Login Codes and Security Alerts: TCPA Rules for App Companies
A leading Supreme Court TCPA case about text messages involved a security feature, not an advertisement. Facebook sent login notifications to a number that turned out not to belong to a user, and the Supreme Court ruled for Facebook because its system wasn’t an autodialer. That win came from the equipment, not from any exemption for security texts. An app company that sends codes and alerts has defenses, but they depend on what the message says and who asked for it.
Are verification codes and login alerts covered by the TCPA?
They can be, and the autodialer provision is the usual reason. The statute makes it unlawful to make a call “using any automatic telephone dialing system or an artificial or prerecorded voice” to a cell phone without the called party’s prior express consent, in 47 U.S.C. § 227(b)(1)(A). The Supreme Court has treated texts as calls for this purpose without deciding the question. In Facebook, Inc. v. Duguid, the Court said that “Neither party disputes that the TCPA’s prohibition also extends to sending unsolicited text messages,” and assumed that it does.
The facts of Duguid are the best guide to the risk. Facebook offered an optional security feature that texted users when someone tried to log in from an unknown device or browser. Noah Duguid, the Court wrote, “has never had a Facebook account and never gave Facebook his phone number,” yet he received the messages. In a footnote, the Court added that “it is possible that Duguid was assigned a recycled cell phone number that previously belonged to a Facebook user who opted to receive login notifications.”
That is a recycled-number problem, and it’s the one I’d worry about most for any company that stores numbers and sends automated alerts. The company thought it had consent. The person holding the number now never gave any.
Does the autodialer ruling end the risk?
For many claims, yes. The Court held that an autodialer is a device that “must have the capacity either to store a telephone number using a random or sequential generator or to produce a telephone number using a random or sequential number generator.” Facebook’s system, which texted numbers that users had provided and verified, did not do that, and the opinion explains that a user “must provide and verify a cell phone number to which Facebook can send messages.”
Two cautions follow. First, equipment is a technical question, and I’d confirm it with the engineers who built the sending system before a dispute starts. Second, the autodialer provision isn’t the only way a text can create a claim. The Do Not Call rules and state laws apply to marketing messages whatever the equipment, and an alert that carries a promotion is a marketing message.
What about a code the user asked for?
A code the user requests is on the safest ground. In its 2015 order, the FCC found that “a one-time text sent in response to a consumer’s request for information does not violate the TCPA or the Commission’s rules so long as it: (1) is requested by the consumer; (2) is a one-time only message sent immediately in response to a specific consumer request; and (3) contains only the information requested by the consumer with no other marketing or advertising information.” The text is in paragraph 106 of FCC 15-72.
A passcode that appears seconds after someone taps the button to send a code fits that description, because the user asked for it, it arrives once, and it carries nothing else. Where a product team has built a flow that resends the code repeatedly or on a timer without a new request, I’d have counsel look at it, since the one-time and immediately-in-response conditions are the ones that fail first. The same order stresses the limits: the ruling “applies only when the on-demand text message has been expressly requested by the consumer in the first instance.”
Be candid about what that means for design. A code message that adds a line urging the user to upgrade to a paid plan has more than the information requested. It no longer fits the three conditions. The FCC’s rules define telemarketing as “the initiation of a telephone call or message for the purpose of encouraging the purchase or rental of, or investment in, property, goods, or services,” in 47 C.F.R. § 64.1200(f)(13), and a one-line upsell can be enough to bring a message within it. I’d keep codes clean.
How should automatic alerts be handled?
Alerts the user never asked for in the moment need a stronger basis. Account alerts depend on the user having opted in and on the number being theirs. Three practices make that record defensible:
| Practice | Why it matters | What to keep |
|---|---|---|
| Verify the number before the first alert | A code sent to a number and entered back shows the user controls it, as in the Facebook flow | The verification event and its time stamp |
| Re-verify or retire numbers that go quiet | Recycled numbers are how a stranger ends up receiving alerts | The re-verification schedule and results |
| Check the reassigned numbers database where it applies | The FCC rule gives a safe harbor to a caller who queries it and gets a “no” answer in error | The query, the response, and the date |
The safe harbor in 47 C.F.R. § 64.1200(m) applies only if the person, “bearing the burden of proof and persuasion,” shows it queried the database and received a response of “no.” It is a narrow protection and the caller has to prove each step.
State law is another place to look, and the point is easy to forget when a federal ruling has just gone your way. A win under the federal autodialer definition doesn’t answer a state-law count, which has its own definitions and its own rules for texts, so I’d check each state where your users are located.
What to preserve when an alert claim arrives
- Capture the sending configuration, including how the system selects and stores numbers and how it dials them, because the autodialer question is technical.
- Pull the verification and opt-in event for the number, with time stamps and the screens the user saw.
- Export the full message history to the number, including each template as sent.
- Find out whether the number was recycled by checking account records and any reassigned-number queries.
- Wait to respond to a demand letter or to the person who got the messages until a lawyer has reviewed the file.
The firm’s page on defending TCPA class actions in California describes how these claims move through court. For the autodialer background, see the earlier post on TCPA autodialer claims after Duguid, and for the text-platform angle, who makes the call when a texting platform sends.
Questions app companies ask about code and alert texts
Do we need consent to send a two-factor code?
If the user requested it and the message contains only the code, the FCC’s 2015 order says a one-time text in response to a request doesn’t violate the TCPA. Your sign-up flow should still record that the user supplied and verified the number. That record answers the follow-up question about who owned the number.
Can we add a link to our product in the code message?
I wouldn’t. Adding promotional content takes the message outside the conditions the FCC described and can make it telemarketing under the rule’s definition. Put marketing in a separate message that rests on its own consent.
What if the person receiving the alerts never had an account?
That is the Duguid fact pattern. The Court’s holding turned on the equipment, so a company with a non-autodialer system had a defense even though the recipient never signed up. Stop the alerts promptly when someone reports the problem, and record that you did.
Does the autodialer ruling protect marketing texts too?
It limits the autodialer claim, not the Do Not Call and state-law claims. Marketing texts raise their own rules on permission, quiet hours, and opt-outs, and a company that sends both kinds of message through one platform should keep the two streams, with their consent records, separate from the start.
Who is responsible when a third-party messaging vendor sends the codes?
Your vendor’s role doesn’t automatically move the risk off your company. The earlier post on texting-platform liability covers how courts look at who “made” the call, and your vendor contract should say who keeps the logs and who answers a claim. I’d also ask the vendor for its own description of the sending equipment in writing, since the autodialer defense depends on it.
Defending claims over automated alerts
If your company has been sued or received a demand letter over account alerts, verification codes, or other automated app texts, the sending system’s technical design and the verification records will drive the case. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving automated security alerts and verification texts. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.
Sources
The statute is the Telephone Consumer Protection Act at 47 U.S.C. § 227. The FCC’s rules are at 47 C.F.R. § 64.1200, as published in the eCFR on February 7, 2026. The FCC order is Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991, FCC 15-72 (July 10, 2015).
The court decision is Facebook, Inc. v. Duguid, 592 U.S. 395 (2021).
This post is general information about the Telephone Consumer Protection Act and related laws as of February 7, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.