$9.8 Million in Two Texting Settlements: The Growth Playbook Gaps Behind Teleflora and Coast Dental

SMS is one of the highest-converting channels a growth team can run. It is also one of the easiest to get sued over. Two settlements disclosed in October 2026 put a combined price of up to about $9.8 million on two ordinary-looking gaps in texting programs.

The two cases

Teleflora, $6 million. In Carter v. Teleflora LLC (Miami-Dade County Circuit Court, Case No. 2026-012979-CA-01), Teleflora agreed to settle claims that it sent promotional texts to people who never provided their numbers and whose numbers were on the National Do Not Call Registry. The class covers people who received more than one promotional text within 12 months, starting May 9, 2021, on a number registered for at least 30 days. The estimated payout is about $251 per class member. Teleflora denies wrongdoing. The final approval hearing is November 25, 2026.

Coast Dental, up to $3.84 million. In Chaviano v. Coast Dental Services, LLC, filed in Florida in July 2026, Coast Dental agreed to pay up to $3,840,664 over appointment-related texts and calls allegedly sent after consumers replied STOP. The claims were brought under the TCPA and the Florida Telephone Solicitation Act. The class is roughly 24,308 people, each eligible for up to $59 in cash or a toothbrush voucher worth up to $99. The final approval hearing is December 9, 2026.

Gap one: list acquisition without suppression

Teleflora’s fact pattern is a familiar growth move: reach people who are not yet customers. When the number did not come from the person, consent is hard to show, and registry status becomes the whole case. If your acquisition plan includes texting numbers you did not collect yourself, the National DNC Registry check belongs in the pipeline, not in a checklist someone forgets.

Gap two: lifecycle messages that ignore opt-outs

Coast Dental’s fact pattern is subtler. Appointment reminders and scheduling nudges feel like service messages, so they often run on a different system or a different team’s automation. The allegation is that people who opted out kept receiving them. For growth teams, the lesson is that an opt-out has to reach every automation that can send to that number, including retention and re-engagement flows.

Why these become class actions

Both cases are defined by a process, not an individual message. When the same gap affects every recipient, it creates a class. Class sizes in the tens of thousands are normal, and that is how a modest per-person payout becomes a multimillion-dollar fund.

What it costs per contact

A quick way to make this real for leadership: both settlements land at a few hundred dollars or less per class member, but the totals run into the millions because the classes are large. Teleflora’s estimated payout is about $251 per person. Coast Dental’s class is roughly 24,308 people. Multiply a small per-contact risk by a big list and the number gets attention fast. That is the case for spending on suppression before scale, not after.

The growth-safe SMS checklist

  • Document the source and consent for every number in a promotional send.
  • Scrub non-customer numbers against the National DNC Registry before the first message.
  • Route STOP replies to a single suppression list that every sending platform reads.
  • Audit lifecycle and reminder flows, not just campaign blasts.
  • Screen lists for known litigation risk before launch.

That last item is where TCPALitigatorList.com fits into a growth stack. It lets teams check numbers against known TCPA litigators before a campaign goes out, so the contacts most likely to file are removed upstream. It complements consent capture and DNC scrubbing rather than replacing them.

Takeaway

Neither of these settlements came from a novel legal theory. They came from scale meeting a process gap. Growth teams that build suppression and screening into the pipeline can keep texting aggressively without handing plaintiffs a ready-made class.

Sources

When a TCPA Lawsuit Is the Product: What the Human v. Fisher Sanctions Mean for Growth Teams

Growth teams like to think of TCPA risk as a compliance problem: consent language, opt-out handling, calling windows. A ruling out of Missouri is a reminder that part of the risk is something else entirely. Some of the people entering your funnel are not prospects. They are building a lawsuit.

On September 30, 2026, Judge Matthew T. Schelp of the U.S. District Court for the Eastern District of Missouri found that Daniel Human’s TCPA suit against Fisher Investments was brought “in complete bad faith.” The court held Human, his attorney Edwin Butler and Butler Law Group LLC jointly and severally liable for all of the reasonable attorney’s fees Fisher incurred defending the TCPA claims, from the beginning of the litigation (Human v. Fisher Investments, Inc., No. 4:24-cv-01177-MTS).

