10.2 TCPA, TSR, CAN-SPAM, JFPA, Cable Act, VPPA, DPPA

10.2 TCPA, TSR, CAN-SPAM, JFPA, Cable Act, VPPA, DPPA

Domain II.E performance indicator 1 is a comparison problem. The Body of Knowledge lists the Telephone Consumer Protection Act of 1991 (TCPA), the Telemarketing Sales Rule (TSR), the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM), the Junk Fax Prevention Act of 2005 (JFPA), the Cable Communications Policy Act of 1984, the Video Privacy Protection Act of 1988 (VPPA), and the Driver's Privacy Protection Act of 1994 (DPPA). Teach each statute's trigger and consent or notice rule, then add the Telecommunications Act of 1996 — the BoK's other named telecom statute, and the act that inserted section 222 of the Communications Act — which created customer proprietary network information (CPNI) and is the telecom-privacy companion the exam pairs with the marketing statutes.

TCPA — current consent, not the vacated one-to-one rule

The TCPA, implemented by the Federal Communications Commission, restricts automatic telephone dialing systems (ATDS), artificial or prerecorded voice calls, and robotexts. Facebook, Inc. v. Duguid, 592 U.S. 395 (2021), read ATDS as equipment with the capacity to store or produce numbers using a random or sequential number generator. A marketing platform that merely dials a stored customer list is often not an ATDS after Duguid. Prerecorded or artificial voice to a wireless number still needs the right consent even when no ATDS is used. Telemarketing texts are treated as calls.

Prior express written consent is an agreement in writing, bearing the signature of the person called (electronic signatures count under E-SIGN), that clearly authorizes the seller to deliver advertisements or telemarketing messages using an ATDS or an artificial or prerecorded voice, and that states the telephone number to which those messages may be delivered. The disclosure must be clear and conspicuous. That is the live standard.

Do not teach the 2023 one-to-one consent rule as current law. The Commission's December 2023 order would have required consent to be limited to one seller and to be logically and topically related to the interaction that produced the consent. The U.S. Court of Appeals for the Eleventh Circuit vacated that rule in Insurance Marketing Coalition Ltd. v. FCC on 24 January 2025, holding the Commission exceeded the TCPA's "prior express consent" language. The Commission declined to seek further review and, in an August 2025 final rule, restored the prior PEWC definition without the one-to-one or topical-relationship limits. A 2026 item that treats one-to-one consent as required is testing a vacated rule.

The TCPA also coordinates with the National Do-Not-Call Registry and supports a private right of action: $500 per violation, trebled to $1,500 for a willful or knowing violation. That private action is why TCPA is the high-dollar marketing statute on the exam.

TSR — sales calls, abandonment, and payments

The TSR implements the Telemarketing and Consumer Fraud and Abuse Prevention Act. It is an FTC sales-call rule, not a substitute for the TCPA. Covered sellers and telemarketers must honor the National Do-Not-Call Registry and an entity-specific do-not-call request, stay inside 8 a.m. to 9 p.m. local time, and avoid abusive practices. A predictive dialer campaign may not abandon more than 3 percent of answered calls measured per campaign over 30 days; the call must connect to a live sales representative within two seconds of the completed greeting, and an abandoned call must play a recorded identification of the seller. The Rule restricts advance-fee pitches for credit repair, recovery services, and certain debt-relief programs, and it bans specified payment methods in telemarketing (remotely created checks and payment orders, cash-to-cash money transfers, and cash-reload mechanisms). The FTC and state attorneys general enforce the TSR. Do not invent a consumer private right of action under the TSR itself; the private action for many of the same calls sits in the TCPA.

CAN-SPAM — commercial email without a consent gate

CAN-SPAM applies when the primary purpose of an email is commercial advertisement or promotion of a commercial product or service. Transactional or relationship messages (account statements, warranty information, employment) are not "commercial," but they still may not use false or misleading header information. For commercial messages the sender must:

• Use accurate From, To, Reply-To, and routing information that identifies the initiator.
• Avoid deceptive subject lines.
• Identify the message as an advertisement.
• Include a valid physical postal address.
• Provide a working Internet-based unsubscribe that remains usable for at least 30 days after the message is sent.
• Honor an opt-out within 10 business days, without a fee and without demanding extra personal information.

