Outbound Marketing Compliance Checklist: Channel Rules, Consent Evidence, Opt-Out Handling, and Vendor Flow-Down

By Casey Scott McKay · 2024-08-20

This checklist audits and then rebuilds an outbound messaging program, in the order the work has to happen and with gates at the points where a mistake creates per-message statutory exposure. It starts with the ten-number test that prices the problem in an afternoon, inventories every message stream and sending system, and separates the opt-in channels from the opt-out ones. It specifies the consent screen element by element, the consent record schema field by field, and the rendering archive that proves what a person saw. It covers global suppression and revocation capture, the do-not-call program most companies do not have, and the lead vendor evidence tests that replace indemnity with proof. It closes with the re-permissioning campaign, the litigation sequence, and the quarterly metrics.

IP and Technology > Privacy Data Security | Checklist | Published 20 August 2024 - Updated 26 December 2024 | Casey Scott McKay - marksy.us

Summary. This checklist audits and then rebuilds an outbound messaging program, in the order the work has to happen and with gates at the points where a mistake creates per-message statutory exposure. It starts with the ten-number test that prices the problem in an afternoon, inventories every message stream and sending system, and separates the opt-in channels from the opt-out ones. It specifies the consent screen element by element, the consent record schema field by field, and the rendering archive that proves what a person saw. It covers global suppression and revocation capture, the do-not-call program most companies do not have, and the lead vendor evidence tests that replace indemnity with proof. It closes with the re-permissioning campaign, the litigation sequence, and the quarterly metrics.

Keywords: channel classification · message stream inventory · consent screen elements · not a condition of purchase · consent record fields · rendering archive · global suppression · revocation channels · do not call policy · registry scrubbing · lead vendor evidence test · contract flow down · template governance · transactional creep · state telephone statutes · exposure arithmetic · re-permissioning · litigation hold · class certification defense · quarterly metrics

How to use this checklist

| Phase | What it covers | |---|---| | 1 | The ten-number test | | 2 | Message stream inventory | | 3 | Channel classification | | 4 | Provenance audit | | 5 | The exposure arithmetic | | 6 | Consent screen elements | | 7 | Capture surface by surface | | 8 | The consent record schema | | 9 | The rendering archive | | 10 | Global suppression | | 11 | Revocation capture | | 12 | The preference center | | 13 | The do-not-call program | | 14 | Lead vendors: the evidence test | | 15 | Vendor contract flow-down | | 16 | Template governance | | 17 | State statutes | | 18 | Re-permissioning | | 19 | Litigation day one | | 20 | Insurance | | 21 | Quarterly metrics | | 22 | Ownership and annual audit |

Boxes marked [Gate] must clear before any send to the affected population.

The matter. A retailer with nine hundred thousand mobile numbers ran the ten-number test and produced complete consent records for three. Twenty-one percent of the file came from purchased leads, and one vendor that had supplied ninety thousand numbers never responded to an evidence request.

Phase 1. The ten-number test

[ ] [Gate] Pick ten numbers at random from the marketing platform.
[ ] For each, ask for three artifacts: the exact consent language displayed, the date and source of consent, and an image of the screen the person saw.
[ ] Time it. The elapsed time and the completion rate are the compliance assessment.
[ ] Record the result and date the memo. It is the document that unlocks the budget.
[ ] Repeat quarterly as a standing metric.

Phase 2. Message stream inventory

[ ] [Gate] List every sending system, including the ones legal does not know about — marketing platform, transactional platform, loyalty system, app push service, call center dialer, and every agency or vendor sending on the company's behalf.
- Trap. There are almost always two or three nobody mentions. Ask finance for vendor payments rather than asking marketing for a list.
[ ] List every message stream by purpose: transactional and relationship, service and operational, marketing and promotional, win-back and re-engagement, research and surveys, and collections.
[ ] Record the consent basis relied upon for each stream.
- Trap. Where the answer is "the customer gave us their number," that stream needs work.
[ ] Flag mixed streams — service messages carrying offers. These are Phase 16.
[ ] Identify who owns each stream operationally.