The setup, as the court described it

The court found that Human provided his number under a fake name to request solicitations, then sued once Fisher called. It called this his “practice” and noted that dozens of earlier defendants had settled similar claims. It also found that Human destroyed his desktop computer two days before a court-ordered inspection and arrived with a decoy laptop, and that his lawyer knew the claims were illegitimate when he took the case.

Fisher must file its fee records by October 22, 2026. Fees for Fisher’s separate fraud counterclaim are excluded from the blanket award.

Why this is a funnel problem

Think about how the lead arrived: a person filled in a request, and the company followed up. From a dashboard, that looks like a healthy inbound conversion. The difference between a buyer and a plaintiff is invisible at the top of the funnel unless you look for it.

That has a few implications for teams that live on lead volume:

  • Lead quality metrics should include legal risk. A source that delivers high contact rates but also delivers repeat litigants is not a good source.
  • Purchased and partner leads deserve the most scrutiny. The further you are from the original form fill, the harder it is to prove consent later.
  • Speed-to-lead has a cost. Calling within seconds is great for conversion. It also means nobody looks at the number before the dialer does.

The settlement math growth teams should know

The detail worth sharing with finance is that dozens of companies settled with the same plaintiff before Fisher fought. That is the rational choice in most cases. Statutory damages under the TCPA run $500 per violation and up to $1,500 if willful or knowing, so a handful of calls can produce a demand that is cheaper to pay than to litigate. Serial filing works because the math works.

Fisher’s result shows what it takes to break that math: litigation running since 2024, a fight over a forensic inspection and a sanctions motion. Most growth-stage companies will never be in a position to do that. They need to avoid the exposure instead.

Build the screen into the stack

The practical answer is to put a check between lead capture and the first touch. TCPALitigatorList.com gives outbound and growth teams a way to scrub numbers against known TCPA litigators and serial filers before they reach the dialer or the SMS platform, so the riskiest contacts never become part of a campaign. It works alongside consent and DNC compliance rather than replacing them.

Pair that with consent capture you can actually prove: the form, the disclosure, the timestamp and the source. If a dispute does come, those records are what let you push back rather than pay.

Takeaway

Human v. Fisher is a rare win against a manufactured TCPA claim. For growth teams, the lesson is not to wait for a court to sort out who is a real prospect. Sort it out at intake, before the first call or text goes out.

Sources

Florida’s Proposed Anti-Spam Act Could Reshape SMS Marketing in a Key Growth State

Florida is one of the largest consumer markets in the U.S. and, for anyone running SMS or outbound programs, one of the most legally complicated. That complexity may be about to grow. On September 17, 2026, Florida Attorney General James Uthmeier proposed the Florida Anti-Spam Communications Act, a crackdown on scam calls and texts that would also change how legitimate marketers handle consent and opt-outs in the state.

For growth leaders, the proposal is a signal to revisit SMS strategy before the bill text arrives, not after.

The proposal at a glance

Announced in Pembroke Pines and covered by Spectrum News, WCTV and TCPAWorld, the proposal centers on fraud: impersonation of government agencies, spoofed caller ID, fake warrants sent by text and undisclosed AI voices used to obtain money. High-volume or high-loss schemes would become heightened felonies with mandatory prison time, and possessing or importing phone farms or SIM farms would itself be a felony.

The parts that touch marketers more directly:

  • Florida’s telemarketing consent law would be tightened.
  • STOP requests would have to be honored “within days instead of weeks.”
  • Carriers would have to authenticate caller ID, respond to traceback requests and stop carrying a named unlawful campaign after written notice.
  • Selling stolen lists used to target Florida numbers would be a separate civil violation.
  • The Department of Legal Affairs would gain independent authority to investigate and to seek injunctions, restitution and civil penalties.

According to Spectrum News, Uthmeier said his statewide prosecution team recovered “about $10 million for victims” over the past year. He also said he expects an AI legislative package “this year.” No bill number, sponsor or session timeline had been published as of late September.

The growth implications

Opt-out speed becomes a deliverability issue. Today, Florida’s FTSA ties a text-message damages claim to a consumer replying STOP and the sender texting again more than 15 days later, according to TCPAWorld’s analysis of Fla. Stat. 501.059(10)(c). The federal TCPA standard is a reasonable time, not exceeding ten business days. If Florida moves to “days,” every connected tool, from your ESP and SMS platform to your CRM, your dialer and any agency partners, has to share suppression data quickly.

