Ep.38 | Why are spam calls STILL a thing?! (Guest: Felix Shipkevich, FinTech Regulatory Attorney)

Show Transcript

Welcome to episode 38 of Privacy Lawls, where I, Donata Stroink-Skillrud, speak with amazing attorneys and privacy professionals, and we have some laughs along the way as well. Today, I’ll be speaking with Felix Shipkevich about do not call rules. Felix is the founder and principal of Shipkevich LLC, a financial services law firm with offices in New York City, Miami, and London.

He advises and defends financial institutions, fintech and digital asset companies, payments firms, and consumer finance businesses in the regulatory, transactional, and enforcement matters. Felix is also a special professor of law at the Maurice A. Dean School of Law at Hofstra University. Felix, thank you so much for joining me on the podcast today.

Thank you for having me, Donata. Um, I’m excited to talk about this topic today because it’s very near and dear to my heart. Um, spam calls are really a persistent issue for many of us. I’d say that I [00:01:00] myself get anywhere from 20 to 30 spam calls and texts every single day and it’s gotten to the point where my phone is essentially unusable, and I know that I’m not the only one who feels that way.

Why is this still such a persistent problem even after decades of laws and regulations designed to stop it? That’s a great question. So I, I probably would draw the following hypothetical, that every one of your listener gets at least multiple calls or texts a day, unwanted spam calls or texts a day, and gets really annoying despite the fact that over the years, both telecom providers and, uh, as well as technology companies that provide telephones like Apple or, uh, if you buy an Android phone like Samsung, for instance, uh, already built-in technology to prevent spam calls from answer- you know, reaching your phone or text messaging.

Unfortunately, the perpetrators are always one step ahead. So which really is the first reason technology has, is evolving. [00:02:00] It’s evolving at such a rapid rate that the, the cost of placing these type of calls or sending you a text message is so de minimis. It’s, uh… I think the, if, if the best way to estimate is every call or text they send is just a tiny fraction of a cent, so if it gets sent in bulk by millions of calls or texts per day, it really doesn’t cost that much for the provider.

So that is one reason. And of course, the the bad players are typically one step ahead of the government or the technology company, so it’s the, the cat and mouse game. The second reason is, uh, many of these spam call or robocall perpetrators, and I am focusing obviously on those that are unwanted, because obviously you also get on daily basis, well, I wouldn’t say daily basis, but quite regularly, phone calls from you know, to confirm your appoi- doctor’s appointment, or if you’re a student, you receive notifications about any type of, um, [00:03:00] uh, emergency alert or even local municipalities and state government could issue these alerts as a result of, you know, for emergency basis like weather and yeah.

Anyway, I think you, you get the point. But the perpetrators that are doing it for illegal purposes are based primarily and substantially overseas. I don’t know the percentage, but I would imagine that probably an overwhelming majority, uh, is based overseas, so the consequences, the legal consequences, the regulatory consequences are not really there.

So, y- you know, the, if your question is why can’t our government try to stop them? Well, it’s very difficult to stop them, right? And then we’ll talk maybe a little bit later on in terms of do telecoms actually have any liability. So yeah. I, I don’t see that the unwanted calls or spams or spam texts are going to go away anytime soon.

And, uh, and it’s also, on a final note, I think it’s very important to distinguish what are the, type of calls or texts that you receive as a result [00:04:00] of a consent versus those that are unwanted and are seeking solicitation or sales purpose. Yeah. I think it’s interesting that you bring up, like, emergency texts or emergency calls for weather or, you know, maybe there’s something happening on a campus.

I feel like because of the amount of spam calls and texts people get, they’re much more likely to miss those, right? Like, if I get- Yeah … 20 to 30 spam texts every day, I’m gonna stop checking my texts, and maybe there’s something really important, like an emergency in there. Yeah. I, I mean, one of the, the best practice for any consumer is when you receive a text that’s unwanted, uh, uh, I, again, I have an iPhone, but, uh, I used to have an Android device, and both platforms provide you with the ability to mark it as fraud or spam.

