compliance – Bring To Market

Your Sender ID Is Now a Compliance Surface: The TCPA Claim Marketing Ops Missed

Ask a marketing-ops team to list their TCPA risks and you will hear consent, opt-outs, quiet hours, list scrubbing. You will almost never hear “caller ID.” That gap is now a problem, because a fast-growing 2026 litigation theory targets exactly the thing your team configures and then forgets: the name and number that appear when your call or text lands.

The theory in plain terms

FCC rule 47 C.F.R. 64.1601(e) requires telemarketers to transmit caller identification — identifying information plus a number a consumer can use to make a do-not-call request. Plaintiffs’ firms have reframed this dusty technical requirement as a private cause of action, and courts in 2026 are largely agreeing. More than one federal court has now held that consumers can sue over caller ID failures, including on marketing text messages — meaning your SMS sender configuration is a litigation surface, not just a deliverability setting.

The state of play

It is unsettled in a way that should worry any growth team. On the defense-friendly side, the District of New Jersey held in Zelma v. Ram (May 19, 2026) that showing the brand name “RE/MAX” alongside the number satisfied the rule — recognizable identification was enough. On the other side, a Massachusetts court in Novia v. Mobiz let a caller ID claim on marketing texts proceed past the motion to dismiss, and courts have recognized a private right of action for SMS caller ID defects. The boundary between “compliant” and “class action” is being drawn right now, case by case.

Why GTM teams own this

The caller ID claim is dangerous to a marketing org for one structural reason: it does not depend on consent. Your entire compliance posture might be built around proving opt-in — clean consent records, documented sources, airtight disclosures — and none of it answers a caller ID claim. A perfectly consented audience that receives a text from an unidentifiable alphanumeric sender, or a voice call with no resolvable callback identity, is still a class. At $500 to $1,500 per message across a campaign list, the math is brutal and the defense is narrow.

Building the fix into your stack

Add caller identity to your campaign QA checklist as a first-class item. For SMS, confirm every sending number or short code presents a clear, recognizable business identity and a monitored opt-out and callback path; retire “no-reply” sender configurations for marketing traffic. For voice, verify the CNAM and ANI you transmit resolve to your business name and a working callback line. Document these settings the way you document consent, so you can show a court a deliberate, compliant choice. And track the states — Florida’s 2026 session is considering caller identification mandates stricter than the federal baseline, and a multi-state program needs to plan for the tightest rule, not the loosest.

From a go-to-market standpoint, list hygiene belongs in your campaign QA, not in a legal post-mortem. Marketing-ops teams increasingly screen outbound audiences against TCPALitigatorList.com, the most widely used registry of known TCPA litigators and serial plaintiffs, so a single suppression step upstream stops a known filer from turning a routine nurture flow into a class action. Wiring that check into your audience-build process is a small operational change with an outsized risk reduction.

The bottom line

For years, marketing ops treated sender ID as plumbing. In 2026 it became a compliance surface with its own class-action theory attached. Audit what your campaigns actually display, fix the gaps before a plaintiff documents them, and make caller identity a permanent line in your launch process.

Sources

Zelma v. Ram, 2026 WL 1398784 (D.N.J. May 19, 2026); National Law Review — “MAX TCPA Clarity”; Buchanan Ingersoll & Rooney — “Calling for Clarity: Navigating New Caller ID TCPA Claims Post-Dobronski and McKesson”; Klein Moynihan Turco — “Caller ID and Text Messages”; 47 C.F.R. 64.1601(e).

Your Lead-Gen Stack Is a TCPA Liability Map. A New Ruling Shows Where the Lines Are.

Modern go-to-market motions are rarely a single company calling a single list. They are layered: a lead generator captures interest, a data broker enriches it, an affiliate or BPO places the call, and a brand sits at the end collecting the conversions. Every one of those handoffs is also a potential TCPA liability transfer — and a May 15, 2026 federal ruling just clarified how plaintiffs can, and cannot, walk that chain back to your brand.

The decision

In Sundstrom v. Ocean Reef Media LLC, the Western District of Washington dismissed TCPA claims against two insurance companies. The plaintiff wanted the insurers held vicariously liable for marketing calls placed by another party in the funnel. The court said the complaint had not done the work: it asserted an agency relationship but never alleged the specific facts — direction, control, authorization, ratification — that make such a relationship plausible. Naming the brand at the top of the funnel is not the same as explaining how the brand controlled the call.

