Permission to Reach Someone: The TCPA, CAN-SPAM, and the Consent Records Nobody Keeps
By Casey Scott McKay ·
The federal statutes that govern calling, texting, and emailing customers are short, old, and carry per-message statutory damages that turn an ordinary marketing list into nine-figure exposure. This article separates the two regimes that actually matter - the TCPA, which is consent-based and privately enforceable, and CAN-SPAM, which is disclosure-based and mostly is not - and explains why companies routinely comply with the wrong one. It works through what prior express written consent requires after Facebook v. Duguid narrowed the autodialer definition, why the prerecorded-voice and do-not-call theories now carry most cases, and how revocation works. It covers vicarious liability for lead vendors and affiliates, the state statutes that reimpose what the federal narrowing removed, and the consent record that is the only real defense. It closes with what a defensible program looks like.
IP and Technology > Privacy Data Security | Article | Published 27 October 2023 - Updated 19 June 2026 | Casey Scott McKay - marksy.us
Summary. The federal statutes that govern calling, texting, and emailing customers are short, old, and carry per-message statutory damages that turn an ordinary marketing list into nine-figure exposure. This article separates the two regimes that actually matter — the TCPA, which is consent-based and privately enforceable, and CAN-SPAM, which is disclosure-based and mostly is not — and explains why companies routinely comply with the wrong one. It works through what prior express written consent requires after Facebook v. Duguid narrowed the autodialer definition, why the prerecorded-voice and do-not-call theories now carry most cases, and how revocation works. It covers vicarious liability for lead vendors and affiliates, the state statutes that reimpose what the federal narrowing removed, and the consent record that is the only real defense. It closes with what a defensible program looks like.
Keywords: TCPA · prior express written consent · automatic telephone dialing system · Facebook v Duguid · prerecorded voice · do not call registry · internal do not call list · revocation of consent · CAN-SPAM · commercial email · transactional messages · opt-out mechanism · sender identification · state mini-TCPA statutes · telemarketing sales rule · vicarious liability · lead generation · consent capture evidence · statutory damages · class action exposure
This is premium Marksy content — the full document is available to subscribers.