Phase 3. Channel classification

[ ] [Gate] Separate opt-in channels from opt-out channels, and never treat them alike.
- Calls and texts are governed by 47 U.S.C. § 227, are consent-based, and carry a private right of action with statutory damages of five hundred dollars per violation, trebled for willful conduct, under § 227(b)(3).
- Commercial email is governed by 15 U.S.C. § 7704, is disclosure-based, and has no general private right of action under 15 U.S.C. § 7706.
[ ] Confirm no team is applying an email model to SMS. This is the structural error underneath most exposure.
[ ] Identify prerecorded and artificial-voice sends, including ringless voicemail and synthesized voices.
- Why. The prerecorded-voice prohibition has no technology element and survived the narrowing of the autodialer definition in Facebook v. Duguid.
[ ] Identify any fax advertising. Still litigated.
[ ] Confirm email compliance basics under 15 U.S.C. § 7704: accurate headers, honest subject lines, advertisement identification, a valid physical postal address, a functioning opt-out operable at least thirty days, and opt-outs honored within ten business days.

Phase 4. Provenance audit

[ ] [Gate] Split the phone file into four buckets: direct capture with a complete record; direct capture with an incomplete record; purchased leads; unknown or legacy.
[ ] Do the same for the email file, separately.
[ ] Count messages sent to each bucket over the last four years, by channel.
- Why. Each message is a violation. The multiplier is send volume, not headcount.
[ ] Identify which capture surface produced each bucket, so the fix can be targeted.
[ ] Flag any list acquired with a business and confirm whether consent records came with it.

Phase 5. The exposure arithmetic

[ ] Multiply exposed messages by five hundred dollars, then by fifteen hundred, and present both figures.
[ ] State the mitigants honestly: standing under Spokeo v. Robins and TransUnion v. Ramirez; predominance, which is strong only in proportion to record quality; and the narrowed autodialer theory, which does nothing against a prerecorded-voice count, a § 227(c) do-not-call count, or a state claim.
[ ] Name the insurance exclusions rather than assuming coverage.
[ ] Itemize the cost to fix.
[ ] State the recommendation and the trade — suppress and re-permission the unknown segment, accept the list shrinkage.

Phase 6. Consent screen elements

[ ] [Gate] Separate and unbundled. One control for SMS marketing, one for email marketing, one for terms acceptance.
[ ] [Gate] Never pre-checked.
[ ] [Gate] Names the seller by name — this company, not a category of partners.
[ ] [Gate] Names the number to which messages may be sent.
[ ] [Gate] Authorizes delivery by automatic telephone dialing system or prerecorded voice, in the regulation's terms at 47 C.F.R. § 64.1200.
[ ] [Gate] States clearly and conspicuously that consent is not a condition of any purchase.
- Why. The most commonly omitted element, and its absence invalidates the entire consent.
[ ] Includes rates, frequency, STOP and HELP, and links to terms and the privacy notice.
[ ] Electronic signature is sufficient under 15 U.S.C. § 7001; the record of what it said is the hard part.

Phase 7. Capture surface by surface

[ ] Web and app checkout. Checkbox unchecked, separate from email and terms.
[ ] Point of sale. Script governance is a legal control — the associate's phrasing is the disclosure, and "not a condition of purchase" disappears here most often. Capture on the terminal with the full disclosure displayed.
[ ] Keyword opt-in on signage. The inbound text is the consent; retain it with its timestamp. The confirmation reply restates program name, frequency, and STOP.
[ ] Call center. Record the call or log the scripted acknowledgement with the agent identifier. An unrecorded verbal consent is a consent nobody can prove.
[ ] Paper forms. Separate signature or initial line for SMS; scan and index by identifier at intake.
[ ] [Gate] Promotion entry forms. Entry consent and marketing consent must be two controls, and marketing must be optional.
- Why. Sweepstakes forms are the single most common source of defective numbers. See the Promotion Launch Checklist.

Phase 8. The consent record schema

[ ] [Gate] Store, per identifier per consent: normalized identifier; exact consent text as displayed; text version identifier; timestamp with timezone; source system, surface, and page URL; IP address or device identifier; channel and purpose; pre-checked flag; capture actor for assisted captures; current status and status history.
[ ] Write synchronously with the action, not from a nightly job.
[ ] Make entries immutable and auditable, with a record of who can modify them.
[ ] Retain past the four-year federal limitations period and past longer state periods — several years after the last message.
[ ] Build one lookup endpoint returning the consent in force, its text, and the rendered screen for an identifier and date.
[ ] Acceptance criterion: a named non-engineer produces all three in under ten minutes.

