Would You Like Spam With That?

Written by Mark Rasch
November 28th, 2012

Attorney Mark D. Rasch is the former head of the U.S. Justice Department’s computer crime unit and today serves as Director of Cybersecurity and Privacy Consulting at CSC in Virginia.

Two recent court cases demonstrate how difficult it can be for retailers to collect personal information about their customers and then use that information for marketing directly to them. Get it right, and you have a goldmine of personal information and contact information you can use to sell your products and services and to share with other interested third parties. Get it wrong, and you can be paying tens of thousands of dollars in fines, court costs and legal bills. And here’s the fun part: There’s virtually no difference between the two.

Pizza And Oil Changes
Both cases arise under federal law called the Telephone Consumer Protection Act of 1991, which was designed to prevent unsolicited commercial telephone calls, robo calls and spam text messages. It was the same law that created the “do not call” list. Although statute was primarily aimed at junk phone calls, regulations promulgated under the act made it clear that the statute applies equally to SMS messages, which are sent unsolicited to customers. Indeed, because the consumer pays for receiving these messages, a retailer must first obtain “express consent” before sending such text messages. The question is, what constitutes “express consent” to receive spam messages.

Earlier this month, a federal court in Seattle certified a class-action lawsuit against Papa John’s pizza for its practice of sending text messages to customers who had ordered pizzas and provided their phone numbers when they did so. Class-action certification allows the case to continue, and the plaintiffs in that case are seeking in excess of $250 million in statutory and other civil damages. This is similar to the case involving Jiffy Lube, which also received class-action certification earlier this year.

The Papa John’s and Jiffy Lube courts found that merely providing a telephone number to a merchant was not express consent to the receipt of a bombardment of SMS messages by either that merchant or others.

In the Jiffy Lube case, the company settled similar charges in August of this year for more than $47 million. So it looks like, under the telephone consumer protection act, merchants must do something more than just obtain people’s telephone numbers if they want to start marketing to them. Right? Not so fast.

The retailing mega-giant was faced with a similar issue with respect to its in-store pharmacy. When Stephanie Pinckard went to a Walmart store in Alabama, she wanted to get her prescription filled. The clerk asked her for her telephone number, “in case anything came up.” Stephanie agreed.

Before the prescription was even filled, Stephanie began to get text messages from the retailer. She claimed she had never agreed to receive those messages, nor had she expressly consented to do so. Stephanie filed a class-action lawsuit against Walmart claiming violations of the telephone consumer protection act.

This is where things went horribly wrong for Stephanie. The court in Alabama dismissed Stephanie’s claim, finding that merely providing her telephone number to a representative of the store constituted “express consent” to receive as many robo calls or text messages as the retailer wished to send her. The court started out by noting that the statute found at 47 United States code section 227 applies equally to telephone calls—that is, voice calls–as it does to text messages and to telephone numbers. From the fact that the statute applied to both text and voice, the court concluded that by providing one’s voice telephone number, one was, of course, consenting to receiving messages by SMS.

Why else would you provide your telephone number?

The court then addressed the question of what constitutes “express consent” to receive these text messages. Here, the court again found that the mere act of providing a telephone number, even in response to the expressed request, was sufficient to constitute consent. The court quoted from the legislative history of the statute noting: “The TCPA allows autodialed and prerecorded message calls if the called party expressly consents to their use.”

In regards to Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991, 7 FCC Rcd. 8752, 8769 ¶ 29 (Oct. 16, 1992); see 27 U.S.C. § 227(b)(1)(A): “[U]nder the prohibitions set forth in § 227(b)(1)—persons who knowingly release their phone number have in effect given their invitation or permission to be called at the number which they have given, absent instructions to the contrary.”


One Comment | Read Would You Like Spam With That?

  1. Felix Lee Says:

    Consent to one thing is not tantamount to consent to other things, especially not spam. These companies just want to circumvent the law and make excuses for their actions. They shouldn’t be permitted to do this when what they’re actually doing is harassing customers.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.