Why this is a GTM problem, not just a legal one

Vicarious liability is the mechanism that turns a vendor’s sloppy dialing into your nine-figure class action. The TCPA reaches a brand when it controls how calls are made, authorizes them, ratifies them after the fact, or lets a caller appear to act with its authority. The uncomfortable truth for marketing-ops teams is that the things you do to run a tight, on-brand program — supplying approved scripts, dictating call cadence and hours, handing over targeting lists, monitoring performance dashboards — are the exact facts a plaintiff cites to prove control.

Sundstrom is a reminder that the plaintiff still has to plead those facts specifically. But it is cold comfort if your operational reality hands them the facts on a plate. The ruling rewards companies whose vendor relationships are genuinely arm’s-length, and punishes those whose “vendor” is functionally an extension of the in-house team.

How to map and harden your funnel

Build a liability map of your outbound stack. For every partner that touches a phone number, document who controls the script, the call window, the list, the dialer configuration, and the consent record. Where you can, push genuine control to the vendor and memorialize it: contracts that assign TCPA compliance and consent collection, with indemnification and audit rights. Insist that consent provenance — source URL, timestamp, the exact disclosure language — flows downstream with every lead, because a brand that can prove clean consent rarely needs the vicarious-liability argument at all. And make list scrubbing a contractual deliverable your partners must evidence, not a box they say they checked.

The bottom line

Sundstrom did not narrow the TCPA. It narrowed sloppy pleading. The brands that benefit are the ones whose go-to-market architecture genuinely separates them from the dialing — clean contracts, real arm’s-length practice, portable consent records. Treat your lead-gen stack as a risk surface you actively manage, and the next plaintiff who tries to walk the chain to your door will run out of facts before they reach it.

Sources

Faegre Drinker — “Washington Federal Court Dismisses TCPA Claims, Finding Insufficient Allegations of Vicarious Liability”; Sundstrom v. Ocean Reef Media LLC, No. 26-5036, 2026 WL 1361646 (W.D. Wash. May 15, 2026).

The OpenAI / Twilio TCPA Suit Is a Shot Across the Bow for Every AI-Powered GTM Stack

If your GTM stack uses an AI agent to draft outbound messages, or a CPaaS provider like Twilio to deliver them, the Lowry v. OpenAI lawsuit should be on your radar — and on your CFO’s.

The lawsuit, filed in the Eastern District of Virginia, is the first major TCPA complaint to advance a clean ‘platform liability’ theory against an AI provider and a CPaaS provider for messages sent by a downstream customer. The theory could quietly reset the risk model for every GTM team running AI-augmented outbound.

What the complaint actually says

The plaintiff, William Lowry, alleges he received unwanted marketing text messages from a third party called Fresh Start Group, sent via Twilio-provisioned numbers, that were generated using OpenAI’s platform. The complaint names OpenAI and Twilio as defendants under the theory that they ’caused’ the messages to be initiated.

The proposed class: every U.S. consumer who received a marketing message generated on the OpenAI platform where the number was on the DNC list and OpenAI lacked consent. At $500 per message with a four-year lookback, plaintiff’s counsel has cited theoretical exposure in the trillions. That’s not what they’ll get. It is, however, the number that will frame every settlement conversation.

Why this is a GTM problem, not a vendor problem

The instinct of marketing-ops leaders reading this is to say: ‘good, that’s Twilio’s and OpenAI’s problem.’ That instinct is wrong, for two reasons.

First, if vendors face platform liability, they will push it back into customer contracts. Expect tighter indemnity clauses, mandatory consent attestation, audit rights into your CRM and lead-source records, and the right to suspend service on suspicion of non-compliance. Your GTM stack just became contractually more fragile.

Second, if the platform-liability theory works, plaintiff’s counsel will keep climbing the stack. CPaaS and AI providers are the obvious first targets. CRMs, marketing automation platforms, and lead-gen vendors are the obvious second wave. Eventually, the ask will be: ‘who in this supply chain actually documented consent?’ If the answer is no one — or only the operator at the end — that operator pays.

