Sales Reps Texting From Personal Phones: TCPA Risk for Employers

It can be. When a sales rep texts a customer about your products, the law can treat the text as your company’s, even from the rep’s own phone. Hand-typed texts rarely raise autodialer issues. The bigger risk is quieter: a customer tells the rep to stop, the request never reaches the company’s do-not-call list, and the marketing keeps coming. A company that can rebuild what its reps sent, and what customers said back, often has more defenses than the demand letter suggests.

Is the company liable when a rep texts from a personal phone?

It can be, either because the text went out on the company’s behalf or because the rep acted as its agent.

Start with the Do Not Call claim. The private right of action in 47 U.S.C. § 227(c)(5) belongs to a person who received “more than one telephone call within any 12-month period by or on behalf of the same entity” in violation of the FCC’s rules. In my view, a rep texting a customer to sell the company’s product sends that text on the company’s behalf, whatever phone it came from.

For claims that don’t have “on behalf of” language, agency decides the issue. In its 2013 DISH Network ruling, the FCC said that a person or entity “initiates” a call “when it takes the steps necessary to physically place a telephone call,” and that a seller that doesn’t place the call itself “may be held vicariously liable under federal common law principles of agency.” In passing, the Supreme Court noted in Campbell-Ewald Co. v. Gomez the FCC’s ruling that “under federal common-law principles of agency, there is vicarious liability for TCPA violations,” said the Ninth Circuit “deferred to that ruling,” and added that “we have no cause to question it.” In June 2024, Loper Bright Enterprises v. Raimondo ended Chevron deference, though the Court wrote that “we do not call into question prior cases that relied on the Chevron framework.” And in January 2025 the Supreme Court heard argument in McLaughlin Chiropractic Associates v. McKesson Corp., which asks “Whether the Hobbs Act required the district court in this case to accept the FCC’s legal interpretation of the Telephone Consumer Protection Act.” For a company’s own employees, I wouldn’t expect either development to change much, because in my view the ordinary rule of employer liability applies whatever weight the FCC’s ruling gets.

Employees are the classic case for agency. In Jones v. Royal Administration Services, the Ninth Circuit pointed to the Restatement rule that “[a]n employer is subject to vicarious liability for a tort committed by its employee acting within the scope of employment.” There, an outside telemarketing company made the calls, and the court affirmed summary judgment for the seller because the telemarketers lacked actual authority to make the unlawful calls and the seller didn’t control the manner and means of their work. That reasoning is harder to use for a company’s own sales staff.

In my view, the fight is often over scope of employment. A rep texting a pipeline lead about the company’s product is doing the job. A rep texting a college friend about a side business isn’t. I’d look for defenses in the middle, such as texts the company banned or never knew about. Don’t lean too hard on a written ban, though. The DISH ruling says a seller “may be liable for violations by its representatives under a broad range of agency principles,” including apparent authority and ratification, and a manager who knew reps were texting from personal phones and booked the resulting sales makes the ban look like paper.

Is a text typed on a personal phone an autodialer text?

Almost never. The Supreme Court held in Facebook, Inc. v. Duguid that an autodialer, the equipment the TCPA restricts for calls and texts to cell phones absent consent or an emergency purpose, must have “the capacity to use a random or sequential number generator to either store or produce phone numbers to be called.” In my view, a rep tapping out a message to a contact doesn’t fit. Our post on autodialer claims after Duguid covers the equipment question if a rep’s app sends to a list. I’d expect the Do Not Call counts to carry most of the exposure.

What happens when a customer texts STOP to a rep’s phone?

Expect a plaintiff to argue the company received it, and the company’s records will shape how that argument goes.

A company that makes telemarketing calls to residential subscribers has to keep its own internal do-not-call list, separate from the National Do Not Call Registry (the federal list where people register numbers to block sales calls). Under 47 C.F.R. § 64.1200(d), as in effect on March 7, 2025, a company must keep “a written policy, available upon demand, for maintaining a do-not-call list,” and its people “must be informed and trained in the existence and use of the do-not-call list.” When the company receives a request from a residential subscriber not to be contacted, the rule says it “must record the request and place the subscriber’s name, if provided, and telephone number on the do-not-call list at the time the request is made.” Section 64.1200(e) applies these rules to “telephone solicitations or telemarketing calls or text messages to wireless telephone numbers,” to the extent the FCC described in a 2003 order.

