We spend a lot of time on this website discussing the dangers inherent in third-party lead generation, but not enough time is spent on the dangers of more basic processes to obtain consumer opt-in.

For instance, even the fairly reliable practice of having consumers enter phone numbers to opt in to text clubs as part of a point of sale transaction has its TCPA risks.

Consider the case of Abboud v. Circle K 2025 WL 307039 (D. Az. Jan. 27, 2025).

There a consumer sued Circle K alleging it was receiving text club notifications for a Tobacco club that she never signed up for.

Circle K responded by filing summary judgment arguing that the phone number at issue was provide don a POS screen with a disclosure and a call to action explaining that by providing the phone number the customer would receive a discount on products in exchange for signing up for the text club.

The POS submission was apparently followed by a double opt in where a message was sent to the number and the person with the handset responded “yes” to confirm their intention to subscribe to the text club.

Here are the messages it sent:

• “Circle K: Reply ‘YES’ to Sign Up to receive special offers via txt message. Msg & Data rates may apply. Txt ‘STOP’ to Opt-Out. 855-276-1947.”
• “Circle K: Reply ‘YES’ to get offers via txt. Go to myck.site/k2KmEU, Age-verify 18/21+ offers. Msg & Data rates may apply. Txt ‘STOP’ to Opt-Out. 855-276-1947.”
• “Circle K: Reply ‘YES’ to get offers via txt. Go to myck.site/Qb9PtF, Age-verify 18/21+ offers. Msg & Data rates may apply. Txt ‘STOP’ to Opt-Out. 855-276-1947.”

Pretty clean right?

Well, not really. Watch.

The Plaintiff contended she never provided her number on the POS display to begin with. So when Circle K thereafter sent three separate requests that the consumer confirm the opt in to complete the process she turned around and sued for TCPA violations.

Circle K raised three arguments against Plaintiff’s claims.

First it argued the messages were not actually marketing because they were merely intended to confirm a transaction. The Court rejected this argument, however, and determined Circle K’s intent must be sent to the jury to decide. That is, a jury might decide Circle K was intentionally marketing to consumers using its opt in message since the opt in included the words “offer” and “special offers”:

“[H]ad merely stated “Circle K, reply yes to confirm the receipt of future text messages,” they would not run afoul of the TCPA. But that is not what the text messages said. Defendant made a discretionary choice to add additional verbiage to the text messages that went beyond confirming the recipient’s consent to receive future messages.”

Wow.

The Court also had little problem finding Circle K could not rely on somebody else’s consent to send messages to the Plaintiff. That issue was determined conclusively by the Ninth Circuit Court of Appeals some time ago and is rarely raised these days. And since Circle K could not prove it was was Plaintiff that actually provided her phone number–as opposed to some other customer that may have entered an incorrect phone number– that issue, too, is headed to the jury.

Defendant also lost on the “established business relationship” defense because it had no evidence Plaintiff had shopped at Circle K within 18 months of the texts at issue. And an established business relationship with the customer providing the number was insufficient– the relationship must be with the party receiving the messages.

So Circle K now must face potentially massive exposure in a TCPA class action because, in essence, every person on the DNC list it sent a confirmation text to that did not opt in might be a wrong number recipient– and have a claim for violation of the TCPA’s DNC rules.

Crazy. But also, seemingly the right result.

Pretty clear take aways here:

1. Businesses should NEVER include advertising content in a SMS opt-in confirmation message. I know there is sometimes pressure to do so but it must be resisted! This is especially true as the carriers essentially require double opt-ins for recurring messages–so the scale of risk a company may face if they get this wrong can be simply enormous;
2. Although this is a wrong number case keep in mind that recurring text clubs can generate massive risk from recycled numbers– numbers that change hands without the business knowing. The TCPA imposes strict liability for all wrong numbers–as Circle K just learned. Protecting yourself by using the Reassigned Numbers Database to detect numbers that change hands over time is critical;
3. Keep in mind that just because a consumer provides a phone number on a POS that does not mean that the consent process is lock solid. Again, consumers fat finger numbers all the time–and sometimes intentionally enter errant numbers. Consider linking POS transactions to identifiable transactions– i.e. limiting POS opt-in displays to credit card transactions as opposed to cash payments. This may help prove a link between the consumer you are texting and the person in the story (Then again it may just prove you texted the wrong person… so watch out.)
4. Notice Circle K could still have won this case if it could prove Plaintiff had visited one of its stores and made a purchase over the last 6 months. The EBR rule is quite powerful for DNC claims. Apparently Circle K had no such evidence, however, and fell back on arguing it had an EBR with the customer in its store that day. But that doesn’t help.

Appreciate you all.