Which, by the way, is, uh, you do wanna notify that because that automatically gets reported to the Federal Trade Commission. But yeah, see, because of the volume of these type of calls or texts, you [00:05:00] might start ignoring and miss something that is important. Yeah. Perhaps in the future we’ll have a better solution, but at this point, it seems to be a recurring problem that’s, uh, still very difficult to tackle for most consumers.

For sure. Now, when we talk about spam calls, so, you know, let’s say companies are reaching out to me about my extended car warranty that I never- … re- never want-wanted or signed up for, or maybe it’s we’re offering business loans. Um, or maybe there’s robocalls or telemarketing calls or, like, pure scam calls trying to- Mm-hmm

to scam you. Are we actually talking about different things from a legal perspective? Well, I imagine that the calls that you receive concerning your expired car warranty is very likely uh, an unwanted, uh, sales call and probably a scam. I I imagine that if your car warranty was expiring, if you purchased your car directly f- you know, from the car manufacturer, that you probably would get, uh, a [00:06:00] call or email or a text, uh, as a result of a consent you will have provided at some point when you signed the contract.

And even if you bought a co- used car typically you provide consent to be notified if the car still has warranty, of expiring warranty. But yes, you give a very good example. So what I think legally, from a legal perspective, we have to bifurcate this into two buckets. The first bucket is let’s you know, that, that’s the bucket of lawful calls that you get, right?

Where you have provided prior consent, whether it’s written consent, whether it’s express consent, uh, whether it was implied consent. Um, so yeah, these are these calls you get from university, from your doctor’s offices, from schools. You know, I, I, I’ll tell you, I receive at least one to two text messages or calls sometimes simultaneously they come in from my kids’ school district, which is, uh, quite interesting.

They, when they really wanna reach you, they will do their best. But these are the– that’s the bucket of the proper calls, right? The cons- the legal calls, lawful calls. Then there’s a separate bucket, which is basically [00:07:00] everything else. And, uh, we have to be able to distinguish that from those where there is no consent.

You did not provide anyone the right to give your phone number to contact you about a car warranty or, uh, anything else. These days during, you know, as we’re recording this, this is during the, you know, right on, on the footstep of our, you know, the midterm elections. What’s really annoying to me is I get at least half a dozen to sometimes a dozen texts about you know, which candidate I support- fundraising opportunities. And the one that’s, uh, which I think is really funny is, um, uh, those surveys, because I don’t understand how you can conduct a survey and how they select these numbers. But in reality all of these calls that I mentioned, I never provided. I don’t belong to any political party.

I never provided any consent when I vote. I don’t provide any consent for anybody to contact me. So it’s kind of ironic that we, during this time period around the elections, and same thing was two years ago, is when this, you know, [00:08:00] blitzkrieg of calls and texts comes in and, um And, and that also for most part is unlawful.

For I imagine that some of these texts and calls are lawful for those who are supporters of a specific party or those who do wanna participate, have given prior consent, uh, for surveys, but I imagine that the overwhelming majority is probably illegal as well. So I don’t know if that answers your question- Yeah

to separating the lawful, unlawful. My favorite part is where they try to pretend like I gave consent. So they’ll leave a voicemail being like, “You have been inquiring about business loans.” And I have never once inquired about that particular topic anywhere, and they make it seem like I submitted a form somewhere saying that I was interested in this, and I never did.

And for the, the political candidates, I get those as well, and I, I usually text back, “I will be voting for the candidate that does not abuse my privacy by texting me without my consent.” And I’m sure nobody ever sees that, but- Do they ever respond back to you? No. Nobody has ever replied to that. [00:09:00] But it does make me feel better, you know?

Um, and, and that’s what I do, uh, is, “I’ll be voting for the candidate that does not abuse my privacy,” and I’m sure no one cares, but it, it makes me feel better about it. Sure. Yeah. You know, so we’re getting all these calls. We’re getting all these texts. Where are these companies and callers actually getting our phone numbers from?

Is it from data brokers, online forms, public records, information shared by businesses, or something else? And for this in particular, I’m talking about the f- the calls that are completely just off the wall for something that I’ve never been interested in. You know, if I get a call from FedEx being like, you know, “Your package was delivered today,” and I knew I was using FedEx, and I, I get that part where they’re getting the number from.

