Fixed Ops Roundtable: The TCPA Compliance Panel ft. Scott Davis and Josh Stevens

Welcome back to the FixOps Roundtable. I'm Sarah Vantyne here with Tedd Angs. Today we have an exciting panel with Volley and a special guest. And Tedd, what an incredible topic for our audience to discuss.

That's right. The last couple months we've been very blessed to have the Volley team joining us on the road throughout the country. Today, Scott Davis, the founder and CEO of Volley, is with us. And first of all, Scott, welcome back to the FixOps Roundtable.

Great to be back. I'm sorry I couldn't make the road. I was actually out of town when everyone was out, but I know Jake and Liza had a great time.

Yeah, you got a great team and we thank you so much and a lot more coming up. I see Josh Stevens is with us, Scott Davis. Tell us a little bit about Josh during the intro.

Yeah, so Volley's a communication platform. All we do is focus on communication. And, uh, McMurray and Schuster, specifically Josh, are our compliance attorneys. Um, I don't like to play lawyer, uh, um, and, and we get these questions every day from, from our dealer customers and, uh, thought it'd be very interesting. I had a couple calls last week and I thought, geez, you know, everyone as they're going into the fall would, would probably like to hear this topic because, because they come up all the time. So So hey, Josh, thanks for joining us.

Thank you for having me.

And Josh, welcome to the Fix Tops Roundtable. Very grateful to have you here as well. So, all right, uh, let's stay compliant, Scott. So with that, uh, I'll let you lead off and, uh, the show is yours.

Yeah, there's a lot of misconceptions, Josh, about, uh, the TCPA text messages, phone calls, etc. Why don't you just start with the very basics? Not every rule, but the very basics of the TCPA.

Yeah, and I think you're absolutely right, Scott. There are a lot of misconceptions, a lot of rumors out there, so let's try to dispel a few of those today. And at the start here, I do have to give the normal lawyer disclaimer that everything I say, it's general education. I'm not your attorney, right? Always talk to your own counsel before acting on anything you hear. But as we think about the TCPA, there are 3 main ways that folks get in trouble. The first is using an automatic telephone dialing system without the right level of consent. Now, what's great about that is the Facebook v. Dugan decision from a couple years ago has really narrowed the scope of that definition, so we don't worry about that one quite as much anymore. The second is with Do Not Call violations, right? You're supposed to scrub that National Do Not Call Registry Before you make a telemarketing call or text. Folks forget to do that. There are exceptions that apply if you have written consent or an established business relationship, but that's a key component. And frankly, that's where we see a lot of the lawsuits these days. And then the third is the use of artificial or prerecorded voices in telecommunications. And with the explosion in AI, that's getting a lot more attention. A lot— auto dealers, folks in every kind of business across the country are looking for ways to utilize AI in their communication channels. That comes with a lot of risk, consent requirements, disclosure requirements. That's another area of growing litigation activity.

Sarah, this is your swim lane. So a lot happening with all of those things that Josh is talking about right now.

Yes. And, you know, my ears perked up quite a bit when Josh mentioned the do not call list because I don't know, Ted, if it's like this with your phone, but I'm on the do not call list and still my phone blows up with all of these unsolicited, unsolicited phone calls, text messages, and communications. So, Josh, I'm curious, you said established business relationship, and for our dealer audience, I'm sure that can mean a lot of different things. You know, I'm thinking from the sales side of the equation with, well, they inquired about a vehicle or I got an internet lead. In my opinion, that's an established business relationship. What does that mean exactly, you know, from the dealer's perspective? And does it vary state to state or are there any other pieces that are important in that consideration?