Phase 9. The rendering archive

[ ] [Gate] Capture a rendered image of each consent screen version, at each viewport class, keyed to the text version identifier.
[ ] Capture automatically on deploy.
[ ] Include assisted-capture surfaces — the point-of-sale terminal display and the call-center script version.
[ ] Retain with the consent records.
[ ] Test retrieval quarterly.

Phase 10. Global suppression

[ ] [Gate] One suppression store, keyed to normalized identifiers rather than account identifiers.
- Why. The same person is three accounts, and account-keyed suppression misses two of them.
[ ] [Gate] Every sender consumes it, including agencies and vendors. A vendor maintaining its own list is a violation waiting for a schedule mismatch.
[ ] Latency measured in minutes, not the ten business days 15 U.S.C. § 7704 allows for email.
[ ] Scope recorded with each entry — global, channel, or purpose — so a marketing opt-out does not silently kill shipping notifications.
[ ] Never deleted. A purged entry re-added through a new capture is the classic re-contact violation.
[ ] Merged on acquisition, before any send.
[ ] Tested monthly: STOP from a test number in each channel, confirm propagation everywhere.

Phase 11. Revocation capture

[ ] [Gate] Accept revocation by any reasonable means.
- Why. Gager v. Dell Financial Services established consent is revocable; Van Patten v. Vertical Fitness Group requires honoring revocation by any reasonable means.
[ ] Build write paths from: STOP replies, unsubscribe links, support tickets, chat, in-app preference centers, retail point of sale, social direct messages, and postal mail.
[ ] Train support agents that a verbal or written request to stop is a revocation, with a one-click way to record it.
[ ] Log every revocation with channel, timestamp, and the words used.
[ ] Sample quarterly: ten suppressed identifiers, confirm no sends after the suppression timestamp across all systems. Target: zero.

Phase 12. The preference center

[ ] Reachable from every message — email footers, STOP confirmations, and account pages.
[ ] Granular by channel and purpose, each control showing its state and the date it was set.
[ ] Honest about what cannot be turned off — security notices and legally required disclosures.
[ ] Shows the consent that exists, with its date. This resolves many disputes before they become demands.
[ ] Writes to the same suppression store, at the same latency.
[ ] Separates privacy opt-outs from messaging opt-outs, clearly labelled, since opting out of texts is not opting out of a sale or share. See the State Privacy Law Applicability and Readiness Checklist.
[ ] Usable without login and on a phone.
- Trap. "I tried to opt out and couldn't" is a far worse fact than an ordinary unwanted message.

Phase 13. The do-not-call program

[ ] [Gate] Publish a written policy, available on demand to anyone who asks. Most companies cannot produce one.
[ ] Train everyone customer-facing, since anyone might receive a request.
[ ] Maintain an internal do-not-call list, honored effectively permanently.
[ ] Scrub against the national registry on the required schedule under 47 C.F.R. § 64.1200(c), recording scrub dates.
[ ] Identify the caller — name, entity on whose behalf, and a contact number or address.
[ ] Enforce time-of-day limits at the called party's local time.
- Trap. Local time cannot be inferred from an area code.
[ ] Document everything, because the safe harbor is a documentation defense and cannot be invoked without it. See Krakauer v. Dish Network for what dealer conduct costs a seller.

Phase 14. Lead vendors: the evidence test

[ ] [Gate] Ask every vendor today to produce the complete consent record for five numbers they supplied.
[ ] Give a two-week deadline. Vendors who cannot produce in two weeks generally cannot produce at all.
[ ] Review what comes back against the Phase 8 field list, and check that the disclosure named this company specifically.
[ ] Examine the disclosure structure. A comparison site listing hundreds of "marketing partners" behind a hyperlink is the recurring target.
[ ] Suppress the numbers from any vendor that fails, and terminate.
[ ] Understand what indemnity is worth. A vendor that cannot produce records is usually a vendor that cannot pay a judgment. Sellers remain liable for messages sent on their behalf under Campbell-Ewald v. Gomez.

Phase 15. Vendor contract flow-down

[ ] Define "Consent Record" as the complete Phase 8 field set plus the rendering.
[ ] Represent that each identifier is accompanied by a compliant Consent Record naming this company as a seller, and that consent was not a condition of purchase.
[ ] [Gate] Require delivery of the record with the identifier, not retention by the vendor for later retrieval.
[ ] Require production on demand within three business days, surviving termination for the limitations period.
[ ] Audit rights, including inspection of capture surfaces as consumers see them.
[ ] No sub-sourcing without disclosure. A vendor reselling another vendor's leads means two links and no record.
[ ] Suppression flow-down before delivery, and never re-supply a suppressed identifier.
[ ] Termination for evidence failure, curable only by production.
[ ] Indemnity, uncapped for consent claims, with evidenced insurance.
[ ] Data protection terms, since the vendor is also a processor.
[ ] A live test as a condition precedent before the first paid delivery.