But what about these companies that I’ve never heard about before? Where are they getting the phone numbers from? Yeah. So the short answer is they’re getting it from every possible place where they could get this, uh, could get your information. In the [00:10:00] age of social media and age where you use y- you know, probably the following will be a slightly politically correct statement.

When you sell your soul to the social media companies to have access to tools and create an account, you essentially give consent somewhere in, you know, uh, their end user agreements that, uh, you will be contacted, you may be contacted. So let’s start with the most obvious one. First of all, there’s a huge industry called the data brokering space. It, it’s big. It… There’s some national data brokers. There are pro data brokers that focus on specific areas. So, as an example that you and I just discussed elections. There are data brokers that just focus on election. So how do they get your data?

How do they get your cell phone number or your home phone number for those who still have home phone numbers? They buy them. They buy them. And then This begs the question is, well, whoever’s selling them this information, where did they get that? They probably bought them themselves, right?

So, so there’s a market out there. And [00:11:00] you can buy data that essentially is, uh, based on your geographic location. It could be broken down by age, gender, your profession, your income. I mean, it, it’s quite amazing. And I’ve seen some of these data broker lists. Uh, it’s, it’s mind-blowing how much someone can know about you and you never knew that your information is out there.

The next is ultimately somehow this information is farmed. This information can be farmed both legally and illegally. Your first question is probably like, “Well, how can it be farmed legally?” Well, you know, if you go back even a few decades ago, some software engineers built, uh, bots that would basically just scan pages and, and, uh, and just extract the data a- and, and put them into either, you know, a CSV file or put into some kind of a data repository where the data would be stored, and that’s how it would be sold, right?

You could probably Google your name or Google my name or anybody else who’s listening, and you could pro- you could find information on probably the home address, the phone number, [00:12:00] ultimately. Uh, you could also buy data from the data broker and then build your own repository and sell that. So there’s a big marketplace.

But that’s lawful, right? There’s nothing… You’re not prohibited from creating a bot and having the bot run and gather somebody’s data. It’s what you do with it that really matters. Then you have a big marketplace in the dark web where they sell your information. Hence why when you have a data breach by law, a company that sustained the data breach, whether it’s a credit card company, whether it’s your bank, or whether it’s, um, a merchant like Target, for instance, had a pretty big, uh, data breach a few years ago.

You’re supposed to be notified that your data was misappropriated. And so how do they… So part of that data breach typically goes to hackers. Hackers will get your information, not just your credit card or debit card numbers, but as a result, the, you know, that data gets, uh, sold, uh, either together or separately with your private financial data on the dark web.

And again, it’s a cat and mouse game, and I know [00:13:00] that not only, um, the US government but other governments try to stop from dark web data sellers, mmm, you know, continue this practice, but it’s virtually impossible, right? It’s almost like you can’t stop car accidents from happening as long as we have cars, right?

So as long as people have cell phones and, or use any type of, uh, devices like cell phones or credit cards, you, there’s always gonna be data, right? So it’s, it’s, it’s always gonna be there. So yeah, I mean, between both legitimate and illegitimate place, there’s a marketplace. Also what’s interesting is that there’s a significant rise in websites that just sell your data.

Like, I don’t know if you ever tried to see, like, I don’t wanna mention these website on the podcast, but they’re websites that, uh, you could, you know, pay a small fee and actually get everything about yourself. And then you question, so how do they get this information? Yeah. Well, again, a lot of it is also unregulated, so none of these companies are regulated.

They don’t need a license, and so it’s a marketplace game. Yeah. I, I’m really [00:14:00] curious as to what the close rate on these calls is, where somebody gets a robocall or spam call and they fall for the scam, or they purchase a product or service that they had no idea about, but are now interested based on this call.

Like, how many people are falling for this? And I mean, there must be– it must be financially viable to like spend all this time getting all this data, making all these calls, you know, getting marked as spam by a bunch of people. They must be getting people to, to purchase or fall for these scams, right?

