Would You Like Spam With That?

Attorney Mark D. Rasch is the former head of the U.S. Justice Department's computer crime unit and today serves as Director of Cybersecurity and Privacy Consulting at CSC in Virginia.

Two recent court cases demonstrate how difficult it can be for retailers to collect personal information about their customers and then use that information for marketing directly to them. Get it right, and you have a goldmine of personal information and contact information you can use to sell your products and services and to share with other interested third parties. Get it wrong, and you can be paying tens of thousands of dollars in fines, court costs and legal bills. And here's the fun part: There's virtually no difference between the two.

Pizza And Oil Changes
Both cases arise under federal law called the Telephone Consumer Protection Act of 1991, which was designed to prevent unsolicited commercial telephone calls, robo calls and spam text messages. It was the same law that created the "do not call" list. Although statute was primarily aimed at junk phone calls, regulations promulgated under the act made it clear that the statute applies equally to SMS messages, which are sent unsolicited to customers. Indeed, because the consumer pays for receiving these messages, a retailer must first obtain "express consent" before sending such text messages. The question is, what constitutes "express consent" to receive spam messages.

Earlier this month, a federal court in Seattle certified a class-action lawsuit against Papa John's pizza for its practice of sending text messages to customers who had ordered pizzas and provided their phone numbers when they did so. Class-action certification allows the case to continue, and the plaintiffs in that case are seeking in excess of $250 million in statutory and other civil damages. This is similar to the case involving Jiffy Lube, which also received class-action certification earlier this year.

The Papa John's and Jiffy Lube courts found that merely providing a telephone number to a merchant was not express consent to the receipt of a bombardment of SMS messages by either that merchant or others.

In the Jiffy Lube case, the company settled similar charges in August of this year for more than $47 million. So it looks like, under the telephone consumer protection act, merchants must do something more than just obtain people's telephone numbers if they want to start marketing to them. Right? Not so fast.

The retailing mega-giant was faced with a similar issue with respect to its in-store pharmacy. When Stephanie Pinckard went to a Walmart store in Alabama, she wanted to get her prescription filled. The clerk asked her for her telephone number, "in case anything came up." Stephanie agreed.

Before the prescription was even filled, Stephanie began to get text messages from the retailer. She claimed she had never agreed to receive those messages, nor had she expressly consented to do so. Stephanie filed a class-action lawsuit against Walmart claiming violations of the telephone consumer protection act.

This is where things went horribly wrong for Stephanie. The court in Alabama dismissed Stephanie's claim, finding that merely providing her telephone number to a representative of the store constituted "express consent" to receive as many robo calls or text messages as the retailer wished to send her. The court started out by noting that the statute found at 47 United States code section 227 applies equally to telephone calls—that is, voice calls–as it does to text messages and to telephone numbers. From the fact that the statute applied to both text and voice, the court concluded that by providing one's voice telephone number, one was, of course, consenting to receiving messages by SMS.

Why else would you provide your telephone number?

The court then addressed the question of what constitutes "express consent" to receive these text messages. Here, the court again found that the mere act of providing a telephone number, even in response to the expressed request, was sufficient to constitute consent. The court quoted from the legislative history of the statute noting: "The TCPA allows autodialed and prerecorded message calls if the called party expressly consents to their use."

In regards to Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991, 7 FCC Rcd. 8752, 8769 ¶ 29 (Oct. 16, 1992); see 27 U.S.C. § 227(b)(1)(A): "[U]nder the prohibitions set forth in § 227(b)(1)—persons who knowingly release their phone number have in effect given their invitation or permission to be called at the number which they have given, absent instructions to the contrary."Of course, there are serious problems with the way the Alabama court looked at this case. If I were a retailer, I would not rely too heavily on the court's conclusions.

Express consent means exactly what it says and does: that a consumer has expressly consented to receiving communications substantially in the form of and in the nature in which they are sent. Obviously, if consumers give out their phone numbers to a retailer, and the retailer later calls those consumers for purposes for which they gave that phone number, that is not an unsolicited communication.

So, for example, if Walmart were to call Stephanie and tell her that her prescription was ready or follow up on information about the prescription, clearly Stephanie would have consented to this communication by giving out her telephone number. Similarly, other telephone communications related to the transaction for which Stephanie gave her phone number (and possibly even an SMS message saying something like "your prescription is ready") could, under the definition of consent in both the statute and the regulations, be acceptable.

But for consent to be express, consumers need to be given an opportunity to know, in a meaningful way, exactly what it is they are consenting to. This is where the Alabama court gets it wrong and the Washington state court, at least at the outset, seems to get it right.

Consent, like privacy itself, is not binary. It's not like you either have privacy or you don't. It's not like you either give consent or you don't. You consent to providing certain information to certain people for certain purposes. Sometimes it is obvious; other times it is not. A lot of it is determined by the circumstances. For retailers, if they want express consent to use someone's telephone number to send that person text messages, the best approach is that taken by almost every retailer: Tell the consumer what you're doing.

The law does not require that the consent be in writing, through a click wrap agreement, or in a particular form or format. Merely that it be express. But the fact that the law requires express consent means that we—retailers—cannot rely on the implied consent. Consumers actually have to know what they are consenting to, and they actually have to agree to it.

I seriously doubt that a reasonable consumer was asked to provide his or her telephone number to a pharmacy as either expressly given or even implied consent to receiving text messages on unrelated matters. Even though a phone is capable of receiving both text messages and telephone calls through the same telephone number, they are different forms of communication. (If you provide your home address for someone to mail you a catalog, it does not imply consent for door-to-door salespeople to come into your home—even though it's the same address.)

Consumers frequently pay their telephone providers separately for voice communications and for text messages. Under the Walmart rationale, once I have your phone number, I could send you hundreds or thousands of text messages, increasing your phone bill by hundreds of dollars, simply because you wanted a prescription. Not only is that a bad marketing practice, but it is exactly the type of thing that the telephone consumer protection act was designed to prevent.

The take away here is not that Walmart was able to win in the district court. Rather, that the best approach is to respect the privacy of your customers. When you collect personal information of any type from them, treat them with respect; use the information only for the purposes for which it was collected and, most importantly, have a commitment to transparency, openness and obtaining consent.

If you disagree with me, I'll see you in court, buddy. If you agree with me, however, I would love to hear from you.