Phase 16. Template governance

[ ] [Gate] Two sending systems, two consent flags — transactional and marketing, separated at the platform level.
[ ] Route any message containing an offer, discount, recommendation, or promotional banner through the marketing consent check, regardless of the template it came from.
- Why. The primary-purpose test at 15 U.S.C. § 7702 does not care what the template is called, and on the SMS side an appended offer converts a service message into telemarketing.
[ ] Require named approval for template changes. A one-line footer addition can convert an entire message class.
[ ] Review the transactional stream quarterly for commercial creep.
[ ] Flag the recurring conversions: offers on receipts, promotional footers on account notices, service templates repurposed for win-back, and "re-engagement" campaigns.

Phase 17. State statutes

[ ] [Gate] Build to the most restrictive state rather than segmenting.
[ ] Florida — Fla. Stat. § 501.059, reaching automated systems for selection or dialing, with a private right of action.
[ ] Oklahoma — Okla. Stat. tit. 15 § 775C.1.
[ ] Washington — Wash. Rev. Code § 19.190.060, enforceable through its consumer protection act.
[ ] Do not geo-segment by area code. A number's area code says nothing about where the person lives.
[ ] Note the email contrast. 15 U.S.C. § 7707 preempts most state email statutes except as to falsity and deception, so email does not have this problem.
[ ] Re-check the state set annually. It changes.

Phase 18. Re-permissioning

[ ] Segment into clean, incomplete, and unknown provenance.
[ ] Suppress the unknown segment from marketing sends.
[ ] [Gate] Re-permission by email or in-product prompt, never by text.
- Why. A text asking someone to opt in is itself telemarketing requiring consent, and it is the most common self-inflicted violation in this practice.
[ ] Use the Phase 6 screen for the re-permission capture.
[ ] Accept the shrinkage, and take the trade to the executive team with the Phase 5 arithmetic.
[ ] Record the campaign — suppression date, mechanics, and resulting consented population. It is a good-faith exhibit later.

Phase 19. Litigation day one

[ ] [Gate] Freeze the campaign and any similar sends. Delete nothing.
[ ] Issue the hold over consent records, rendering archives, suppression logs, send logs, vendor correspondence, and template histories.
[ ] Count precisely — messages, unique recipients, dates, platform, and consent source.
[ ] Sample fifty consent records and count how many are complete.
[ ] Demand vendor records on a short deadline.
[ ] Identify the theory pleaded. Autodialer-only is weak after Facebook v. Duguid; prerecorded voice needs no dialer; a § 227(c) count needs neither; a state count may survive where the federal one fails.
[ ] Check the suppression logs for the named plaintiff. A STOP followed by a message is clean facts plus a willfulness argument.
[ ] Confirm federal jurisdiction is available under Mims v. Arrow Financial Services and assess standing.
[ ] Tender to carriers.

Phase 20. Insurance

[ ] Ask the broker in writing whether any policy in the tower responds to a claim under 47 U.S.C. § 227.
[ ] Read the exclusions — statutory-violation exclusions naming the TCPA, broad privacy exclusions, and distribution-in-violation-of-law exclusions.
[ ] Confirm the duty to defend, which turns on potential coverage on the face of the complaint and is often the policy's entire practical value here.
[ ] Meet the notice and cooperation conditions.
[ ] Re-ask at every renewal, because exclusions get added quietly at renewal. See Tendering and Winning an IP Coverage Claim.

Phase 21. Quarterly metrics

[ ] Consent record completeness rate, by capture surface.
[ ] Ten-identifier retrieval test, timed.
[ ] Suppression propagation test results, by channel.
[ ] Unknown-provenance population remaining.
[ ] Vendor evidence tests passed and failed.
[ ] Messages sent after a suppression timestamp. Target: zero.

