New Wave of Privacy Litigation: Plaintiffs Press Untested Theories Under 2005 Colorado Prevention of Telemarketing Fraud Act

In what appears to be an emerging privacy litigation trend, plaintiffs’ attorneys have recently filed a series of putative class action lawsuits targeting data companies in possession of cellular telephone numbers. The lawsuits attempt to leverage an untested provision in Colorado’s Prevention of Telemarketing Fraud Act (PTFA) which prohibits knowingly listing “a cellular telephone number in a directory for a commercial purpose unless the person whose number has been listed has given affirmative consent[.]” Colo. Rev. Stat. Ann. § 6-1-304(4). Although the law was originally enacted in 2005, there is almost no case law interpreting its provisions. However, the PTFA provides for statutory damages of $300-500 per violation, attorneys’ fees, and costs, making it attractive to plaintiffs’ lawyers. Several other states have similar laws. See, e.g., Conn. Gen. Stat. Ann. § 16-247s, N.Y. Gen. Bus. Law § 399-cc.1, Minn. Stat. Ann. § 325E.318, 73 Pa. Stat. Ann. § 2403, S.D. Codified Laws § 49-31-118, and TX UTIL § 64.202.

The recently filed cases attempt to assert PTFA claims against several companies, including Datanyze LLC, Zenleads, Inc., Infopay, Inc., Lusha Systems, Inc., and Beenverified LLC. The plaintiffs claim the defendants violated the PTFA’s prohibitions by listing plaintiffs’ cell phone numbers on their websites without authorization. Specifically, the complaints target business models in which companies display “teaser” data in response to a search query with an offer to purchase additional information. Plaintiffs argue that displaying cell numbers in response to such searches constitutes “listing” numbers in a “directory” within the meaning of the PTFA.

Plaintiffs’ firms Bursor and Fisher, P.A., Emery Reddy PLLC, Anderson + Wanca, and Birnbaum & Godkin, LLP have all jumped on the PTFA bandwagon in recent months. Cases are now pending in federal district courts across the U.S., including the District of Colorado, District of Massachusetts, Northern District of California, Western District of Washington, and Southern District of New York. Each of these cases remains is in the early stages of litigation, and to date, no responsive pleadings or motions to dismiss have been filed.

In light of this recent wave of litigation, companies should consider the following to mitigate the risk they may be targeted under the PTFA:

1. Identify Colorado cell numbers: Companies should consider their ability to reliably determine if a cell number belongs to a Colorado resident (or that of another state with similar laws).
2. Consent practices: The PTFA contains an exception if the owner of the cell phone number has provided consent. Companies should consider the sources of their cell phone data and practices relating to obtaining and documenting consent.
3. “Lists a cellular phone number”: Companies should consider using “dummy” data or redacting portions of displayed cell phone numbers in any search results, which may mitigate risk.
4. Use of a “directory”: The PTFA prohibits listing a cell number in a “directory,” but the term is not defined in the statute. Companies should consider how they display search results and how they might avoid having those results characterized as a “directory.”
5. “For a commercial purpose”: Companies should consider adjustments to their sales practices to mitigate any argument they are using data for a commercial purpose.
6. Opt-out mechanisms: Companies should ensure there are user-friendly opt-out mechanisms that allow individuals to request that their information be removed from databases.

Companies targeted in PTFA litigation will need to think creatively about defenses, as the PTFA has rarely been tested in court. Companies may have a number of arguments based on the statute’s legislative history and the statute’s intended purpose of targeting abusive telemarketing practices, or that a company’s business practices do not fit within the “commercial” conduct regulated by the statute. Further, PTFA claims are generally poor candidates for class certification because the individualized nature of the claims (for example, determining whether there was consent or whether the number belonged to a Colorado resident at the time of publication) arguably defeats Rule 23’s predominance requirement.

Troutman Pepper Locke’s Privacy + Cyber team has experience advising clients concerning PTFA issues and litigating PTFA claims. For more information, contact Joshua D. Davey, David J. Navetta, Ronald I. Raether, and Natalia A. Jacobo.