Website Visitor Identification and Texts: Intent Data Isn’t Consent

Some marketing tools match an anonymous website visitor to a phone number, so that a company can text a person who never gave it a number. That practice treats a page view as if it were permission. It isn’t. The FCC’s consent rule asks for a signed agreement after a clear disclosure, and the Do Not Call rules ask for an inquiry or a signed permission. A company that buys the numbers and sends the messages carries the risk, whatever the vendor’s sales material says.

Why isn’t a page view consent?

Because the rules ask what the person agreed to, and a visitor agreed to nothing. For autodialed or prerecorded marketing, the FCC defines prior express written consent as an agreement “bearing the signature of the person called” that authorizes the seller to deliver marketing messages and names “the telephone number to which the signatory authorizes such advertisements or telemarketing messages to be delivered,” in 47 C.F.R. § 64.1200(f)(9). The same paragraph requires a “clear and conspicuous disclosure” that the person is not required to sign as a condition of purchasing anything.

The FCC explained the thinking when it adopted the rule. A consumer’s written consent must show that the person received disclosure “of the consequences of providing the requested consent” and “agrees unambiguously to receive such calls at a telephone number the consumer designates,” according to paragraph 33 of the FCC’s 2012 order. The key phrase is “the consumer designates.” In a visitor-identification flow, the company designates the number. The consumer never does.

A visitor who browses a product page hasn’t signed anything or been told anything about texts. Matching that visitor to a number through a data vendor adds a step the consumer didn’t take and doesn’t know about.

Does an autodialer have to be involved?

For the consent rule above, yes, because it governs messages sent with an autodialer or a prerecorded voice. After Facebook, Inc. v. Duguid, an autodialer is a device that “must have the capacity either to store a telephone number using a random or sequential generator or to produce a telephone number using a random or sequential number generator.” Many texting platforms aren’t autodialers on that definition.

That doesn’t make visitor texting safe. The Do Not Call rules apply to telephone solicitations without regard to the equipment, and the FCC’s rule says they reach “telephone solicitations or telemarketing calls or text messages to wireless telephone numbers” to the extent described in its 2003 order, per § 64.1200(e). I would plan on a court applying that reading unless counsel advises otherwise. A number on the National Do Not Call Registry can be solicited if the company has an established business relationship or the person’s permission. The FCC defines the relationship as one based on “the subscriber’s inquiry or application regarding products or services offered by the entity within the three months immediately preceding the date of the call,” per § 64.1200(f)(5). A page view is not obviously an inquiry. A visitor who read about a product has made no request of anyone.

The permission alternative is stricter: “Such permission must be evidenced by a signed, written agreement between the consumer and seller which states that the consumer agrees to be contacted by this seller and includes the telephone number to which the calls may be placed,” under § 64.1200(c)(2)(ii). A matched number has no signed agreement behind it.

What does California add?

For California residents, the state text-advertising statute applies on top of the federal rules. Business and Professions Code § 17538.41 bars a “text message advertisement” to a California resident’s mobile number, with an exception for “a business, candidate, or political committee that has an existing relationship with the subscriber if the subscriber is offered an option not to receive text messages.” A visitor who has never dealt with the company has no existing relationship, so the exception wouldn’t fit.

That statute does not create a damages remedy on its face, but it is another rule a visitor-identification campaign can violate, and it is the type of fact that supports other state claims. I would not build a campaign that depends on stretching the existing-relationship exception to include anyone who clicked an ad.

What should a company do instead?

Ask. A form that invites a visitor to enter a number to receive an offer by text, with the disclosure and the opt-out beside the button, produces the signature, the disclosure, and the number in one act. It converts some visitors, not all, and the people it converts are the ones you can lawfully text. If a vendor tells you it can supply numbers for visitors who never entered one, I’d ask the vendor in writing how it gets the numbers, whether the person ever agreed to be contacted by you, and what it will pay if a claim comes.

A second approach is to use the visitor signal for something other than texting. Retargeting through ads or a landing-page prompt reaches the same person without a text. The TCPA concerns the call or message, and not every marketing channel is one.

Whatever the channel, the contract with a data vendor should state where the numbers come from, what consent the vendor says it holds, and who bears the cost of a claim. A vendor’s statement that a list is compliant isn’t evidence of consent on its own.

How do these claims usually unfold?

They begin with a message the recipient didn’t expect, from a company the recipient may remember visiting. The recipient replies STOP or asks how the company got the number, and the company’s answer is the center of the case. If the answer is that a vendor matched the visitor to the number, the plaintiff has the fact that matters: no one ever gave the company that number to use for texting.

Defendants in that position tend to argue that the vendor said the numbers were consented. That argument may shift some cost to the vendor, and it does little against the plaintiff, because the seller is the party whose burden it is to show the consent. The better defense facts are the ones you build before sending: a number that the person typed into your form, a disclosure beside the button, and a record of the click.

I’d also ask a harder question inside the company before any campaign launches: if the recipient asked where we got this number, could we answer in one sentence without embarrassment? If not, the data source needs another look.

What to preserve when a claim over visitor texts arrives

1. Capture the vendor contract and every statement from the vendor about how the numbers were obtained.
2. Pull the campaign records that show which visitors were matched and when, and what message each received.
3. Export the website logs for the recipient’s visit, if any, and the pages viewed.
4. Collect any form, disclosure, or consent language the person actually saw.
5. Wait to respond to a demand letter or contact the recipient until a lawyer has reviewed the file.

The firm’s TCPA litigation defense page describes how these claims move through court. For related reading, see the earlier posts on TCPA vendor contracts and indemnity and on text-to-join and double opt-in.

Questions marketers ask about texting website visitors

Can we text a visitor who filled out a contact form?

Yes, if the form asked for the number, described the texts, and showed an opt-out, and if the person agreed. The form is the signature and the disclosure. Keep the page version and the submission record.

What if the vendor says the numbers come from consented sources?

Ask to see the consent, meaning the language the person saw, the date, and the party the person agreed to hear from. Consent to be contacted by the vendor or by unnamed partners isn’t consent to be contacted by you. A vendor that cannot produce the record has told you something important about the list.

Is a cart abandonment text different?

If the shopper typed in a number during checkout, the context is different, because the person supplied it. What matters then is what the number was collected for. The earlier post on order and cart texts covers that issue.

Does the vendor’s compliance certificate protect us?

Not by itself. The seller’s burden to show consent doesn’t move to the vendor. A certificate may help in a dispute with the vendor, which is the reason to get it in the contract.

What if the visitor is on the Registry?

Then you need the established business relationship or a signed permission. A matched number with neither is exposed.

Defending claims over messages to matched visitors

If your company has been sued or received a demand letter over texts sent to people who never gave their numbers, the vendor’s records and the campaign data will decide much of the defense. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving marketing texts to people who never signed up. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The statute is the Telephone Consumer Protection Act at 47 U.S.C. § 227. The FCC’s rules are at 47 C.F.R. § 64.1200, as published in the eCFR on July 7, 2026. The FCC order is FCC 12-21 (Feb. 15, 2012), and California’s text-advertising statute is Bus. & Prof. Code § 17538.41.

The court decision is Facebook, Inc. v. Duguid, 592 U.S. 395 (2021).

This post is general information about the Telephone Consumer Protection Act and related laws as of July 7, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.