Sealing Customer Lists and Call Data in TCPA Litigation

A TCPA class action puts a company’s customer phone numbers, call logs, and consent records into discovery, and some of that data will end up attached to court filings. Two tools keep it contained. A protective order limits how the plaintiff’s side can use what it receives, and it’s available for “good cause.” Sealing keeps a filed document out of the public record, and the standard is much higher for anything tied to the merits. Defendants who negotiate the protective order early and file carefully protect their customers and their business.

Why does TCPA discovery create a privacy problem?

Because the evidence is the customer list.

Plaintiffs seeking class certification ask for call detail records, dialer exports, texting-platform logs, and the consent records behind them. Those files contain thousands or millions of phone numbers, often with names, account data, and notes about customer interactions. A company’s customers didn’t sue anyone. In my view, the company owes it to them, and to itself, to keep that data from becoming a public exhibit or a marketing list for the next lawsuit.

Federal rules don’t redact phone numbers automatically. Federal Rule of Civil Procedure 5.2(a) requires redaction of “an individual’s social-security number, taxpayer-identification number, or birth date, the name of an individual known to be a minor, or a financial-account number.” Phone numbers aren’t on that list. Protection has to come from a court order. Our post on keeping TCPA class discovery narrow covers the scope fight that comes first.

What does a protective order do, and what does it take to get one?

It sets the rules for how discovery can be used, and it requires good cause.

Under Rule 26(c)(1), a party “may move for a protective order,” and the motion “must include a certification that the movant has in good faith conferred or attempted to confer with other affected parties.” The court “may, for good cause, issue an order to protect a party or person from annoyance, embarrassment, oppression, or undue burden or expense,” and Rule 26(c)(1) lists orders “forbidding the disclosure or discovery,” “limiting the scope of disclosure or discovery to certain matters,” and “requiring that a trade secret or other confidential research, development, or commercial information not be revealed or be revealed only in a specified way.”

In practice, most TCPA protective orders are stipulated. I’d push for three terms. First, a tier for customer personal information that limits who can see it and bars use outside the case. Second, a rule that the plaintiff can’t use produced numbers to contact customers without court approval. Third, return or destruction of the data at the end of the case. A plaintiff’s lawyer who refuses those terms is telling the court something about why they want the list.

Does a protective order keep documents sealed when they’re filed with the court?

No. Filing changes the standard.

The Ninth Circuit drew this line in Kamakana v. City and County of Honolulu, 447 F.3d 1172 (9th Cir. 2006). Good cause is enough to protect documents exchanged in discovery, but the court held that a good-cause showing “will not, without more, satisfy” the compelling-reasons test that governs records attached to dispositive motions. Those seeking secrecy for such records “must meet the high threshold of showing” that compelling reasons support it.

Later, in Center for Auto Safety v. Chrysler Group, LLC, 809 F.3d 1092 (9th Cir. 2016), the court said the test doesn’t depend on labels. Public access “will turn on whether the motion is more than tangentially related to the merits of a case.” In my view, a class certification motion in a TCPA case will usually be treated as tied closely to the merits. I’d plan as if the compelling-reasons standard applies to anything attached to it.

How do defendants meet the compelling-reasons standard?

By sealing less. In my view, a narrow redaction request has a much better chance than a request to seal whole exhibits.

Kamakana requires a party to “articulate[ ] compelling reasons supported by specific factual findings.” Individual phone numbers and names of non-party customers present the strongest case for redaction, because the public’s interest in the lawsuit doesn’t depend on knowing who a particular customer is. The company’s call volume, its consent procedures, and its scrub practices are what the case is about. Asking to seal those invites a denial.

The practical approach is to file aggregate data and samples, with phone numbers and customer names redacted, and to move to seal only the unredacted versions. Expert reports can often be written to describe the data without reproducing it.

Timing matters too. Before the first filing, check whether the court’s local rules or standing orders put the burden of supporting a sealing request on the party that designated the material, and whether they set a short deadline for that party’s declaration. If they do, a company that designated customer data as confidential should calendar the deadline for every motion the plaintiff files. Missing one can put the data on the public docket even when the protective order was well drafted. Procedures differ by district and by judge, so read the specific court’s rules and the assigned judge’s standing order before anything is filed.

What about California state court?

California’s sealing rule is demanding, and it starts from openness.

Under California Rules of Court, rule 2.550(c), “Unless confidentiality is required by law, court records are presumed to be open.” A court may seal a record “only if it expressly finds facts that establish” an “overriding interest” that “overcomes the right of public access,” that the interest supports sealing, a substantial probability of prejudice without sealing, narrow tailoring, and no less restrictive means. The rule doesn’t apply to discovery motions, but it does apply “to discovery materials that are used at trial or submitted as a basis for adjudication of matters other than discovery motions or proceedings.”

When plaintiffs seek contact information in state court, the California Supreme Court’s decision in Williams v. Superior Court, 3 Cal.5th 531 (2017), sets the terms. That was a representative employment case under California’s Private Attorneys General Act, and the court allowed discovery of employee contact information, while noting in a footnote that “trial courts may also supplement Belaire-West notices with a protective order prohibiting disclosure of any received contact information outside the confines of a specific lawsuit.” A defendant asking for similar limits in a TCPA case is asking for something California courts recognize.

Protective-order and sealing standards side by side

What to do with customer data when a TCPA suit is filed

The firm’s defending TCPA class actions in California page covers how these cases move from complaint to class certification. Early steps:

1. Preserve the call and text logs, dialer and platform exports, and consent records for the proposed class period, under a litigation hold.
2. Export opt-out and internal do-not-call records with dates.
3. Pull National Do Not Call Registry scrub records and Registry versions used.
4. Collect vendor and platform contracts, including their confidentiality and data-security terms, and identify which customer fields each system holds.
5. Talk to a lawyer before producing any customer data, contacting customers about the suit, or agreeing to a protective order.

Questions about protecting customer data in TCPA cases

Can a plaintiff’s lawyer contact our customers using numbers we produce?

Only if the protective order allows it. A well-drafted order bars use of produced data for any purpose outside the case and requires court approval before contacting customers. Negotiate that term before the first production.

Will a court seal our entire call log?

Probably not, if it’s attached to a merits-related motion. Under Center for Auto Safety, filings more than tangentially related to the merits need compelling reasons for sealing. Redacting the phone numbers and names of non-party customers is a much easier request than sealing the whole log.

Does a stipulated protective order bind the court on sealing?

No. Kamakana explained that a good-cause showing under Rule 26(c) doesn’t by itself satisfy the compelling-reasons test. The court decides sealing on its own standard when a document is filed.

Protecting customer data in a TCPA defense

If your company is defending a TCPA class action and the plaintiff wants your customer data, the protective order you negotiate at the start shapes what the public, and the next plaintiff, can see. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including discovery and confidentiality fights over customer call data. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The federal rules are Fed. R. Civ. P. 5.2 and Fed. R. Civ. P. 26. The California rule is California Rules of Court, rule 2.550.

The court decisions are Kamakana v. City and County of Honolulu, 447 F.3d 1172 (9th Cir. 2006); Center for Auto Safety v. Chrysler Group, LLC, 809 F.3d 1092 (9th Cir. 2016); and Williams v. Superior Court, 3 Cal.5th 531 (2017).

This post is general information about the Telephone Consumer Protection Act and related laws as of June 28, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.