Consent sources will get more scrutiny. A tighter consent law plus a civil violation for selling stolen lists puts pressure on third-party lead buying. Growth teams that rely on aggregators should be ready to show exactly where and how each Florida contact opted in.

Campaign continuity risk. Letting the state direct carriers to cut off a named campaign is aimed at scammers, but TCPAWorld notes that the response deadline and any process to challenge a mistaken notice are not yet known. For a brand running a big seasonal push, an erroneous cutoff could be costly.

Prep checklist for marketing teams

  • Map every system that can send a message to a Florida number and measure STOP-to-suppression time.
  • Document consent capture for each lead source, including screenshots, timestamps and language.
  • Keep sender IDs registered and authenticated with your carriers.
  • Assign someone to track the bill when it is filed.

Protect your pipeline from serial plaintiffs

Stricter state rules tend to give plaintiffs new theories, and Florida’s FTSA already carries a private right of action. Smart list hygiene is a growth lever as well as a legal one. TCPALitigatorList.com helps marketing and sales teams screen contacts against known TCPA litigators before launching a campaign, so a small number of high-risk contacts don’t turn a profitable channel into a legal expense.

The takeaway

Florida’s proposal is still early, and the final bill could look quite different. But the direction of travel is faster opt-outs, stricter consent and more state enforcement power. Growth teams that operationalize those principles now will keep their Florida channels open whatever the legislature passes.

Sources

Do-Not-Call Lawsuits Are Shrinking in Some Courts. Here’s How Growth Teams Should Read It.

For growth teams that live on outbound calls and SMS, the TCPA’s do-not-call rules have long been one of the most expensive line items on the risk register. Two federal court decisions handed down in the last week of September 2026 suggest that, in at least some courtrooms, that line item is shrinking. Whether it shrinks for your program depends on where your audience lives and how you run your campaigns.

The two rulings

Internicola v. MortgagePros, LLC (M.D. Fla., Sept. 24, 2026). A federal court in Florida held that the TCPA does not give consumers a private right of action for claims based on the National Do-Not-Call Registry. As reported by TCPAWorld, the court read the statute’s private-right provision, Section 227(c)(5), as covering only regulations the FCC prescribed within the nine-month window Congress set in 1991, which closed on September 20, 1992. The national registry did not exist until 2003. The court also held that texts are not “calls” under the provision.

Koeller v. Ox AppSec Security, Inc. (E.D. Mo., Sept. 30, 2026). A Missouri federal court dismissed DNC claims because, in its view, the TCPA’s do-not-call protections for “residential” subscribers do not reach cellphones. Citing Loper Bright and McLaughlin, the court refused to defer to the FCC’s 2003 interpretation that extended residential protection to cell numbers.

Why this matters for go-to-market

DNC claims are the bread and butter of a lot of TCPA filings because they are easy to plead: a number on the registry, two or more marketing contacts in twelve months, and a demand letter follows. If courts keep narrowing that pathway, the economics of plaintiff-side litigation change, and so does the risk profile of high-volume outbound.

But a GTM leader should read these cases the way they read a single A/B test: interesting, directional, not yet conclusive.

  • Geography is now a variable. TCPAWorld reported on October 5 that California federal courts are still treating SMS as calls for DNC purposes. A text program that is low-risk in one district may be high-risk in another.
  • The rulings are fragile. The Internicola plaintiff has filed a motion for reconsideration, and neither case is an appellate decision.
  • Other claims fill the gap. The cases did not touch Section 227(b) robocall and autodialer claims, and state laws such as Florida’s FTSA carry their own private rights of action.

How to adjust your playbook

Look closely at the Internicola facts. The consumer had engaged with the company about a refinance, then withdrew consent on July 1, 2025, and allegedly received just over a dozen calls and texts in the following ten days. That is not a DNC-registry problem at its core. It is a lifecycle problem: a lead who said stop kept getting touched by automated cadences.

For growth teams, that points to three practical moves:

  • Wire opt-outs directly into your sequencing tools. A stop request in one channel should pause every channel immediately.
  • Keep registry scrubbing in place. It is cheap insurance against jurisdictions that do not follow these rulings.
  • Segment by risk. Know which states and area codes your lists concentrate in, and match your cadence intensity to the legal environment.