Because otherwise they wouldn’t be doing this. Correct. Yeah. If it didn’t make commercial sense, they would stop. So I don’t know I never looked at the data, and I don’t know if it’s even possible to extract data of scams, because it’s gonna depend- Probably not … on the type of scam. Yeah. Yeah. The question is what, you know, what is the likelihood that someone returned a voicemail?

Like, you know, one of those, uh, uh, [00:15:00] virtual voicemail s- you know, spams that you get. Then you have your robocalls, right? And robocalls that could be y- you know, both human voice that’s pre-recorded, uh, or it could be live voice and somebody just leaves you a voicemail. It just, you know, dials either random people or a specific sequence.

Now you have, uh, a new beast, uh, which is AI, right? Uh, which could leave you– Uh, and there, there’s actually a question. I recently wrote an article. Uh, well, there’s a question of whether an, an AI is considered to be a pre-recorded voice. Because if, you know, there, there, s- there are definitions both, uh, in the law in certain states, and there’s obviously case law out there what is considered to be pre-recorded.

I think it’s pretty simple to decipher that versus what is AI. AI is not pre-recorded, where AI will just basically could leave a message that’s very different for everybody. Yeah. So, yeah. I I think as, as long as there’s a commercial reason for [00:16:00] it they’ll– it’s gonna go on. Again, we’re focusing on the unwanted calls or illegal calls, right?

Because the wanted calls, they’re obviously, or, or needed calls or lawful calls, so that’s a different bucket. Yeah. That’s crazy … enough answers here. Yeah. It’s just wild. But those are scams. Yeah. Yeah, I’ll tell you, the biggest scams that actually do work part of the reason that I know, I don’t know the statistics of it, but the ones that actually have a live person on the phone.

You know, and, and these scams really vary year to year. So if you go back about 10 years ago, one of the most notorious scams that was initiated by an autodialer and the origin, it was actually in, was in India, and there are a n- number of YouTube videos that are made that you could see about call centers that would call US consumers, and they would tell them they have– they’re calling from the IRS.

I don’t know if you’ve heard of that one. Mm-hmm. Yeah. And that you have outstanding tax debt, and an IRS agent would, um- is coming to your house, uh, and gonna arrest you. And, um, you know, I remember my parents called me [00:17:00] frantically, you know, about 10 years ago and said, “We have a, you know, we have the FBI on the way to arrest Dad for not paying taxes.”

I said, “What are you talking about?” And, um, I said, “The IRS would never, first of all, send anyone. They’re never gonna show up, and second of all, everything is done in writing.” But if you can imagine the anxiety of, uh, two senior citizens, uh, who felt that the FBI was on the way to arrest them.

Thankfully, they did not fall for that scam. Now the biggest… Some of the scams that I see is, uh, a lot of it is done, uh, with elderly. I see that, you see that on the news where, uh, they will call and they offer you a product, a medical device or less expensive drugs, and, and those, uh, el- you know, people who, especially the elderly population who don’t have either co- full coverage or, or can’t afford, they, they usually fall for it, and they ask you for credit card numbers or bank account information.

They’re one of the most notorious frauds that’s still happening, and I’m involved in a number of companies whose money was misappropriated is [00:18:00] when, uh, you have, uh, calls and they call you, they tell you they’re calling from a bank- Mm-hmm … and they’re just asking you to verify a few things. I don’t know if, um- Yeah

Donata you ever received it. Yeah. Your bank is not gonna call you very likely, unless it’s a private client relationship. But yes, that’s a huge, huge scam. Yeah. I’ve gotten so many of these. I’ve gotten the, uh, Life Alert scam, um, where- Uh-huh … they say, “Oh, we’ve heard you’re 90 years old,” and I’m not.

… “And we want to sign you up for Life Alert.” And I say, “No, I’d rather… I wanna die. I’m ready to go.” You’re ready to go. “I don’t need Life Alert. I don’t need any help.” You know, the, the banking ones, the ones that are, you know, “We have your Amazon package,” and I, I just pretended I didn’t know what Amazon was and I was like, “Oh, you’re sending me the package from the Amazon forest?