The company must honor a request within a reasonable time, and the current outer limit is in the same paragraph (d)(3): “This period may not exceed 30 days from the date of such request.” The FCC’s 2024 revocation order changes it to “This period may not exceed ten (10) business days from the receipt of such request,” and the FCC’s October 2024 notice sets the effective date for that change as April 11, 2025. The same order codifies, effective the same day, a rule that a consumer may revoke the consent the FCC’s robocall and Registry rules require “by using any reasonable method to clearly express a desire not to receive” more calls or texts from the sender.

Section 64.1200(d)(3) also says that if do-not-call requests “are recorded or maintained by a party other than the person or entity on whose behalf the call is made, the person or entity on whose behalf the call is made will be liable for any failures to honor the do-not-call request.” That sentence addresses outside list-keepers, and the rule doesn’t address a request sent to an employee’s own phone. Still, I’d expect a plaintiff to argue the company received a stop request when its rep did. If the request lives only in the rep’s message thread, the company’s marketing platform may keep texting that number, and that’s the fact pattern these claims are built on.

An opt-out to a rep also ends an exception the company may be counting on. Under § 64.1200(f)(5)(i), a “seller-specific do-not-call request” terminates the established business relationship “even if the subscriber continues to do business with the seller.”

The defenses in § 227(c)(5) depend on records. The statute makes it “an affirmative defense” that the company “has established and implemented, with due care, reasonable practices and procedures to effectively prevent telephone solicitations in violation of the regulations.” The Registry safe harbor in § 64.1200(c)(2)(i) requires a showing that “the violation is the result of error” and that the company had written procedures and trained its people, among other standards. It also requires a list “of telephone numbers that the seller may not contact.” Both turn on records, so opt-outs left on employees’ phones make them harder to prove.

Where are the consent records your reps never logged?

Often they’re on the same phones, and they can help.

A Registry claim requires a “telephone solicitation,” and the FCC’s definition in § 64.1200(f)(15) excludes a message sent with the recipient’s “prior express invitation or permission,” a message to a person with whom the caller has an established business relationship, and a message by or for a tax-exempt nonprofit. The internal-list rule reaches any telemarketing call to a residential subscriber, so these exclusions matter most for Registry counts. In a personal-phone case, the best proof of permission or a relationship is often the customer’s own words in the rep’s thread, such as a request for a quote by text. I’d preserve those threads first. One caution: the Registry rule’s separate permission safe harbor in § 64.1200(c)(2)(ii) says permission “must be evidenced by a signed, written agreement between the consumer and seller,” so a casual text thread fits the definition argument better than that safe harbor. Our post on the scope of TCPA consent covers what a customer’s request allows.

One exemption is easy to miss. The Registry rule in § 64.1200(c)(2)(iii) carves out calls that meet this test: “The telemarketer making the call has a personal relationship with the recipient of the call.” Section 64.1200(f)(17) defines that as “any family member, friend, or acquaintance of the telemarketer making the call.” A rep who texts their neighbor about a promotion may fall inside it. It’s narrow, and it does nothing for internal do-not-call claims.

How the claims and defenses line up

A prerecorded message is one recorded in advance and played to the recipient.

What should a personal-device texting policy require?

It should make the company’s records complete without pretending reps will stop texting.

I think a ban on texting customers from personal phones is weak on its own, because it creates no records and reps who text anyway leave no trail. A better approach gives reps a business-texting app or number that logs every message to the CRM and is easier to use than their phone’s own app. If personal numbers are allowed at all, limit them to customers who asked for texts, and write that limit down.

In my view, opt-out routing is the piece most likely to fail. The written policy should tell reps that any message asking to stop gets logged on the internal do-not-call list the same business day, whether the customer uses a keyword like STOP or just asks in plain English. Train on it and keep the training records, because both defenses are built on them.