The exam trap is treating CAN-SPAM as an opt-in statute. It is not. A sender may email a purchased list on day one if the headers are accurate and the unsubscribe works. Enforcement is the FTC, other federal agencies, state attorneys general, and Internet-access providers, which have a statutory right of action. Recipients do not have a general private right of action. Aggravated header falsification can be criminal.

JFPA, Cable Act, VPPA, DPPA, and CPNI

The Junk Fax Prevention Act of 2005 amended the TCPA. Unsolicited fax advertisements are barred unless the sender has an EBR and obtained the fax number through a voluntary communication from the recipient or from a directory, advertisement, or site to which the recipient voluntarily agreed to make the number available. Every such fax must carry a cost-free opt-out on the first page (local or toll-free voice number and a domestic fax number, available 24 hours). The sender must honor the opt-out in the shortest reasonable time, not to exceed 30 days. Purely transactional or informational faxes are not advertisements.

The Cable Communications Policy Act § 551 requires a cable operator to give subscribers written notice, at the time of the agreement and annually, of the nature of PII collected, how it is used, retention, disclosure practices, and subscriber rights. The operator may not disclose subscriber PII without written or electronic consent except as necessary to render service or conduct a legitimate business activity related to the service, or pursuant to a court order with notice to the subscriber. PII must be destroyed when it is no longer necessary for the purpose collected and no pending request or legal retention applies. Section 551 has a private right of action with liquidated damages of not less than $100 per day of violation or $1,000, whichever is higher, plus possible punitive damages and fees.

The VPPA was enacted after a newspaper published Judge Robert Bork's video-rental list. A video tape service provider may not knowingly disclose PII that identifies a consumer as having requested or obtained specific video materials or services. Courts have applied the statute to modern audiovisual subscription and streaming services when the disclosure names a person plus a title. The ordinary course of business exception covers debt collection, order fulfillment, request processing, and transfer of ownership — not an advertising partnership that publishes a subscriber's name next to a specific title. The 2012 amendments allow disclosure if the consumer gives informed, written consent in a separate contemporaneous communication (the social-sharing fix). The private right of action includes $2,500 liquidated damages.

The DPPA forbids a state Department of Motor Vehicles, and most downstream recipients, from disclosing personal information from a motor vehicle record except for a statutory permissible use: government functions, motor-vehicle safety and theft, insurance, certain licensed private-investigator uses, employer verification of a commercial driver's license, and the other listed uses in 18 U.S.C. § 2721(b). Highly restricted personal information is narrower. Reno v. Condon, 528 U.S. 141 (2000), upheld the statute as a valid regulation of interstate commerce. The private right of action includes $2,500 liquidated damages. A marketing desk that buys a DMV list to mail sports-car offers is the classic unlawful use.

CPNI is information that relates to the quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service, made available to the carrier solely by virtue of the carrier-customer relationship, plus information on telephone bills. Section 222 lets a carrier use CPNI to provide the telecommunications service from which it was derived. Sharing individually identifiable CPNI with a third party for marketing requires opt-in customer approval. Using CPNI to market communications-related services of the carrier is the more limited opt-out path under the Commission's rules. Carriers must authenticate the customer before releasing CPNI and must protect it. Interconnected voice-over-Internet-protocol providers are in the CPNI universe; a typical edge website is not a § 222 carrier just because it has a phone number field.

Worked scenario. A fitness company (1) sends a promotional text to a wireless number using a prerecorded voice note, (2) emails a commercial blast to a purchased list, (3) faxes a coupon to a gym that bought plates last year, (4) sells a "members who streamed Spin Class 4" list to an advertiser, and (5) buys a DMV list of convertible owners. The text needs TCPA PEWC (one-to-one consent is not the 2026 rule). The email is legal under CAN-SPAM if headers, identification, postal address, and a 10-business-day unsubscribe are right — no prior consent required. The fax can ride the JFPA EBR only if the number was obtained permissibly and the first page has a working opt-out. The streamed-class list is a VPPA disclosure of specific audiovisual PII, not ordinary-course fulfillment. The DMV list is a DPPA violation unless a listed permissible use applies. Marketing is not one.