6 ms·

I agree entirely; this is a dumb case. If decided for Duguid, here's a list of things that would probably have become illegal for businesses to do under TCPA:

I agree entirely; this is a dumb case. If decided for Duguid, here's a list of things that would probably have become illegal for businesses to do under TCPA: 1) using caller ID to return a missed call unless you were sure you were calling an existing customer 2) sending a one-time password over SMS, unless you had already validated that the telephone number belonged to your customer 3) using call-center software that automatically connects an operator to the customer's on-file telephone number in order to validate that the number was correct!

kmonsen 6y ago
2) and 3) would probably always be illegal since phone numbers are recycled and you can never know when that happens. I guess it’s fairly likely that is what happened in this case? So even if you are sure it is the number of a customer, it is verified and used for correspondence it can still be sometime else number a year (I don’t know how long the recycling waiting time is) later.
- duskwuff 6y ago
  > you can never know when that happens There's work being done to address that: https://www.fcc.gov/reassigned-numbers-database https://www.fcc.gov/reassigned-numbers-database https://www.reassigned.us/ https://www.reassigned.us/
nulbyte 6y ago
Regarding the first two, it's not just a matter of an existing relationship, but also consent. As to the latter, this was the effect, and likely will continue to be, until companies decide to implement changes in response to this ruling. Especially larger corporations have been capturing consent and even relying on third-parties to manually dial numbers, because this was the prevailing interpretation until the Supreme Court reintroduced common sense.
- NovemberWhiskey 6y ago
  I don't see the relevance of consent: you can't consent on behalf of a third party. The evidentiary question of whether a customer had actually consented to receive calls/texts from a service to which they had subscribed is separate from the question of liability for using automation to call/text a number that turns out not to belong to a customer.
Der_Einzige 6y ago
Two factor auth is so bad over SMS for security that id love to see it banned (even for the wrong reasons). The other two are fine casualties for a world with far less autodialing. Call centers probably ought not exist.
toast0 6y ago
> 2) sending a one-time password over SMS, unless you had already validated that the telephone number belonged to your customer Note that it's pretty hard to validate a phone number belongs to someone. You could ask their telephone company, but their telephone company shouldn't disclose subscriber information, and even if they did, maybe you get a name, but lots of people have the same name as me, so what does that show? Commonly, people send a text message with a code or a phone call with a code to demonstrate control (not belonging), but that's almost always automated, and you would need the number to be validated before you could validate it.
- connorproctor 6y ago
  Rather than texting the consumer a security code and having them enter it in the browser, you could display a security code in the browser and have them text it to your automated system. But there’s still no way to know if that number later gets released to another person.
  - anticristi 6y ago
    AFAIU, caller ID can be faked. Getting an SMS from a phone number does not demonstrate anything. Probably this is why the send factor is received, not sent.
  - toast0 6y ago
    As the sibling comment says, spoofing sender ID or caller ID is relatively easy. You can't trust it, outside of some very narrow cases (although, shaken/stir may change that). Some carriers do make available lists of recycled numbers, and some telephone information companies aggregate these lists, when I was looking, coverage was sparse though, and questions about reliability and privacy were too big relative to the limited coverage. Sharing of confidential information was an issue too: carriers wanted to provide events only for numbers of interest to a 3rd party service, so the carrier didn't divulge the number of customers leaving their service; the 3rd party service didn't want to provide numbers of interest because it would divulge user count. I may be biased (I was working for a service), but the recycled number list feels less privacy invasive than providing numbers of intetest. The numbering space is small, so you can't meaningfully obscure the numbers, etc. Determining which carrier is responsible for a number is also tricky, of course.
privacylawthrow 6y ago
These were already violations of the TCPA in the 9th Circuit under the 9th Circuit's previous ruling in Marks where the court found that an autodialer is any equipment that dials a number from a stored list. Marks was used as precedent for this lawsuit. Facebook argued that this case was different from Marks. The Ninth Circuit found otherwise. SCOTUS appears to have shot down the ruling from Marks. Marks was widely regarded as a terrible decision because it made no sense at the time. It's nice to see SCOTUS return some common sense to the law. Note also that the TCPA allows for statutory damages of up to $1500 per violation, so it takes less than 675 calls/texts to rack up $1M in liability. Class action attorneys love it because they don't have to show damages. They only have to show that the call or text was sent using an autodialer.
- NovemberWhiskey 6y ago
  Having now read Marks it now makes a whole lot more sense why this is in the Supreme Court; the Ninth Circuit seems to have gone off the deep end with that decision.
- andjd 6y ago
  >Marks was widely regarded as a terrible decision because it made no sense at the time. Citation? I've looked over _Marks_, and it doesn't seem unreasonable, and the 9th circuit was not the only court to adopt the same interpretation of the statute. I can see why certain industries would lothe that rule, but it doesn't seem to me that the Court's opinion is a fine, if not exemplary, example of legal interpretation. Similarly, it's far from clear that Congress intended that such behavior be permissible when they passed the law. Honestly, _Marks_ makes more sense to me than the Supreme Court's interpretation does. Reading a law's text in the narrow and formal way that they did causes the law to be nonsensical.