Periodic capture fills the rest of the gap. A monthly export or sync of business texts from any device a rep uses for work can catch what reps send before a claim exists. I’d also make capture a step in offboarding, before a departing rep’s phone is wiped or traded in.

What happens to reps’ phones once a claim arrives?

Preserve them quickly, including employees’ own devices.

Discovery reaches electronically stored information in a party’s “possession, custody, or control” under Federal Rule of Civil Procedure 34. Expect a plaintiff to argue that work texts on reps’ phones qualify. Rule 37(e) authorizes remedies when electronically stored information “that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it” and it can’t be restored or replaced through additional discovery. On a finding of prejudice, the court can order measures no greater than necessary to cure it, and the harshest sanctions require a finding of intent to deprive the other side of the information. Beyond the hold notice, I’d tell reps to turn off auto-delete settings and arrange a forensic collection of the relevant threads before any phone is replaced.

Once a demand letter or complaint names your company, work through these steps:

1. Get a hold notice to every rep who may have texted the claimant, covering personal phones, and preserve the company’s platform logs and consent records for that number.
2. Collect the reps’ threads with the claimant, flag any reply that reads as a stop request, and note when it reached the internal do-not-call list.
3. Pull the National Do Not Call Registry scrub records for the number and the dates of the Registry versions the company used.
4. Gather the device policy, training records, texting-app contracts, and any templates reps used.
5. Talk to a lawyer before anyone responds to the demand, contacts the claimant, or offers money to settle.

When a claim involving texts sent by sales staff and opt-out requests that never reached a do-not-call list is filed as a proposed class action, the firm’s page on defending TCPA class actions in California covers what comes next.

Questions companies ask about reps texting from personal phones

Can we text existing customers who are on the Do Not Call Registry?

Sometimes. A purchase or transaction within the 18 months before the text, or an inquiry or application within the prior three months, can create an established business relationship that takes marketing messages outside the Registry rule. That exception ends when the customer makes a do-not-call request to your company, even if they keep buying from you. A stop request sent to a rep’s phone can end it without anyone at headquarters knowing.

Is one text from a rep enough for a Do Not Call lawsuit?

Not under the federal statute. A private Do Not Call claim under § 227(c)(5) requires more than one call or text within a 12-month period by or on behalf of the same company. The risk comes from a pattern: the rep’s text, then the company’s automated campaign to the same number after the customer asked to stop.

What changes for opt-outs on April 11, 2025?

Under the FCC’s 2024 order, the deadline to honor an internal do-not-call request drops from 30 days to ten business days. A codified rule also confirms that a consumer can revoke the consent the FCC’s robocall and Registry rules require by any reasonable method that shows they want the calls or texts to stop. Both changes make an opt-out stranded on a rep’s phone more dangerous, because the clock runs faster and informal replies are more likely to count.

When a rep’s texts become the company’s lawsuit

If your company is accused of texting a customer who told one of your reps to stop, the question is usually what the company knew, when it knew it, and what its records show. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving texts sent by sales staff and opt-out requests that never reached a do-not-call list. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The statute is the Telephone Consumer Protection Act at 47 U.S.C. § 227. The FCC’s rules are at 47 C.F.R. § 64.1200, as published in the eCFR through March 7, 2025. The FCC’s revocation order is at 89 Fed. Reg. 15756 (Mar. 5, 2024), and its effective-date notice is at 89 Fed. Reg. 82518 (Oct. 11, 2024). The FCC’s agency ruling is In re Joint Petition Filed by DISH Network, LLC, 28 FCC Rcd. 6574 (2013).

The court decisions are Campbell-Ewald Co. v. Gomez, 577 U.S. 153 (2016); Facebook, Inc. v. Duguid, 592 U.S. 395 (2021); Loper Bright Enterprises v. Raimondo, 144 S. Ct. 2244 (2024); McLaughlin Chiropractic Associates v. McKesson Corp., No. 23-1226 (U.S. argued Jan. 21, 2025); and Jones v. Royal Administration Services, Inc., 887 F.3d 443 (9th Cir. 2018). The discovery rules are Federal Rule of Civil Procedure 34 and Rule 37.

This post is general information about the Telephone Consumer Protection Act and related laws as of March 7, 2025. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.