Phone Append and Skip Tracing: Numbers You Found, Not Ones Given

A number a data vendor appended to a customer record was not given to you by the customer, and the FCC’s consent rules are built around numbers people give. The agency’s written-consent standard, explained in its 2012 order, asks whether the person “agrees unambiguously to receive such calls at a telephone number the consumer designates.” With an appended number, the company did the designating. Calling or texting those numbers relies on permission the company hasn’t obtained.

What is a phone append, and why do companies use it?

A phone append matches a customer’s name and address, or an email address, against a commercial database and returns a phone number the customer didn’t give you. Companies use it to fill gaps in their records for marketing or to reach customers who have gone quiet. Skip tracing is similar but aimed at locating someone, often in collections.

The legal question is the same in each case. Did the person with that phone number agree to be contacted by you at it? The answer is rarely yes for an appended number, because the person never saw your sign-up page, never typed the number, and may not be the person your record describes.

What do the FCC’s consent rules say?

They place the act of giving a number on the consumer. For marketing calls and texts that use an autodialer or recorded voice, the FCC requires prior express written consent, defined in 47 C.F.R. § 64.1200(f)(9) as a signed agreement that “clearly authorizes the seller to deliver or cause to be delivered to the person called advertisements or telemarketing messages” and names “the telephone number to which the signatory authorizes such advertisements or telemarketing messages to be delivered.”

The FCC’s explanation in its 2012 order ties consent to the consumer’s own designation. A valid consent shows the consumer “agrees unambiguously to receive such calls at a telephone number the consumer designates.” Nothing in that language contemplates a number that a third party found.

The FCC’s looser line for informational calls doesn’t help either. It rests on a person having released their own number. In its 2015 order, the FCC recited that “persons who knowingly release their phone numbers have in effect given their invitation or permission to be called at the number which they have given, absent instructions to the contrary,” in paragraph 141. The phrase “the number which they have given” is the limit. An appended number was not given.

What about the customer’s other number, or a number that is really theirs?

Even if the appended number belongs to your customer, you have a problem, because the number wasn’t given for the purpose you want. The FCC said consumers who provide a number for a limited purpose “do not necessarily expect to receive telemarketing calls that go beyond the limited purpose,” per FCC 12-21. A customer who gave you an email address for receipts has not agreed to texts on a phone number a database found.

The more common risk is that the number isn’t your customer’s. Data vendors match records on name and address, which produces errors, and numbers change hands. The FCC’s reassigned-number safe harbor in § 64.1200(m) applies to a call to a number “for which the person previously had obtained prior express consent of the called party,” so it assumes there was consent in the first place. For an appended number there wasn’t any consent to begin with.

What about autodialers, and what about manual calls?

The consent rule above applies to autodialed or prerecorded calls and texts. The Supreme Court defined an autodialer narrowly in Facebook, Inc. v. Duguid, as a device that “must have the capacity either to store a telephone number using a random or sequential generator or to produce a telephone number using a random or sequential number generator.” Many texting platforms don’t meet that definition.

That narrows one claim, not the risk. The Do Not Call rules apply to telephone solicitations whatever the equipment, and an appended number on the National Do Not Call Registry can be solicited only with an established business relationship or signed permission. The relationship, as the FCC defines it in § 64.1200(f)(5), rests on a purchase within the prior eighteen months or an inquiry within the prior three. That can exist with the customer. It does not make an appended number the customer’s chosen contact point, and a call to a stranger’s number gets no help from it.

A live, manually dialed call to a customer you have a relationship with is a different matter from an automated campaign. I’d treat any automated marketing to an appended number as high risk and any manual, service-related outreach as a separate question to be reviewed.

How can a company use enrichment safely?

Treat an appended number as a lead, not a contact point. The safest use is to send a single neutral message that asks the person to confirm and opt in, and to send nothing else until they reply. That first message should identify your company, say why you’re contacting them, and tell them how to stop. Even that is a risk when the number belongs to someone else, so many companies prefer to ask for the number directly through a channel the customer already uses, such as an account page or an email.

I’d also read the vendor contract. A vendor that sells appended numbers should state where they come from, what consent the source holds, and who bears the cost of a claim. A representation that a list is clean isn’t evidence that the person agreed to hear from you.

Why do these claims tend to reach the company and not just the vendor?

Because the company is the one that sent the message. A vendor that sold a list is a possible source of reimbursement, but the plaintiff’s claim runs against whoever called or texted, and the seller whose products were advertised can be named too. The vendor contract matters after the fact, as a basis for a cross-claim or an indemnity demand, and not as a defense to the plaintiff.

That is why I’d put the diligence before the purchase. Ask the vendor where each category of number comes from, whether the source collected consent for marketing by your company or for anyone, and how the vendor handles numbers reported as wrong. Keep the answers in writing. A vendor that will not answer those questions in writing is telling you what its answer would be if a claim arrived.

Internal controls count too. If a marketing team can load appended numbers directly into a texting tool, nothing stops a bad batch. A gate that holds appended numbers out of automated campaigns until a person has reviewed the source and the legal basis costs a day and can prevent a class action.

What to gather if a claim over an appended number arrives

1. Pull the vendor contract and any statements about the source of the number.
2. Identify when and how the number entered your system, and whether any customer action supplied it.
3. Export the messages and calls to the number, with times and content.
4. Collect the consent record for the customer, if any, and compare it to the appended number.
5. Wait to respond to a demand letter or contact the recipient until a lawyer has reviewed the file.

The firm’s TCPA litigation defense page describes how these claims move through court. For related reading, see the earlier posts on wrong-number claims and on TCPA vendor contracts and indemnity.

Questions marketers ask about appended numbers

Can we text an appended number if the vendor says it’s consented?

I wouldn’t rely on that. The consent that matters is the person’s agreement to be contacted by your company, and the vendor’s statement doesn’t supply it.

Is skip tracing different for collections?

It is a different context, with different laws, and it raises its own questions about calls to debtors and third parties. The consent problem for automated contact is the same.

What if the appended number matches the customer’s name and address?

A match raises the odds that the number is right. It doesn’t show consent, and it doesn’t protect you if the number was reassigned.

Can we call the number once to verify it?

A single live, manually dialed call raises different questions from an automated campaign. Have counsel review the script and the purpose before you do it.

Defending claims over numbers that were found, not given

If your company has been sued or received a demand letter over calls or texts to a number it obtained from a data vendor, the vendor contract and the record of how the number entered your system will drive the defense. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving appended and purchased phone numbers. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The statute is the Telephone Consumer Protection Act at 47 U.S.C. § 227. The FCC’s rules are at 47 C.F.R. § 64.1200, as published in the eCFR on September 7, 2026. The FCC orders are FCC 12-21 (Feb. 15, 2012) and FCC 15-72 (July 10, 2015).

The court decision is Facebook, Inc. v. Duguid, 592 U.S. 395 (2021).

This post is general information about the Telephone Consumer Protection Act and related laws as of September 7, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.