That’s so exciting. What’s in the package? Is it, like, snakes or, you know, bugs, or is it, like, worms? Like, what’s in there from the forest? I’m really [00:19:00] looking forward to learning more about the forest.” And they were just so bad. Right. You know? They, they get so upset when you don’t… act like you don’t know what you’re talk- the, what they’re talking about, and it’s just, uh…

You can have fun with this, um, you know, and I, I encourage people to have fun with it. But, uh, yeah, a lot of these are, are unfortunately targeting more vulnerable populations who don’t know. You know, and people get these calls, you know, “I’m from your bank and your account’s gonna be frozen unless you tell me your account number.”

And they’re n- you know, they might be in a rush and they’re just like, “Oh my gosh,” you know, “Here you go.” But yeah, you, you definitely, um, need to think before you, you provide any information like that because you’re right, like the IRS or the bank they’re not gonna call you like this, and they’re, they’re not gonna be super rushing you and super upset or, or anything like that.

That’s just not how professional services work Correct. A, a bank is gonna freeze your accounts before they call you. Mm-hmm. And there’s gonna be some correspondence, usually through secured [00:20:00] mail. But this but these criminals are getting m- much more savvy, and they’re, they’re getting pretty good at how they’re disguising theirselves and masking themselves.

Because when you have that call they… You know, I’ve seen so many instances when they, you know, first of all, the caller ID would be the one. They’re using spoofers to have- Mm-hmm … a caller ID either off your local bank, and the caller ID will actually show your bank. Yes. So they’re very good at this, right?

So you, you, you think it’s a legitimate call, right? The Bank of America or JP Morgan, which, you know, a bank or credit union they’re doing this. They’re very good. Even, even like you said, an example with Amazon packages, or even FedEx and UPS, um, the, the, the type of technology that exists, right, and it’s like I said in the beginning, it’s a cat and mouse game that they’re always one step ahead.

And, uh, I’m kinda hoping that one of the better uses for AI will be that there will be some AI technology that will be able to dis- distinguish between a real phone [00:21:00] call and one that’s, uh, unsolicited and fraudulent in nature. That’s what I’m kinda hoping there will be some use for it. But, um- That’d be nice.

Yeah. That’d be very nice … yeah, ’cause we, we as humans can’t differentiate sometimes. Yeah. For sure. So turning us to New York, Sure … what… You know, New York recently released an announcement, um, of higher enforcement. What does New York’s do not call framework require, and what powers does the responsible agency have to enforce those requirements?

Yeah, sure. So, so first of all, uh, just outside of New York, we have the federal TCPA, Telephone Consumer Protection Act, which applies, uh, nationally. There are some states that have adopted mini-TCPAs, their own more restrictive telephone consumer protection, a type of laws that would, uh, prevent from unsolicited calls.

New York has a do not call law, which is, uh, if anyone wants to know, it’s Section 399 of the General Business Law. And, [00:22:00] uh, that, uh, falls under the purview of, uh, the Division of Consumer Protection, uh, which is part of the, uh, New York Department of State. I know it gets all complicated, but the simplest way, it’s basically there’s an agency, Division of Consumer Protection, that, uh, oversees, uh, and has jurisdi- diction over anyone who contacts a New York consumer and in violation of the statute.

Now what’s very different in this New York statute is there is no private cause of action that you typically have under federal law or uh, and, and under the mini TCPA law, right? For instance, Texas has a mini TCPA statute adopted in recent years. It act- it only provides for the state to try to enforce the do not call laws on unwanted solicitations or text messages.

That law has been interestingly enough, or the New York law has been around since 2001, and many people don’t know about this law. Ironically, until fairly recent, I didn’t know [00:23:00] about it myself. I mean, I figured almost every state has some type of you know, your DNC statute that, you know, or some states just rely on the f- on, on the, uh, federal, uh, law.

But, uh, yeah. Uh, the, this is kind of interesting. So the, the Division of Consumer Protection since 2024 has been very active in comparison to its early years, even though the law’s been around now for 25 years. Mm-hmm. And just in the past– So we, we don’t have data on 2026 yet but in 2024 based on the consent orders that are publicly available, there were 16 in total.