Yeah. So, Sarah, established business relationship comes in 2 different varieties. The first is what we refer to as an inquiry EBR. That's what you're talking about, right? A consumer submitted a lead, they've called in, they've asked about a vehicle. Under federal law, you have 90 days of an established business relationship based off of that voluntary inquiry. Now, states do differ. Some states don't recognize that. Some states may have a shorter time period of 30 days, but federally, 90 days is that, is that window. The second version is what we call a transactional EBR. That's when a consumer has actually paid you money. They have paid for a good or service from you, and that one lasts for 18 months from that transaction under federal law. Again, states can differ. Some have shorter timeframes. Only a couple don't recognize that, and that's another exemption from that scrubbing against the National Do Not Call Registry. Now, having said that, remember, consumers can always ask to be put on your company Do Not Call list. You should always be scrubbing that unless the consumer gives you written consent after they had asked to be put on that list.

Josh, is that, is that why on the 3 or 4 calls I get every day telling me that they're responding to my loan application, that they are Referring to some kind of an inquiry that I made, which I don't recall making any of them, by the way.

Yeah. And unfortunately, we do see a lot of bad actors out there who will pretend that someone inquired when they didn't actually. And the FCC is trying to crack down on that. Certainly, private litigants are suing when those things come up. If they can track down who made that call or sent that text, that's its own challenge. It's— it is an area where we see dealers get in trouble a lot, is when they don't properly manage that do not call list and that do not call scrubbing.

Um, hey Josh, let's, let's, let's back up a second on that. You said text messages and email and phone calls. Yeah, I get this question every week by our dealers. Um, they think there's different rules for a text message and a phone call. I tell them there's not, just the documentation is a lot better on a text message. Can you talk about how the laws apply for those communications?

Yeah, well, and you're absolutely right, Scott, that the documentation on text is a lot better. It's a lot easier to prove up a claim, right? You've got that whole chat history right there in your phone that you can bring into the lawsuit. From a TCPA perspective, calls and texts are typically treated the same. Now, there have been some recent developments that I'm going to let the group know about because we do get questions about these. The Supreme Court, in a case you all might have heard of called Loper Bright a couple years ago, said that federal courts no longer have to defer to agency interpretations of the law, and courts can, can make their own judgments about what the law says. After that, we have seen federal courts now starting to have some differing views on certain points of the TCPA. One of those is whether text messages are equivalent to calls under the law. The 7th Circuit in July ruled text messages are not calls under the TCPA.

Hmm.

The 9th Circuit a few months earlier said that they are. So we're getting now some differing court opinions. I recommend continuing to treat texts just like calls under the same rules, apply the same standards until the Supreme Court definitively determines whether texts are covered or not.

But now, Josh, I'm sorry, Scott, I'm also thinking in this equation You know, with Scott and Valli, one of the important elements that OEMs oftentimes instill with the dealership is, again, around safety recalls.

Mm-hmm.

And those are communications that, you know, I'm just curious what your perspective is. How do those types of communications apply? Obviously, you know, the customer didn't inquire and they didn't do, you know, a request to be notified. However, now there's some other component from, you know, NHTSA and the OEM regarding a safety piece on the vehicle. How does the law apply in cases like that?

Yeah, the TCPA actually contains an exception for communications impacting the health and safety of consumers. And so if there is a recall, right, an OEM or NHTSA, right, issue a recall related to safety, communications need to go out on that. TCPA, completely gone. You can communicate about that. Where we see dealers get in trouble is when they pair that recall communication with some other marketing content. So for example, they'll say, well, there's a recall on your airbag, come in and get it fixed. We'll also give you an oil change for $10 while you're here if you'd like. Now, that has converted that communication from being a pure safety recall message into a marketing message and triggering all the rules for marketing communications.

Josh, over half of the recalls are not safety-related. They're emissions, they're cosmetic, they're nice-to-haves. It has to be a safety Recall, right?

That's my view. The FCC has not given a definitive interpretation on this, but just looking at the plain language of the TCPA, it talks about the health and safety of consumers. So I think the recall needs to be a safety-related recall in order to qualify.

Okay, and then what if I'm on the Do Not Call list and I no longer own that vehicle? And they're telling me that I need to bring some car I don't own in for a recall. A violation or not?