What GTM and marketing-ops teams should do now

Audit your AI outbound surface. Inventory every use of an AI-generated message in your stack: outbound email personalization, SMS drafting, voice agents, chatbots that escalate to call. For each, write down: who triggered it, what consent was on file, what platform generated it, what platform delivered it.

Reread your CPaaS and AI vendor contracts. Most disclaim TCPA liability and shove it back to the customer. After Lowry, expect renegotiation pressure in both directions — the vendor will want stronger attestations from you; you’ll want clearer indemnity if their inadequate guardrails contributed to a class.

Build a consent ledger. A single source of truth for every number in your outbound stack, with timestamp, source, channel scope, and opt-out status. If a Lowry-style case finds you as a downstream sub-defendant, the ledger is your defense.

Stop using AI to scale calling that wasn’t consented to. The fastest way to land in a Lowry-style class is to use AI to dramatically expand the reach of a list that didn’t have rigorous consent provenance. AI multiplies your risk surface at the same rate it multiplies your output.

For GTM and marketing-ops leaders, this is exactly the kind of risk that should live inside your lead lifecycle, not in legal’s inbox. TCPALitigatorList.com gives revenue teams a way to suppress known TCPA litigators and serial plaintiffs at the top of the funnel — before a number ever hits the dialer, the SMS platform, or a sales rep’s queue. Treat it the same way you treat email-deliverability hygiene: a quiet, automated check that keeps your pipeline from blowing up.

Regulatory backdrop

The FCC has already declared that AI-generated voices count as ‘artificial or prerecorded voice’ under the TCPA, and has issued cease-and-desist letters to infrastructure providers (including Twilio in 2024) over alleged enabling of illegal robocall traffic. Lowry is the litigation-side extension of that regulatory posture.

For GTM teams, the through-line is simple: as AI gets integrated deeper into outbound motions, the legal system is allocating liability across the stack, not just at the customer-facing entity. Build your consent architecture to survive that allocation.

Sources

National Law Review: TCPA Complaint Against OpenAI and Twilio
Lexology: New TCPA Complaint Could Change Everything

If Your Marketing Stack Includes Ringless Voicemail, Read This Before Your Next Campaign Launch

Ringless voicemail (RVM) has lived in a strange corner of the GTM stack for years — a high-deliverability, low-friction channel that growth teams reach for when email and SMS are saturated. The pitch is appealing: messages get into the consumer’s voicemail without interrupting them. The legal reality, in 2026, is brutal.

Two recent cases should reshape how GTM teams think about RVM as a channel — and whether it should remain in the stack at all.

Case one: National Retail Solutions, $6.5M

NRS, a B2B point-of-sale technology vendor, just agreed to pay more than $6.5 million to resolve a TCPA class action over its RVM campaigns. The settlement covers a class capped to messages sent through a single RVM provider, yet still exceeds 50,000 class members each set to receive more than $100. The economics are not subtle.

The GTM read: NRS was running a growth motion that probably looked like a low-risk, high-output channel inside their funnel. It wasn’t. The cost-per-acquisition for that channel — once you back the settlement into the math — has obliterated whatever pipeline it built.

Case two: GoHighLevel + a Las Vegas realtor

A solo realtor in Las Vegas used GoHighLevel to drop ringless voicemails on expired listings. A court certified a TCPA class against her, finding she had no documentation of consent from the class members and that the messages qualified as prerecorded calls subject to the TCPA.

The lesson for GTM and marketing-ops leaders is sharp: your platform’s automation does not insulate you from TCPA exposure. If your stack supports an action, and you take that action, you own the consent risk. The platform doesn’t.

What the FCC actually says

In 2022, the FCC issued a Declaratory Ruling holding that ringless voicemails to wireless phones are ‘calls’ under the TCPA and require prior express written consent. That rule has not been softened. If anything, recent court decisions have hardened it — including a 2025 case holding that simply alleging identical message content is enough to support a prerecorded-call claim at the pleadings stage.

That last point matters operationally. It means a plaintiff doesn’t need a forensic audit of your stack to survive a motion to dismiss. They just need to allege your messages look the same to multiple recipients. Your campaign architecture is the evidence.

The GTM playbook on RVM

Reclassify RVM as a regulated channel. In your lifecycle plan, treat RVM the same way you treat outbound calls — prior express written consent, channel-specific opt-in, DNC scrub, litigator suppression, revocation handling.

