future for the time period during which they were intentionally noncompliant. But smart businesses aren’t taking any chances. By making good-faith efforts at achieving compliance on time (and being able to demonstrate those efforts to a regulatory authority), businesses can greatly reduce the risk of fines or lawsuits, even if they end up missing the compliance deadline.

5. Data subject rights are here to stay.

The GDPR and the CCPA define specific data subject rights that all covered businesses must be prepared to enforce. While each set of regulations lays out different variations of data subject rights, there is an unmistakable trend toward elevated scrutiny and greater transparency when it comes allowing an individual a measure of control over their personal data. Even if your business may not be subject to these regulations now, integrating many of these requirements into your operation, including an individual’s rights to access, right to erasure, and right to withdraw consent, can give you a leg up should a broader, farther-reaching piece of legislation be passed in the future.

6. Significant fines and class action lawsuits await the noncompliant.

Large data privacy class action lawsuits have become a regular occurrence in today’s privacy-sensitive climate. Under the GDPR, individuals are given a number of private rights of action, including the right to bring a class action lawsuit. On the first day of the GDPR, for example, both Facebook and Google were hit with approximately $8.8 billion lawsuits. When the CCPA launches in 2020, enterprising class action attorneys are expected to lead a surge of consumer litigation under the CCPA’s private right of action. In addition to lawsuits, businesses will want to protect themselves from costly fines as well. While CCPA fines (up to $7,500 per violation) are initially smaller than GDPR fines, the CCPA also allows for statutory damages between $100 and $750 per consumer, per incident. Compliance violations also have the potential to quickly become PR nightmares for an organization, as public support continues to swell for stricter data protection laws, making effective compliance all the more important.

While none of these lessons offers a magic bullet that can ensure your organization will be compliant when the CCPA takes effect in 2020, learning from these lessons can help your business stay ahead of the compliance curve, and better prepare for a data-protected future. Moreover, taking a proactive approach to the coming wave of data privacy laws can pay financial, legal and PR dividends down the road.