Phase 22. Ownership and annual audit

[ ] [Gate] Name one owner for messaging compliance, with authority over consent language across surfaces.
[ ] Publish four triggers requiring legal review: a new capture surface, a new sending system or vendor, a change to any consent screen or script, and any message mixing service content with an offer.
[ ] Give legal review a service level, or teams will ship without asking.
[ ] Attend the campaign calendar review monthly.
[ ] Annually: re-run the provenance audit and exposure model; review consent screens against current rules and state statutes; confirm the do-not-call policy, training records, and scrub dates; re-test vendors; confirm retention still covers the limitations periods; review the transactional stream.
[ ] Report three numbers to the board: completeness rate, unknown-provenance population, and messages sent after suppression.

Phase 23. Model consent language, by surface

Use these as the pattern for Phase 7. The elements are constant; only the presentation changes.

Web or app checkout.

☐ Yes, send me marketing text messages from Acme Corp. at the number I provided, including messages sent using an automatic telephone dialing system or prerecorded voice. Consent is not a condition of any purchase. Msg & data rates may apply. Msg frequency varies. Reply STOP to cancel, HELP for help. [Terms] · [Privacy Notice]

[ ] Unchecked, separate from the email control and from terms acceptance.

Point of sale, spoken.

"Would you like to get text offers from Acme? I'll need your mobile number. You don't have to sign up to buy anything, and you can text STOP any time."

[ ] Capture on the terminal with the full disclosure displayed, and log the script version with the agent identifier.

Keyword opt-in on signage.

Text JOIN to 55555 to get offers from Acme. Msg & data rates apply. Msg frequency varies. Consent is not a condition of purchase. Reply STOP to cancel. Terms: acme.com/sms

[ ] Retain the inbound message with its timestamp — it is the consent record. Confirmation reply restates program name, frequency, and STOP.

Call center.

"Before we finish — may I send you text offers at this number? That's separate from your order updates, it's not required for anything, and you can stop any time by replying STOP."

[ ] Record the call or log the scripted acknowledgement. An unrecorded verbal consent is a consent nobody can prove.

Paper form.

[ ] Same elements in print, separate initial line for SMS, scanned and indexed by identifier at intake.

Promotion entry.

[ ] Two controls. Entry consent, and an optional marketing consent carrying the full element set.

Phase 24. Rewrite reference

| Written | Rewritten | |---|---| | "By providing your number you agree to receive messages from us." | "Yes, send me marketing text messages from Acme Corp. at the number I provided, including messages sent using an automatic telephone dialing system or prerecorded voice. Consent is not a condition of any purchase." | | One checkbox: "I agree to the Terms and to receive offers." | Three controls: terms acceptance, email marketing, SMS marketing. | | Pre-checked marketing box | Unchecked, always. | | "Standard rates apply." | "Msg & data rates may apply. Msg frequency varies. Reply STOP to cancel, HELP for help." | | "Reply STOP to unsubscribe" as the only revocation path | STOP, plus unsubscribe links, support, chat, preference center, point of sale, and postal mail — all writing to one suppression store. | | Order confirmation with a promotional banner | Two templates: a clean transactional confirmation, and a marketing message routed through the marketing consent check. | | "We may share your number with our marketing partners." | Name the parties, or do not share. A partner category is not a named seller. | | "Opt out at any time by contacting customer service." | A working preference center, reachable without login, from every message. |

[ ] Run every capture surface through this table and record who approved each replacement.
[ ] Confirm each replacement is accurate, since a stated practice the company does not follow is a consumer-protection problem under 15 U.S.C. § 45.

Phase 25. Evidence request, written in advance

Draft once, send unchanged when a demand arrives. Name the system and the owner for each.

[ ] Consent record for the named plaintiff, all Phase 8 fields.
[ ] Rendered consent screen for the version and surface recorded.
[ ] Script version and agent identifier for assisted captures.
[ ] Complete send log for the identifier, across every sending system, with template identifiers.
[ ] Suppression history for the identifier, with source and timestamp of every entry.
[ ] Support tickets, chat transcripts, and call recordings referencing messages, opt-outs, or complaints.
[ ] Vendor consent record, if the identifier came from a lead source, plus the vendor contract and the disclosed seller list at that version.
[ ] Template history for every template sent to the identifier, showing content at the send date.
[ ] Do-not-call policy, training records, and registry scrub dates covering the relevant period.
[ ] Preference center change log for the identifier.
[ ] Insurance policies in force on the relevant dates.

Why this belongs in the checklist rather than a litigation memo. Most of these items do not exist in retrievable form at most companies, and week one of a class action is a much worse time to learn that than a quarterly review.