No, the TC, as long, again, as it is purely that safety recall message, right? Public policy says we want people to get those vehicles in, get them fixed before someone's harmed. So we allow businesses to make some mistakes. in the, in the service of getting those vehicles in for repair.

Yeah. Now, Josh, I'm thinking of another scenario that Scott probably encounters quite a bit, which is the focus on retention, right? There's a lot of focus on, you know, getting vehicles back in for service at different increments. And we're seeing that window of when service and those transactions occur on vehicles going longer and longer. And that's especially true on vehicles like EVs, that may only have one service once a year. So if a transaction has been established, how does a dealer really navigate some of those things that the OEM is wanting them to focus on when it comes to retention if they're outside of that window?

Well, remember that transactional EBR window, at least federally, is 18 months. So if the consumer brought that vehicle in for service and now it's a year later, hopefully you're still within within that window. But I absolutely take your point, right, that you start to— over time, you start to get longer and longer periods between contact with that customer, that customer making another purchase. The issue there is once that EBR is gone, to not have to scrub the National Do Not Call Registry, you either need written consent, and the beauty of written consent is federally it doesn't expire. It can be revoked. The consumer can, can ask to be put on your do not call list, but unless they actively revoke it, it never expires. So that exemption will always be there, and that's why we, we encourage dealers to try to get that express written consent whenever they can and keep good records to prove it, because that's your golden ticket. Otherwise, yeah, you got to scrub against the National DNC Registry, and unfortunately 60 to 70% of numbers are on the registry.

Um, just a couple comments there. Uh, first of all, audience, it is 3 times harder to convert someone who is— who has skipped you once to come back in for service. Keep your active customers active and you shouldn't run into problems federally, at least with them. A lot of the dealers were like, well, my regular customers are coming in anyway. I want to get the people who haven't come in. Um, the, the velocity of your database really matters to your revenue and, and keep your active customers active. Um, Josh, you kind of served up a softball for me. Uh, as with Josh's help, we're, we're developing a way to collect consent and manage consent for our dealers.

Mm-hmm.

We'll have it out by the end of the year. It's called Opti. Part of that is to, is we're gonna give our dealers a, uh, an opportunity to collect legal consent for outbound AI calls, which it's a separate consent. Could you talk about—

Well—

Well, actually, this is the longest question there is, but just so everyone knows, your typical dealer doing a service retention campaign, they can create a class of 300 customers over a few-week period, and there's not as much exposure. A robot can create a class of 10,000 customers, which is a $15 million fine in minutes. So let's talk about how you legally do outbound AI and what you do need to do to comply, because there's a lot of questions and misconceptions on this.

Absolutely. Under the TCPA, to use an artificial or prerecorded voice in a marketing call, You need prior express written consent, and there are specific content requirements for that consent disclosure, and that consumer has to voluntarily give that consent. If it's collected electronically, it needs to be collected in conformance with the eSign Act. If it's collected on paper, you want to get them to separately sign or initial that specific consent. And obviously, you need to, to keep really good records, right? Unless you can prove the consent. The consent's not valuable to you whatsoever. Once you have the consent, then you can use that artificial or prerecorded voice. But I will tell you, and, and, and the audience, there are special disclosure requirements in those calls.

Hmm.

And so the big one is they have to have an automated key press or voice-activated do not call mechanism and give the consumer instructions for how to use that mechanism. That's something that's unique to those artificial or prerecorded voice calls.

Yeah, yeah. Well, that makes a lot of sense. And EBR does not apply to—

EBR doesn't save you. You've got to have the consent.

And it's a separate written consent than just a normal You're coming in for service. Sign this so we can communicate with you about your car.

It's that prior express written consent, that marketing consent. Yep.

Josh, I'm imagining again with this written consent, I'm thinking of our dealer audience. And there's a lot of variables when it comes to their CRMs. They have potentially one for service, one for sales. They have their DMS, all of these separate systems. Which potentially they have to go through efficiently and click all of the internal buttons that flag it as a do not call or a do not communicate. For our dealers that are looking at this, what are some of the best practices to make sure that they maintain and have the right documentation?

