Colorado’s PTFA Litigation Wave: Liability for Listing Cell Phone Numbers Without Consent and Why It Puts Data Brokers at Risk

If you list cellphone numbers in a directory for a commercial purpose without consent, you could be liable under the Colorado Prevention of Telemarketing Fraud Act, Colo. Rev. Stat. § 6-1-304(4)(a)(I). A new class action filed in federal court in Colorado pursues exactly this claim, the latest in a wave of similar complaints filed against companies over the last couple of years.

What the law says

Under the Colorado statute:

On or after September 1, 2005, a person commits an unlawful telemarketing practice if the person knowingly: (I) Lists a cellular telephone number in a directory for a commercial purpose unless the person whose number has been listed has given affirmative consent, through written, oral, or electronic means, to such listing[.]

Additional exposure: Data broker laws

If you collect these phone numbers from third parties and make them available to third parties for valuable consideration, you may also be a data broker, subject to registration and consumer rights requirements under the data broker laws of a growing number of states, including California, Connecticut, Vermont, Oregon, and Texas.

What should companies do?

1. Ask the threshold question: are you a data broker? If you collect personal information that does not come directly from the individual and you make it available to third parties, engage counsel to determine whether you qualify as a “data broker” under U.S. state data broker laws, and take the compliance steps that follow. Those steps may include:

• Registration requirements
• Privacy disclosures
• Consumer rights, including the right to delete
• Governance and information security obligations

2. Treat cellphone numbers as more sensitive. If you collect phone numbers, remember that cellphone numbers can carry heightened sensitivity and may require consent up front under the Colorado law.
3. Look downstream. Under the amended Vermont data broker law, data brokers are required to adopt a KYC-like duty regarding the intended use of the information by their recipients. (For more detail, see our prior post on Vermont’s amendments: Vermont Amends Its Data Broker Law – What Do You Need to Know.)

The takeaway:

Listing cellphone numbers without consent, can trigger both telemarketing liability and data broker obligations across multiple states. It is worth mapping where your phone number data comes from, how you use it, and who you share it with. Plaintiffs are increasingly doing that first…