Key Takeaways
- Automated SMS to skip-traced numbers without prior consent creates TCPA liability of $500-$1,500 per message.
- A 5,000-message non-compliant campaign theoretically exposes the sender to $2.5M-$7.5M in statutory damages.
- TCPA compliance requires prior consent, DNC scrubbing, real-time opt-out processing, and sending time restrictions.
- Manual one-to-one texting carries lower TCPA risk than automated bulk SMS for initial outreach to unconsentented contacts.
This case study examines a real estate investor who received a TCPA demand letter after a bulk SMS marketing campaign. The case illustrates the legal exposure from non-compliant outbound marketing and the compliance infrastructure needed to prevent violations.
Case Context: The SMS Campaign Gone Wrong
A wholesaler in Florida used a skip tracing service to obtain phone numbers for 5,000 property owners matching their buying criteria (absentee owners, high equity, properties older than 20 years). The wholesaler uploaded the list to an SMS marketing platform and sent a campaign: "Hi [Name], I'm interested in buying your property at [Address]. Would you consider selling? Reply STOP to opt out." The campaign generated 250 responses—including 15 angry replies, 3 formal cease-and-desist letters, and 1 demand letter from a consumer attorney representing a class of 12 recipients. The attorney alleged TCPA violations: the SMS messages were sent using an automated system to cell phone numbers without prior express written consent. The attorney demanded $18,000 in settlement ($1,500 per recipient x 12 class members) and threatened a broader class action if not resolved.
Legal Analysis and Exposure
The legal analysis revealed significant exposure. The TCPA prohibits sending automated text messages to cell phones without prior express written consent. The skip-traced phone numbers were obtained without the property owners' knowledge or consent. The SMS platform's autodialing capability likely qualified as an "automatic telephone dialing system" under the TCPA. The opt-out mechanism in the message, while required, does not substitute for prior consent. Total theoretical exposure: 5,000 messages x $500 minimum statutory damages = $2,500,000. With the willful violation multiplier ($1,500 per message): $7,500,000. Even limiting the class to the 12 identified claimants: $6,000-$18,000. The wholesaler's attorney recommended settling for $12,000 (approximately $1,000 per claimant) to avoid the risk of a broader class action that could include all 5,000 recipients. The settlement included: $12,000 payment, agreement to implement TCPA-compliant marketing procedures, and a 12-month compliance monitoring period.
Compliance Remediation
The wholesaler implemented a comprehensive TCPA compliance program. Consent Management: all outbound SMS marketing now requires prior express written consent obtained through opt-in web forms, in-person signup cards, or verbal consent documented in the CRM with date, time, and method. DNC Scrubbing: all outbound lists are scrubbed against the national DNC registry and the company's internal DNC list before every campaign. The internal DNC list includes everyone who has ever replied "STOP" or requested removal. Platform Compliance: the SMS marketing platform was configured to automatically honor opt-out requests in real time, include compliant opt-out language in every message, enforce sending time restrictions (no messages before 8am or after 9pm recipient's time zone), and maintain consent records with timestamps. One-to-One Texting: for initial outreach to skip-traced contacts, the wholesaler switched to one-to-one manual texting from a personal phone (not an automated system)—which has different TCPA requirements and lower risk when done properly and at reasonable volume. Automated SMS is now reserved for contacts who have provided prior consent. Cost of compliance: $12,000 settlement + $8,000 legal fees + $3,000 compliance program setup = $23,000 total. Annual compliance maintenance: approximately $2,000/year for DNC scrubbing subscriptions and consent management tools.
Compliance Checklist
Control Failures
Sending automated bulk SMS campaigns to skip-traced phone numbers without prior express written consent.
TCPA violation liability of $500-$1,500 per message. Class action attorneys actively target non-compliant SMS campaigns.
Correction: Obtain prior express written consent before automated messaging. Use manual one-to-one texting for initial outreach to skip-traced contacts.
Not maintaining an internal Do Not Call list alongside the national DNC registry.
Contacting people who have previously opted out violates TCPA even if they are not on the national DNC registry.
Correction: Maintain an internal DNC list of every contact who has opted out, sent STOP, or requested removal. Scrub against both internal and national DNC lists before every campaign.
Relying on the SMS platform's compliance features without understanding the legal requirements.
Platforms provide tools (opt-out management, sending windows) but do not verify prior consent—compliance remains the sender's legal responsibility.
Correction: Understand TCPA requirements independently of platform features. Maintain your own consent records, DNC lists, and compliance documentation.
Sources
- SBA — Customer Relationship Management(2025-01-15)
- FTC — Data Security for Small Business(2025-01-15)
Common Mistakes to Avoid
Sending automated bulk SMS campaigns to skip-traced phone numbers without prior express written consent.
Consequence: TCPA violation liability of $500-$1,500 per message. Class action attorneys actively target non-compliant SMS campaigns.
Correction: Obtain prior express written consent before automated messaging. Use manual one-to-one texting for initial outreach to skip-traced contacts.
Not maintaining an internal Do Not Call list alongside the national DNC registry.
Consequence: Contacting people who have previously opted out violates TCPA even if they are not on the national DNC registry.
Correction: Maintain an internal DNC list of every contact who has opted out, sent STOP, or requested removal. Scrub against both internal and national DNC lists before every campaign.
Relying on the SMS platform's compliance features without understanding the legal requirements.
Consequence: Platforms provide tools (opt-out management, sending windows) but do not verify prior consent—compliance remains the sender's legal responsibility.
Correction: Understand TCPA requirements independently of platform features. Maintain your own consent records, DNC lists, and compliance documentation.
"Data Governance, Privacy Regulations & Breach Prevention" is a Pro track
Upgrade to access all lessons in this track and the entire curriculum.
Immediate access to the rest of this content
1,746+ structured curriculum lessons
All 33+ real estate calculators
Metro-level data across 50+ regions
Test Your Knowledge
1.What is operational risk?
2.What is a risk register?
3.What is the Recovery Time Objective (RTO)?