Yeah, the first thing I always recommend is if there is a way to centralize your consent and your customer preference records, into a golden master record. That is the best, safest way to do that, right? So think about it like a hub and spoke. You, you have that central system that acts as your golden, and then the spokes go out to your texting platform, your calling platform, your this, your email platform, whatever, whatever other systems need to pull from that central record. That's the best way to structure it so you ensure that all of your consents are being properly maintained. If that's not possible, then unfortunately it really comes down to training, training, training, right? Auditing, making sure that those humans who are responsible for checking those boxes, applying those flags, setting those settings know what they're doing, have gone through the checklist, And have done it all right. Humans are the weakest point in any compliance program. And so, to the extent that you can automate and centralize, set up API connections— we have several clients that use Zapier as a tool to communicate between different systems, right?

Okay.

Those are all different strategies that you can use to try to reduce that human error. Because human error, unfortunately, you know, we all like to think we're perfect at times, right? But human error is the largest source of risk in a compliance program.

There are some new FCC guidelines that take effect on January 31st of next year, and we'll have Josh back on if he'll come on, and we can talk about those as well as what we're building, that hub and spoke system, which we'll have done by the end of the year. Josh, this is the frighten your audience part of the, of the presentation. What, what generally is a class action lawsuit? What are the damages? What are the biggest exposures in the dealership?

So under the TCPA, potential violations are up to $1,500 per call or text in violation. And so if you think about how many calls or texts you send in a day, multiply that by 1,500, you get into millions, tens of millions very quickly.

Quickly. Yeah.

Very, very quickly. I had a client actually fairly recently that had a reassigned number issue. So this is not something we've really talked about much, but if you have consent, or an EBR, if that number gets disconnected and assigned to a new subscriber, those automatically go away. And the FCC has created what's called the Reassigned Number Database that businesses can use to query and see if numbers have been reassigned. It's a great tool. Not a lot of people use it, but people should. Because, for example, we have a client that was sending text messages They weren't scrubbing the reassign number database. They ended up sending, if you tally $1,500 per text, $65 billion of liability of texts. And now, you know, it didn't settle for anywhere near that, but millions and multi-million dollar settlements are not uncommon. In the TCPA space.

Oh, wow. Wow. You know, when Scott told us he had a great topic and a great speaker to talk about it today, Sarah, I had no idea that it was going to be this good. This is so relevant to our industry right now.

So, DNC, artificial voice, or ringless voicemail for you guys who are old enough in the business to remember that. Big exposure.

Yep.

So, but it's not really that hard. You just need to be a little bit thoughtful, right?

It really is. Forget it once you set it, right? Like, you set the rules, you build the process, and then you let the process work.

Okay. Just, there is a couple of little nuances. First of all, someone has to get 2 violations in a 12-month period, and I'll let you do that one. And there is kind of an exception for being an idiot, right? And accidentally screwing up at least once, right?

In the Do Not Call world, that doesn't exist for the artificial or prerecorded voice, but in the Do Not Call rules, you do get essentially one mulligan every 12 months. You get one call or text in violation to a number. So once you've violated twice to that number in 12 months, they can sue on both of them, but they can't initiate the suit until they get that second one in 12 months.

Wow. Wow. It's a good— the CRMs always send a text to see if they can text, they never send a second one to the people. So, and then if you accidentally make a mistake through your best efforts, except for AI voice, you can maybe get out of it once. Is that right?

There is a safe harbor provision for the Do Not Call section of the TCPA. As long as you have compliant policies and procedures, if you have a bona fide error, then you can potentially use that as a shield.

Wow.