kmonsen 6y ago

2) and 3) would probably always be illegal since phone numbers are recycled and you can never know when that happens. I guess it’s fairly likely that is what happened in this case? So even if you are sure it is the number of a customer, it is verified and used for correspondence it can still be sometime else number a year (I don’t know how long the recycling waiting time is) later.

duskwuff 6y ago
> you can never know when that happens There's work being done to address that: https://www.fcc.gov/reassigned-numbers-database https://www.fcc.gov/reassigned-numbers-database https://www.reassigned.us/ https://www.reassigned.us/

nulbyte 6y ago

Regarding the first two, it's not just a matter of an existing relationship, but also consent. As to the latter, this was the effect, and likely will continue to be, until companies decide to implement changes in response to this ruling. Especially larger corporations have been capturing consent and even relying on third-parties to manually dial numbers, because this was the prevailing interpretation until the Supreme Court reintroduced common sense.

NovemberWhiskey 6y ago
I don't see the relevance of consent: you can't consent on behalf of a third party. The evidentiary question of whether a customer had actually consented to receive calls/texts from a service to which they had subscribed is separate from the question of liability for using automation to call/text a number that turns out not to belong to a customer.

Der_Einzige 6y ago

Two factor auth is so bad over SMS for security that id love to see it banned (even for the wrong reasons). The other two are fine casualties for a world with far less autodialing. Call centers probably ought not exist.

toast0 6y ago

> 2) sending a one-time password over SMS, unless you had already validated that the telephone number belonged to your customer Note that it's pretty hard to validate a phone number belongs to someone. You could ask their telephone company, but their telephone company shouldn't disclose subscriber information, and even if they did, maybe you get a name, but lots of people have the same name as me, so what does that show? Commonly, people send a text message with a code or a phone call with a code to demonstrate control (not belonging), but that's almost always automated, and you would need the number to be validated before you could validate it.

connorproctor 6y ago
Rather than texting the consumer a security code and having them enter it in the browser, you could display a security code in the browser and have them text it to your automated system. But there’s still no way to know if that number later gets released to another person.
- anticristi 6y ago
  AFAIU, caller ID can be faked. Getting an SMS from a phone number does not demonstrate anything. Probably this is why the send factor is received, not sent.
- toast0 6y ago
  As the sibling comment says, spoofing sender ID or caller ID is relatively easy. You can't trust it, outside of some very narrow cases (although, shaken/stir may change that). Some carriers do make available lists of recycled numbers, and some telephone information companies aggregate these lists, when I was looking, coverage was sparse though, and questions about reliability and privacy were too big relative to the limited coverage. Sharing of confidential information was an issue too: carriers wanted to provide events only for numbers of interest to a 3rd party service, so the carrier didn't divulge the number of customers leaving their service; the 3rd party service didn't want to provide numbers of interest because it would divulge user count. I may be biased (I was working for a service), but the recycled number list feels less privacy invasive than providing numbers of intetest. The numbering space is small, so you can't meaningfully obscure the numbers, etc. Determining which carrier is responsible for a number is also tricky, of course.

privacylawthrow 6y ago

These were already violations of the TCPA in the 9th Circuit under the 9th Circuit's previous ruling in Marks where the court found that an autodialer is any equipment that dials a number from a stored list. Marks was used as precedent for this lawsuit. Facebook argued that this case was different from Marks. The Ninth Circuit found otherwise. SCOTUS appears to have shot down the ruling from Marks. Marks was widely regarded as a terrible decision because it made no sense at the time. It's nice to see SCOTUS return some common sense to the law. Note also that the TCPA allows for statutory damages of up to $1500 per violation, so it takes less than 675 calls/texts to rack up $1M in liability. Class action attorneys love it because they don't have to show damages. They only have to show that the call or text was sent using an autodialer.

NovemberWhiskey 6y ago
Having now read Marks it now makes a whole lot more sense why this is in the Supreme Court; the Ninth Circuit seems to have gone off the deep end with that decision.
andjd 6y ago
>Marks was widely regarded as a terrible decision because it made no sense at the time. Citation? I've looked over _Marks_, and it doesn't seem unreasonable, and the 9th circuit was not the only court to adopt the same interpretation of the statute. I can see why certain industries would lothe that rule, but it doesn't seem to me that the Court's opinion is a fine, if not exemplary, example of legal interpretation. Similarly, it's far from clear that Congress intended that such behavior be permissible when they passed the law. Honestly, _Marks_ makes more sense to me than the Supreme Court's interpretation does. Reading a law's text in the narrow and formal way that they did causes the law to be nonsensical.