In 2025, there were 18 in total. So I imagine that we’ll see probably more for 2026 once that information becomes public. Mm-hmm. Okay. So, now the thing about the New York law, so I, we, we we recently– What prompted me to write an article about this that was published on JD Supra and, but what [00:24:00] recently, uh, we dealt, uh, with a pretty major, uh, investigation.

In fact, it was one of the, if not the largest one that the New York State has, uh, done in this space. And my client was a marketing company that was not placing any calls, right? It was, it’s not– First of all, it’s not a New York-based company. It’s it markets its services, um, to companies throughout the US and, uh, it relies on marketing, um, lead gen third-party lead gen companies.

So, you know, in this specific case, the, the lead gen was hired and, uh, the lead gen was the one that was making the calls and sending the text messages and leaving voicemails. My client had no idea this was happening, but sadly my The client I represent was dragged into this investigation and ultimately had to pay a pretty heavy price.

Arguably a very unfair price, but, uh, it would be, it was a lot less than litigating [00:25:00] it over the next few years. But on the premise that, um, they’re, you know, they should have done a better job in due dili- provide, doing due diligence in who they’re entering into a relationship. So that’s lesson number one under New York.

If you have if you’re, if you have telemarketing sales efforts using s- third-party services you should do your due diligence of whether or not they’re compliant. Because in New York, even though their, the statute doesn’t create vicarious liability, the, the state will take a position that you should have known.

Don doesn’t necessarily agree with it. And also there’s not a lot of case law in New York. Not many… The- virtually nobody wants to litigate with Division of Consumer Protection because of the cost and the litigation costs involved with it. So really that, this specific statute hasn’t really been tested that well in the courts.

Second thing about this, this law, which is kind of interesting, is that it has an automatic, almost a strict liability standard if you are creating an unwanted call during the times of emergency. [00:26:00] Well, you know, which basically then magnifies the damages. So not only do you do you get hit, uh, a maximum penalty of $20,000 per violation, it’s magnified if it’s in case of emergency.

Even if you made that call you know, your company that you negligently violated the statute and you placed a call that was unwanted, because there’s some companies that just generally, like we have to be candid, don’t know that these laws even exist. They have no idea. So they if, if the calls are made during the state of emergency, the fines become a lot more excessive.

And of course, uh, being a resident of the state of New York, there’s always some kind of an emergency, uh, pacing. And I don’t think anybody looks at… I mean, obviously we, we have, you know, any kind of, you know, major snowfall or any inclement weather, sure. But apparently there’s always some kind of emergency, which is kind of laughable because it’s almost, um, [00:27:00] an automatic punitive penalty without you even knowing it.

And finally, the, the third prong of this law, which is kinda quirky, and I haven’t seen this anywhere else, is the fact that in New York you are literally required if there’s no i- if there’s no prior exist- uh, no consent, if this is an unsolicited call, you’re required to identify yourself within 30 seconds, it says there in the statute, 30 seconds, and let a client know that, uh…

sorry, the consumer know that the consumer can opt out of this call. And, and therefore, if they say, “I’m not interested,” they have to take you off the list in their company and, uh, never c- you know, they’ll, they’ll never… basically create your own do not call list. I also don’t know how practical the 30 seconds, right?

So that, like, just from a practical point of view, just the initial introduction, like, you know. Mm-hmm. So that’s kind of a little quirk in all of this. Yeah. But yeah New York is, uh, has a statute [00:28:00] that now is being used. Uh, and I think it’s gonna be used a lot more ’cause it obviously dri- drives revenue for the state.

Do you think that… So let’s say I’m, I’m your client and, um, obviously you’re not providing legal advice today and all of this is hypothetical, but, you know, let’s say I’m a company and I wanna reach out to New York potential customers in New York, and I’m hiring a, a third party to do that, like a third party marketing or lead gen firm.

You know, should we make sure that our contracts say, “Under no circumstances d- will this service call or text residents in New York,” if we wanna completely avoid this? Yeah. I mean, that, that’s probably gonna be your best bet is to have a covenant in your agreement that if you want to exclude contacting through telemarketing means c- New York residents.

