Evan Schuman's StorefrontBacktalk

Attorney Mark D. Rasch is the former head of the U.S. Justice Department’s computer crime unit and today serves as Director of Cybersecurity and Privacy Consulting at CSC in Virginia.

Two recent court cases demonstrate how difficult it can be for retailers to collect personal information about their customers and then use that information for marketing directly to them. Get it right, and you have a goldmine of personal information and contact information you can use to sell your products and services and to share with other interested third parties. Get it wrong, and you can be paying tens of thousands of dollars in fines, court costs and legal bills. And here’s the fun part: There’s virtually no difference between the two.

Pizza And Oil Changes
Both cases arise under federal law called the Telephone Consumer Protection Act of 1991, which was designed to prevent unsolicited commercial telephone calls, robo calls and spam text messages. It was the same law that created the “do not call” list. Although statute was primarily aimed at junk phone calls, regulations promulgated under the act made it clear that the statute applies equally to SMS messages, which are sent unsolicited to customers. Indeed, because the consumer pays for receiving these messages, a retailer must first obtain “express consent” before sending such text messages. The question is, what constitutes “express consent” to receive spam messages.

Earlier this month, a federal court in Seattle certified a class-action lawsuit against Papa John’s pizza for its practice of sending text messages to customers who had ordered pizzas and provided their phone numbers when they did so. Class-action certification allows the case to continue, and the plaintiffs in that case are seeking in excess of $250 million in statutory and other civil damages. This is similar to the case involving Jiffy Lube, which also received class-action certification earlier this year.

The Papa John’s and Jiffy Lube courts found that merely providing a telephone number to a merchant was not express consent to the receipt of a bombardment of SMS messages by either that merchant or others.

In the Jiffy Lube case, the company settled similar charges in August of this year for more than $47 million. So it looks like, under the telephone consumer protection act, merchants must do something more than just obtain people’s telephone numbers if they want to start marketing to them. Right? Not so fast.

Walmart
The retailing mega-giant was faced with a similar issue with respect to its in-store pharmacy. When Stephanie Pinckard went to a Walmart store in Alabama, she wanted to get her prescription filled. The clerk asked her for her telephone number, “in case anything came up.” Stephanie agreed.

Before the prescription was even filled, Stephanie began to get text messages from the retailer. She claimed she had never agreed to receive those messages, nor had she expressly consented to do so. Stephanie filed a class-action lawsuit against Walmart claiming violations of the telephone consumer protection act.

This is where things went horribly wrong for Stephanie. The court in Alabama dismissed Stephanie’s claim, finding that merely providing her telephone number to a representative of the store constituted “express consent” to receive as many robo calls or text messages as the retailer wished to send her. The court started out by noting that the statute found at 47 United States code section 227 applies equally to telephone calls—that is, voice calls–as it does to text messages and to telephone numbers. From the fact that the statute applied to both text and voice, the court concluded that by providing one’s voice telephone number, one was, of course, consenting to receiving messages by SMS.

Why else would you provide your telephone number?

The court then addressed the question of what constitutes “express consent” to receive these text messages. Here, the court again found that the mere act of providing a telephone number, even in response to the expressed request, was sufficient to constitute consent. The court quoted from the legislative history of the statute noting: “The TCPA allows autodialed and prerecorded message calls if the called party expressly consents to their use.”

In regards to Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991, 7 FCC Rcd. 8752, 8769 ¶ 29 (Oct. 16, 1992); see 27 U.S.C. § 227(b)(1)(A): “[U]nder the prohibitions set forth in § 227(b)(1)—persons who knowingly release their phone number have in effect given their invitation or permission to be called at the number which they have given, absent instructions to the contrary.”