Wow. Josh, I know we're running up on time, but one kind of final question, I think, and then turn it back over to Scott. So I'm imagining too, you know, Scott and Volley, these are typically conversations and communications coming from a BDC department, but we know there's lots of other individuals involved in servicing and purchasing the vehicle. So what happens to a business that's allowing sales consultants, service advisors to use their personal cell devices for these types of communications? Does that reflect back on the individual advisor or is the business liable for that?

That's going to get tied back to the business. It is. There actually is a theory under the TCPA where that individual could also be named personally. And so, I always recommend people think about that, right, before they do it. But it's going to get back to the business because ultimately the business is the one that directed and managed that the calls be made.

Right.

And so, I always recommend if you are going to allow sales consultants to use their personal cell phones, have very clear established policies on do not call, on cross-checking against the database of consent. doing all of those things that you need to be doing. But again, you're introducing an opportunity for human error, and that creates risk.

Yeah, yeah. Just, we've got to wrap it up here. So, just very quickly, the 2 questions I didn't get to, if you could just briefly talk about them. First of all, you can get in trouble with email, even though CAN-SPAM is easy to comply with. Talk about what's going on there because there's some new stuff, and then talk about privacy laws across the U.S. and what people need to look out for.

Yeah, so, so real quick on both. As, as you mentioned, Scott, CAN-SPAM does, which is a federal law regulating email, and it's, let's face it, pretty easy to comply with, um, preempts state laws with regard to email except in the context of deception. And we are seeing an explosion of lawsuits across the country by consumers alleging that email subject lines are deceptive and seeking penalties. And just to give you one example, in Washington State, um, consumers can get $500 per email with a deceptive subject line. And so we're seeing class actions forming. This is really exploding across the country. And then with regard to privacy laws, we're now up to, I think it's about 24 states, give or take 1 or 2 how you count them, that have comprehensive privacy laws either in effect or that will be in effect in 2027. Red states, blue states, purple states, north states, south states, they're all over the country. So be sure as a dealer that you're paying attention to what's going on with comprehensive privacy laws in your state. Or in surrounding states that you might service so that you're staying compliant with those because they are really taking off.

Wow.

Sarah, Volley is looking out for the best interest of the retailer and the consumer, I might add. And it's always great to partner with somebody who has the inside information and is aware of the law. And clearly Volley can help our retail partners, our dealers, uh, with that because they're on the forefront. And it sounds like Scott already has some things in the works that we're going to see later this year, maybe around the first of the year, probably in time for Orlando NADA. And, um, Josh, uh, you've also, uh, uh, are a part of a practice there in Ohio. Um, tell us a little bit about that in case our audience wants to reach out directly to you with questions as well.

Yeah, thank you. Yeah, I'm with McMurray& Schuster. We are a boutique consumer protection compliance and defense firm based in Ohio, about 12 attorneys. I'm in Cincinnati, firm's in Columbus, focusing on telemarketing privacy and marketing advertising more generally. Our website is mslawgroup.com. You can email me, jstephens@mslawgroup.com. Always happy to help anybody who is trying to do right by the law and consumers.

Got a feeling you're busy now and will only get busier as we move into the future. So, Josh, thank you so much. First time on the Roundtable. Look forward to having you back with Scott Davis. Scott, what a great, super, super relevant topic. This could be a standalone piece. I think it's going to be as well. And Scott, thank you for this information today.

Yeah, I mean, you know, volley engineers We try to engineer the platform to be compliant, but everyone needs to know these things.

Yeah.

McMurray& Schuster and Josh, they are truly experts. That's why we sought them out. One of a handful of Supreme Court-level arguing firms that do this. I would highly suggest, you know, it's worth an hour of legal time every quarter to double-check your best practices. And you can reach out to me and I'll connect you with Josh or reach out to Josh. It is not that hard, but it does take knowing what it is and just a little bit of work. So.

Great. Josh Stevens, thank you so much for being with our audience here today at the Fixed Ops Roundtable. And Scott Davis, as always, thank you. And Volley, the number one BDC engine, everybody, here with us today at the Fixed Ops Roundtable. volley.com.

Thank you. See ya.