Know your audience before you reach out

Every growth marketer knows that list quality drives results. In outbound, list quality also drives legal exposure. A small group of repeat plaintiffs generates an outsized share of TCPA lawsuits, and they are adept at shifting legal theories when courts close one door. TCPALitigatorList.com gives sales and marketing teams a way to screen lists against known TCPA litigators before a campaign launches, which removes some of the highest-risk contacts without slowing down the pipeline.

The takeaway

Late September brought real wins for businesses defending DNC claims, and they reflect a broader trend of courts reading the TCPA strictly after Loper Bright. Still, the smartest growth teams will bank the good news without changing their fundamentals: clean consent, fast opt-outs and smarter list hygiene remain the best growth hedge against litigation.

Sources

AI Is Finding Security Vulnerabilities Faster Than Ever. Can IT Teams Keep Up?

Artificial intelligence is changing cybersecurity in a way that is already creating a major operational challenge for IT departments: vulnerabilities can now be discovered at extraordinary speed, while fixing, deploying, validating, and recovering systems still requires organizations to act.

A September 19, 2026 WIRED report describes a sharp increase in vulnerabilities being uncovered as AI-assisted security research becomes more capable and widely available. The important issue is not simply that more vulnerabilities are being reported. It is whether IT and security teams can remediate those vulnerabilities quickly enough to keep their environments protected.

That distinction matters.

More discovered vulnerabilities do not necessarily mean software suddenly became less secure. In many cases, AI is helping researchers uncover weaknesses that were already there. But once those vulnerabilities become known—and once similar AI capabilities become available to attackers—the pressure on organizations to respond increases.

The Scale of Vulnerability Discovery Is Changing

The numbers cited by WIRED illustrate how dramatically the security landscape is shifting.

Oracle’s July 2026 Critical Patch Update contained 1,448 new security patches across its product families. Oracle specifically recommends that customers remain on supported versions and apply security patches without delay.

Google’s Chrome team experienced a similar surge. According to reporting by WIRED, two major Chrome releases in June contained fixes for 1,072 security bugs—more than the previous 23 major releases combined. Google has responded by experimenting with releasing security fixes twice a week.

Mozilla also demonstrated how dramatically AI can accelerate vulnerability hunting. The Firefox 150 release included protections for 271 vulnerabilities identified using Anthropic’s Mythos Preview AI model.

These examples point toward a cybersecurity environment where finding vulnerabilities may become increasingly automated.

Remediation, however, remains an operational problem.

Finding a Vulnerability Doesn’t Fix It

The UK’s National Cyber Security Centre has highlighted exactly this issue.

Its guidance on AI-based vulnerability discovery emphasizes that simply finding vulnerabilities does not improve security. Organizations must have processes for receiving, prioritizing, fixing, and deploying remedies without overwhelming their security teams. The NCSC also stresses the importance of understanding how software throughout an organization’s environment is patched.

That’s where the AI vulnerability boom becomes an endpoint-management problem.

An organization may know that a vulnerability exists. A vendor may even have already released a patch. But the organization still has to determine which systems are affected, apply the appropriate remediation, verify that endpoint security requirements are being enforced, and deal with systems that become corrupted, compromised, or unusable.

At enterprise scale, those tasks can create an enormous amount of work.

Security Operations Need More Automation

As vulnerability discovery accelerates, manually managing endpoint remediation becomes increasingly difficult.

Swimage is designed around automating endpoint management, security enforcement, remediation, and recovery.

Swimage can continuously monitor endpoints against configurable compliance rules and take predefined actions when a system falls out of compliance. Those actions can include installing software or patches, reinstalling applications or drivers, locking a PC, encrypting it, or initiating a complete system redeployment.

When more extensive remediation is required, Swimage can rebuild a system from known-good sources and restore applications, security policies, settings, and data. The platform is designed to perform these processes on local, remote, and even offline PCs.

That capability becomes increasingly relevant in an environment where security teams may be asked to respond to a growing stream of newly identified vulnerabilities.

Recovery Is Becoming Part of Endpoint Security

Traditional cybersecurity has understandably focused heavily on preventing compromise.

But prevention cannot guarantee that every endpoint will remain healthy forever.