Pull RVM from cold motions. If you’re using RVM for prospecting or expired-listing outreach, that is the highest-risk use case and the one courts are most willing to certify against.

Audit consent provenance for every list. Lead vendors that won’t or can’t produce per-number consent records for the RVM channel specifically are a hard pass. ‘They opted in to email’ is not consent to a voicemail.

Set a vendor accountability standard. If your RVM platform’s docs or sales reps still pitch the ‘not a call’ theory, treat it as a risk indicator and document the divergence.

Strategic frame

The RVM channel doesn’t have to be removed from the GTM stack. It has to be repositioned. Used against an opted-in customer base with clean consent records, RVM is a legitimate retention channel. Used as a cold-prospecting workaround for inadequate lead consent, it’s a trillion-dollar-statute waiting to fire.

The NRS settlement and the GoHighLevel certification are the industry’s last polite warning. Treat RVM like a regulated channel, or remove it from the stack.

Sources

National Law Review: $6.5M NRS Ringless Voicemail Settlement
TCPAWorld: GoHighLevel Realtor Faces Massive RVM Exposure

Tennessee’s New Telemarketing Oversight Law Lands July 1 — Build It Into Your GTM Plan Now

For GTM and marketing-ops leaders running campaigns into Tennessee, the calendar just got tighter. Tennessee’s General Assembly passed HB 2408 and its companion SB 2659 unanimously, the Speaker signed off on April 30, 2026, and the bill was transmitted to Governor Bill Lee on May 7. If signed, it applies to conduct on or after July 1, 2026 — right in the middle of Q3 launch season.

This isn’t a federal TCPA story. This is a state regulator getting the keys to your dialer logs, your SMS platform, and your consent records. And it’s a preview of what’s coming in other states.

What GTM teams actually need to know

HB 2408 adds a new oversight layer on top of Tennessee’s existing telephone and text-solicitation framework. The practical effect is three things:

Reporting. Businesses running automated outbound campaigns will need to file periodic reports about their activity. That means your demand-gen team’s dialing volumes are about to become regulator-visible.

Recordkeeping. Consent provenance, opt-out events, and call/text logs will need to be retained in a form the state can review. Your CRM and your dialer have to actually agree with each other.

Solicitation limits. The bill tightens what you can do, when, and how often. Expect operational rules that overlap with but extend beyond the federal TCPA’s calling-hour, frequency, and consent baselines.

Why this is a GTM problem, not a legal problem

Marketing ops teams have spent two years building lifecycle programs assuming the federal TCPA is the ceiling. That assumption is now wrong in at least three states (Tennessee, New York, Mississippi), and the gap is widening as the FCC moves the other direction with its proposed rollback FNPRM.

The GTM cost of getting this wrong is not abstract. It looks like:

— A lifecycle automation that perfectly satisfies federal rules but trips a state reporting obligation you didn’t know existed.

— A nurture sequence that hits Tennessee numbers during a window the new state law restricts, even though it’s fine federally.

— A lead vendor with messy consent provenance that you can’t audit in time to file a clean state report.

None of these are catastrophic in isolation. All of them are expensive to retrofit after a regulator comes knocking.

The 30-day GTM action list

State-segment your outbound. If you don’t already report dialer and SMS volume by state in your marketing ops dashboard, add it this sprint. You can’t manage what you can’t see.

Map every lead source against state rules. Each form, partner, and inbound channel needs a documented consent path that holds up under state-level scrutiny, not just federal.

Get your vendors on side. Push your dialer, SMS, and lead-vendor contracts to explicitly cover state recordkeeping and production obligations. If they push back, that’s signal.

Build litigator suppression into the funnel. Reporting regimes mean every TCPA filing becomes a paper trail back to your funnel. The fewer known-plaintiff numbers in your dial list, the smaller the trail.

The strategic read

Tennessee is a leading indicator. Federal TCPA enforcement is softening, but state-level enforcement is hardening fast — and the states are using the same playbook of reporting + recordkeeping + private rights of action. GTM teams that treat compliance as a 50-state patchwork rather than a single federal program will be the ones who keep growing through the next 18 months without unexpected legal drag.

July 1 is six weeks away. If Tennessee is in your sales territory, now is the time to put this on the marketing-ops roadmap.