Phase 26. Business-model boxes

Run the base checklist, then the boxes for the model in play.

Retail with physical stores.

[ ] Point-of-sale script governance, since the associate's words are the disclosure and this is where "not a condition of purchase" disappears.
[ ] Terminal display of the full disclosure, with a recorded acknowledgement.
[ ] Receipt-based capture reviewed: a number written on a paper form and typed in later has no timestamp and no rendering.
[ ] Store-level opt-out capture writing to the same suppression store.

Ecommerce and subscription.

[ ] Checkout consent separate from terms acceptance and from account creation.
[ ] Cart-abandonment messages classified as marketing, because they are.
[ ] Renewal and billing notices kept clean of offers, or routed through the marketing check.

Marketplace or platform with sellers.

[ ] Determine who is the sender for messages to buyers — the platform, the seller, or both — and contract accordingly.
[ ] Confirm sellers cannot message buyers outside the platform's consent framework.
[ ] Flow suppression down to sellers and to any seller-facing messaging tools.

Franchise or dealer network.

[ ] The highest-risk model on this list. Krakauer v. Dish Network is the case to read.
[ ] Central suppression consumed by every franchisee or dealer, with contractual obligation and audit.
[ ] Central do-not-call policy and training extended to the network.
[ ] Prohibit locally purchased lead lists outright, since that is where the unprovable consents enter.

Lead-generation-dependent business.

[ ] Treat Phase 14 and Phase 15 as the core of the program rather than an appendix.
[ ] Route all vendor-sourced identifiers into a segregated segment with its own consent metadata, so the exposure is always measurable.
[ ] Re-test every vendor quarterly rather than annually.

Regulated sector — health, financial, insurance.

[ ] Layer the sector-specific consent and content rules on top of everything here.
[ ] Confirm that service messages carrying regulated content are not routed through marketing systems.
[ ] Confirm vendor processing terms satisfy the sector regime as well as the state privacy statutes.

Phase 27. The twelve-month build

[ ] Month 1. Ten-number test. Stream and system inventory. Provenance audit begun.
[ ] Month 2. Exposure model complete. Executive presentation and funding decision.
[ ] Month 3. Consent screen rebuilt on the highest-volume surface; point-of-sale and call-center scripts rewritten.
[ ] Months 4-5. Consent record schema live on new captures; rendering archive capturing on deploy.
[ ] Month 6. Suppression consolidated; every sender re-pointed, including loyalty and app push. Monthly STOP test begins.
[ ] Month 7. Do-not-call policy published, training delivered, internal list consolidated, scrub schedule documented.
[ ] Month 8. Vendor evidence tests run; contracts renegotiated; failed vendors terminated.
[ ] Month 9. Template governance; transactional and marketing separated at the platform level.
[ ] Month 10. Re-permissioning campaign, by email.
[ ] Month 11. Backfill legacy records where source systems still hold them; formally retire the rest.
[ ] Month 12. Full audit, timed retrieval test, metrics baseline, owner named, annual review calendared.

What defensible looks like along the way. After month 3, new captures are clean. After month 6, revocation failures stop. After month 8, vendor exposure is bounded. After month 10, the unknown segment is retired. A company interrupted by a lawsuit at month 7 is far better placed than one that never started, and the build record is itself a good-faith exhibit.

Phase 28. The demand-letter sequence, week by week

[ ] Week one — freeze and count. Suspend the campaign and every similar send. Determine exactly how many messages went to how many unique identifiers, on which dates, through which platform, and under which consent source. The number nobody can produce quickly is how many came from purchased leads.
[ ] Week two — the consent inventory. Classify every recipient by consent source: direct web, in-store, point of sale, app, lead vendor, unknown. Pull complete records for a random sample of fifty and count the complete ones. That proportion is the settlement value.
[ ] Week three — the vendors. Demand full records for the identifiers each vendor supplied, on a two-week deadline. Vendors who cannot produce in two weeks generally cannot produce at all, and their numbers should be treated as unconsented for planning purposes.
[ ] Week four — the legal assessment. Identify the counts pleaded and test each: autodialer, prerecorded voice, § 227(c) do-not-call, and any state statute. Assess standing under TransUnion v. Ramirez.
[ ] Then answer the two questions that set value. What proportion of the putative class has a complete, retrievable consent record — because that is both a merits defense and the predominance argument. And did suppression work, because a plaintiff who texted STOP and received another message has clean facts and a treble-damages argument.
[ ] Report the pattern honestly. Companies with good records defeat certification and settle for a fraction. Companies without records settle on the exposure arithmetic rather than the merits, because a defense with no evidence cannot be litigated.

