Defense Strategy, Not
General Information.

Facebook v. Duguid (2021) narrowed the autodialer definition to equipment that uses a random or sequential number generator, eliminating ATDS liability for predictive dialers and contact-list systems that had been the primary target of pre-Duguid litigation. The ruling changed the landscape without ending it. Prerecorded message liability continues independently under § 227(b)(1)(A)(iii) and (B). State law analogues, particularly CIPA and the Florida FTSA, impose liability under separate frameworks unaffected by Duguid.

TCPA liability turns on consent. The burden of demonstrating consent falls on the defendant. That means the defense begins not in court, but in the consent capture architecture: how opt-in is obtained, what language is used, how consent is documented, and how revocation is processed and recorded.

TCPA class certification requires that common questions predominate under Rule 23(b)(3). The consent defense almost always defeats predominance when the defense builds the factual record, because consent is obtained differently for different class members. Different web forms, different opt-in mechanisms, different points of sale. The certification defeat is in the evidence of those individual variations.

For defendants with consumer-facing agreements that include class action waivers and arbitration provisions, Concepcion and its progeny enable enforcement that eliminates class exposure entirely. The analysis includes: whether the arbitration agreement covers the specific claims; whether the class waiver is enforceable in the relevant circuit; and whether retroactive enforcement is available for pre-implementation claims.

Both CIPA § 631 and the Federal Wiretap Act contain party exceptions: a party to a communication cannot intercept it. The critical question in session replay and website chat cases is whether the software vendor qualifies as a party to the communication or as a third-party interceptor. Courts have split on this question, with the answer turning on the specific facts of the vendor relationship, the data sharing agreement, and the nature of the communication being recorded.

TransUnion LLC v. Ramirez (2021) established that plaintiffs must demonstrate concrete harm, not just a statutory violation, to establish Article III standing in federal court. In privacy cases where plaintiffs allege recording or interception but no actual injury, standing challenges at the motion to dismiss stage have succeeded in ending the litigation before it reaches the certification stage.

The consent defense in CIPA and Wiretap Act cases parallels the TCPA consent defense. The quality of the consent depends on the disclosure: what the cookie banner or privacy notice says, whether it accurately describes the use of session replay or recording tools, and whether meaningful consent was obtained before data collection began.

AT&T Mobility v. Concepcion (2011) established that the Federal Arbitration Act preempts state law rules that would invalidate class action waivers in arbitration agreements. Epic Systems v. Lewis (2018) extended that protection to employment contexts. The result is a robust legal framework for enforcing class waivers, but the enforcement depends entirely on the quality of the agreement’s drafting, presentation, and implementation.

An arbitration program fails at enforcement if any of several implementation requirements are not met: the agreement must be presented in a manner that creates mutual assent; the class waiver must be conspicuous and specific; the arbitration provision must cover the claims being asserted; and the agreement must have been in effect at the time of the conduct giving rise to the claim.