Endpoints can become corrupted. Malware can evade defenses. A bad update can cause operational problems. A newly disclosed vulnerability may require rapid remediation across thousands of devices.

Organizations therefore need both prevention and recovery.

Swimage’s Rapid Recovery capabilities are designed for situations where an endpoint requires more than a routine update. In response to events such as ransomware or malware, Swimage can lock the affected PC, enter recovery mode, rebuild the operating system from a known-good source, reinstall required applications, restore data, rejoin the domain, and return functionality to the user through an automated process.

Swimage does not replace vulnerability research, threat intelligence, or vulnerability-prioritization platforms.

Instead, it addresses another critical part of the security equation: what happens at the endpoint once action needs to be taken.

AI Is Increasing the Speed of Cybersecurity

AI will undoubtedly help defenders.

It can help researchers discover vulnerabilities that might otherwise have remained hidden. It can assist with triage and analysis. And it may eventually automate more of the remediation process itself.

But the transition creates an immediate challenge.

The speed at which vulnerabilities can be discovered is increasing faster than many organizations’ traditional endpoint-management processes were designed to handle.

The answer cannot simply be to give IT teams longer lists of vulnerabilities.

Organizations need security processes that can translate detection into action—quickly, consistently, and across large numbers of endpoints.

That means greater automation of compliance enforcement, remediation, deployment, and recovery.

The AI vulnerability explosion may have started with better tools for finding software flaws.

For enterprise IT teams, the next challenge is making sure their ability to respond and recover scales just as quickly.

Swimage helps organizations automate endpoint remediation, security enforcement, OS rebuilding, and disaster recovery across local, remote, and offline PCs. Learn more at Swimage.com.

Taiwan Cyberattack Shows Why Incident Response Must Get Faster

One of the biggest cybersecurity challenges created by artificial intelligence may not be a completely new class of attack. It may simply be speed.

Taiwan revealed in August that government agencies had been targeted by an overseas AI-assisted cyberattack in July. The Ministry of Digital Affairs said the campaign used a hybrid approach combining traditional hacking activity with AI agents.

Cybersecurity company Dream, which investigated the operation, reported that AI agents were used together as part of a coordinated attack system.

The reported campaign compromised at least 85 government user accounts and extracted more than 2,500 personnel records. Attack activity later extended toward Taiwan’s nuclear safety agency and several energy companies.

The incident provides an important warning for organizations outside government as well: the window between intrusion, discovery and significant damage may be shrinking.

When Attackers Automate, Defenders Cannot Depend Entirely on Manual Response

Incident response has traditionally involved a sequence of actions.

Security teams identify suspicious activity, investigate it, determine its scope, isolate affected systems, eliminate the threat and restore normal operations.

The problem is that every manual step takes time.

AI agents can potentially perform reconnaissance, test systems and coordinate activities rapidly. They can also perform many tasks simultaneously.

If an attacker can automate portions of an intrusion while the defender is waiting for technicians to manually remediate individual computers, the attacker gains an important operational advantage.

This is one reason automation is becoming increasingly important to cyber resilience.

Detection Is Only Part of the Problem

Organizations invest heavily in detecting attacks, and rightly so. But detection does not automatically return a compromised PC to a trusted state.

Once an endpoint has been seriously compromised, an organization needs a reliable way to recover it.

Swimage approaches this problem through automated remediation and system rebuilding.

Swimage can isolate and rebuild affected endpoints from known-good sources, restore applications and settings, enforce required security policies and return systems to operation with minimal manual intervention. Swimage can also take a full-disk snapshot before rebuilding a system so that information can be preserved for forensic investigation.

Because the process is automated, multiple endpoints can be addressed without requiring a technician to manually rebuild each computer.

Preparing for the AI-Assisted Threat Environment

AI-assisted cyberattacks do not mean that every future attack will be completely autonomous. The Taiwan incident itself involved a combination of human direction and AI assistance.

But that may be exactly what makes the development important.

Attackers do not need perfect autonomous hacking systems to become more dangerous. They simply need automation that allows them to operate faster and at larger scale.

Organizations should therefore examine not only how quickly they can detect an attack, but how quickly they can contain, remediate and recover from one.

In an era of increasingly automated attacks, recovery speed is becoming part of cybersecurity.

test test