Phase 29. What to say to marketing operations

[ ] Lead with the arithmetic, not the doctrine. "Every text without permission is five hundred dollars, and we sent four hundred thousand" changes behavior; a memo about Facebook v. Duguid does not.
[ ] Name the trade explicitly. Re-permissioning costs list size. State the number, state the exposure it removes, and let the executive team choose.
[ ] Give a fast lane. A new capture surface gets consent-language review in days, or teams ship without asking.
[ ] Make one metric theirs. Consent completeness rate by surface is a number marketing operations can own and improve, which turns an obligation into a scoreboard.
[ ] Say the two sentences that stick. "A list you bought does not come with the permission — the permission was given to whoever asked, and that was not us." And: "Email is a permission-to-stop system; texting is a permission-to-start system."

Outcome. The ten-number test returned three complete records in nine days. The provenance audit found fifty-two percent clean, nineteen percent missing the "not a condition of purchase" element because the point-of-sale script omitted it entirely, twenty-one percent purchased leads, and eight percent unknown legacy. Of four lead vendors, one produced records in three days, two produced partial records after three weeks, and one never responded — that one had supplied ninety thousand numbers, all of which were suppressed. Three sending systems consumed three different suppression lists, and a sample of two hundred suppressed identifiers found eleven had been messaged afterward, all through a loyalty platform nobody had connected. Consent screens were rebuilt across six surfaces, the record schema and rendering archive took three sprints, suppression was consolidated, and the unknown and failed-vendor segments were re-permissioned by email, recovering about eleven percent. Fourteen months later a demand letter arrived; complete records were produced for the great majority of recipients within a week, certification was defeated on predominance, and the individual claims resolved for a small fraction of the exposure model.

Key Authorities at a Glance

| Authority | Proposition | |---|---| | 47 U.S.C. § 227(b) | Autodialer and prerecorded voice prohibitions | | 47 U.S.C. § 227(c) | Do-not-call protections; private action | | 47 C.F.R. § 64.1200 | Consent definitions; internal list rules | | Facebook v. Duguid | ATDS requires a number generator | | Marks v. Crunch San Diego | Broader reading, abrogated | | Gadelhak v. AT&T | Narrower reading | | ACA International v. FCC | Prior interpretation set aside | | Barr v. American Association of Political Consultants | Exception severed | | Gager v. Dell Financial Services | Consent is revocable | | Van Patten v. Vertical Fitness Group | Revocation by any reasonable means | | Campbell-Ewald v. Gomez | Messages sent on a seller's behalf | | Krakauer v. Dish Network | Seller liability for dealer conduct | | Mims v. Arrow Financial Services | Federal jurisdiction | | Spokeo v. Robins | Concrete injury | | TransUnion v. Ramirez | Concrete harm | | 15 U.S.C. § 7702 | Commercial versus transactional | | 15 U.S.C. § 7704 | CAN-SPAM requirements | | 15 U.S.C. § 7706 | Enforcement; no general private action | | 15 U.S.C. § 7707 | Preemption of state email law | | 15 U.S.C. § 7001 | Electronic signatures | | 15 U.S.C. § 45 | Unfair or deceptive practices | | 16 C.F.R. Part 310 | Telemarketing Sales Rule | | Fla. Stat. § 501.059 | Florida statute | | Okla. Stat. tit. 15 § 775C.1 | Oklahoma statute | | Wash. Rev. Code § 19.190.060 | Washington statute |

The five things people get wrong

Treating SMS like email. Email is a permission-to-stop system; texting is a permission-to-start system with five hundred dollars per message attached. This one confusion produces most of the exposure in this practice.

Bundling consent into one checkbox. Terms acceptance, email marketing, and SMS marketing captured by a single control captures none of them properly, and the promotion entry form is where this happens most.

Omitting "consent is not a condition of any purchase." The single most commonly missing element, and its absence invalidates the entire consent no matter how good the rest of the screen is.

Running more than one suppression list. Revocation failures are the easiest violations for a plaintiff to prove, because the company's own logs show the STOP and then show the next message.

Buying leads and relying on indemnity instead of evidence. Ask each vendor to produce five complete records today. A vendor that cannot produce the record is usually also a vendor that cannot pay the judgment.