Sources

TCPAWorld: Tennessee’s New Solicitation Oversight Law
National Law Review: Tennessee Adds Oversight Mechanism to Solicitation Framework

The $28M SiriusXM Lesson: Your Internal Do-Not-Call List Is a GTM Asset, Not a Compliance Checkbox

SiriusXM’s $28 million TCPA class action settlement reached its final approval hearing on May 11, 2026, capping a case that should be required reading for any GTM organization running an outbound calling motion. The headline is the dollar figure. The actionable insight is what the case reveals about how internal Do-Not-Call lists fail — and why those failures are increasingly a GTM ops problem, not just a legal one.

The case in one sentence

In Campbell v. SiriusXM Radio, Inc., a class of consumers alleged that SiriusXM continued to make telemarketing calls to people who were either on the National Do Not Call Registry or who had specifically asked SiriusXM to stop calling — over a window stretching from April 27, 2019 to October 31, 2025. The size of the class and the duration of the alleged violations point to a systemic operational failure, not isolated incidents.

Why this is a GTM problem

Most large companies don’t actively decide to call people who asked them to stop. The violations accumulate at the seams — the places where customer requests pass between teams, systems, and vendors. Those seams are exactly the places GTM ops typically owns. Specifically:

The opt-out → suppression handoff. A customer texts “STOP” or asks a CSM to remove them. Where does that signal go? In most stacks, it goes to a marketing automation tool or a CRM. Does it propagate to the outbound dialer, the SMS platform, the partner contact pipeline, the data warehouse used for upload to new acquisition campaigns? In most companies, the answer is “yes, partially, with lags.” That’s where Campbell-style cases originate.

The lifecycle marketing seam. A consumer opts out of marketing but stays a customer. Your retention motion fires up a re-engagement push. Whose responsibility is it to confirm the consumer didn’t opt out of all calling? This question is increasingly being litigated, and answer-by-default is starting to fail.

Acquired-data and partner-source contact. A consumer opted out three years ago. Your company acquires a new business unit, ingests its contact lists, and runs a campaign. The opted-out number isn’t on the new list’s suppression — but your master list still has the opt-out. Whose responsibility is it to enforce?

The GTM control plane

The companies that get this right treat their suppression infrastructure as a first-class GTM asset:

A single source-of-truth opt-out table, owned by GTM ops, that ingests opt-outs from every channel (web forms, SMS keywords, inbound calls, email link-clicks, partner-reported opt-outs, postal mail) within hours, not weeks. Outbound sending systems — dialer, SMS, email, partner-facing CDP — read from that table as a blocking check before any send. Migration and acquisition playbooks include a “merge suppression lists” step with reconciliation. Quarterly audits sample random opt-outs and verify zero outbound contact since the opt-out date.

Companies that don’t get this right typically discover the gap only when a plaintiff’s counsel runs the dataset analysis that produced Campbell.

The reputational layer

The brand cost of being a defendant in a case like this is real but often underestimated. The settlement website (sxmtcpasettlement.com) and accompanying claim form become high-traffic destinations for ex-customers, current customers, and prospects researching the brand. The narrative that “this company kept calling people who asked them to stop” surfaces in news coverage, social media, and search results — affecting acquisition and retention metrics in ways that show up in the dashboard but don’t get attributed to the underlying compliance failure.

If your demand-gen motion leans on outbound calling or SMS, a litigator-suppression layer belongs in your stack right next to your DNC scrub and consent-capture audit. Tools like TCPALitigatorList.com index numbers tied to known TCPA plaintiffs and serial filers; running your dialing lists through that file before you hand them off to SDRs or a dialer vendor is one of the lowest-friction risk controls a GTM team can deploy.

The action list for GTM leaders

Within 30 days: map every system that captures an opt-out and every system that initiates outbound contact, and confirm the data flow between them. Within 60 days: stand up a quarterly suppression audit using a random sample of opt-outs. Within 90 days: revise any partner or vendor agreement that involves outbound contact to mandate shared use of your suppression list. The companies that operationalize these basics are the ones whose growth motions look defensible 18 months from now; the ones that don’t are the next round of Campbell defendants.

Sources

Campbell v. SiriusXM Radio, Inc., No. 2:22-cv-2261 (C.D. Ill.); class settlement website (sxmtcpasettlement.com); reporting by Inside Radio, TopClassActions, and Cord Cutters News.