Uh, and again, the focus is on the outbound calls that are made to these- Mm-hmm … New York residents. So, y- you know, in, in my particular [00:29:00] recent case that I handle, The client had a covenant not like that, but it had a covenant that it should be compliant with all the applicable laws and should not be making unsolicited calls.

And, uh, even though a copy of the contract was produced to the regulator, there was very little attention paid. Uh, and I’m not necessarily gonna say I agree with that position, but the position the regulator took is that you should have done, your client should have done more, right? And then I said, “Well, what is more?”

Right? Because if you’re an innocent c- I don’t know, what, you know, you, I don’t know, you Whatever, I don’t know, you sell real estate or you, you do provide loans whatever. Let’s pick a service, uh, that could be offered on a national basis, and you excluded New York to be one of the states where you don’t wanna take the risk and violate the, the DNC law, but the lead gen ignores it, right?

Sure, you could shift the blame [00:30:00] to lead gen, but the problem is a lot of times the states will ignore and say, “Well, you should have done more.” Again, I don’t necessarily agree with that. I don’t think that’s the right approach, but that usually is the initial position that they take. Yeah. I guess, how would you know, right?

Like, unless you- Yeah … were on that list and you received the call or the text message, or you received a complaint from somebody on your website saying, “Hey, I’m sick of getting these calls,” there’s not much you can do to figure that out. Correct. Um, you know, unless you- It’s not practical … yeah, unless the lead gen company gave you a proposal that included that or said, “Hey, please approve the message that we’re gonna call people with or the message that we’re gonna text people with,” it’s kinda hard to figure that out.

It is very hard to figure it out, and one thing that also that’s not taken into consideration a lot of times is that people in our country move. We have the ability to relocate, and so what happens if a person is on a list, data broker sells you, [00:31:00] sells you a list of 100,000 people, but 500 people, right, a tiny fraction of it, have relocated to the state of New York.

And now a resident of the state of New York, even though you don’t think you’re calling the state of New York- Yeah … are you responsible for that? Yeah. Yeah. Absolutely. Now, you know, going from the business itself, um, to the, the spam callers and everybody else, how much of this responsibility should fall on the shoulders of the telephone carriers, technology providers, data brokers?

What level of the responsibility should they have for this? Yeah. I mean, certainly data brokers should be held accountable for it. And one of the unfortunate things in this discussion is that both on the federal and state level there’s, y- you know, there, there are only so many resources and so many people and so much money in each of the agencies, both on federal and state level, to prosecute data brokers or companies that, uh, sell the lists, right?

So that’s one. And, You know, I always look at it as the law is only as good as you can enforce it, right? Because [00:32:00] if, if it’s not gonna be enforced because, um, uh, lack of resources, um… And I mean reasonable enforcement, I don’t mean, uh, with enforcing, uh, creating a legal precedent simply through enforcement matters.

I’m talking about that, look, um, there are companies that obtain consumer data through ill-gotten means and they should be prosecuted. The problem is there really isn’t enough resources. Then the big question is, can you hold telecom companies responsible, right? And the short answer is very– it’s very hard to do legally, right?

So if… There is no case law that I’ve come across that holds AT&T or Verizon or T-Mobile responsible, and it’s understandable. They’re just there to provide an opportunity to connect one or more people with each other, right? They can’t police, right? They can’t police every single phone call. They shouldn’t police because of privacy laws.

Then there’s a question, what [00:33:00] happens if they’re, if they receive notification that something was reported as a spam call or, uh, or as a fraudulent call, right? If you, you know, notify– if you… The, the short answer is these companies have already adopted measures, uh, and I’m talking about the larger telecoms.

They’ve adopted measures specifically to then ban these companies who purchase phone numbers from them, right? Because ultimately, how does it work? They, you know, the telecoms will sell phone numbers and access. And the auto dialers are not, uh, or whatever technology is behind, whether it’s auto dialers or not even auto dialers they’re, they’re not provided by the telecoms.

They’re just providing you with the phone numbers. There have been recent, um, limited enforcement actions by the Federal Communication Commission against the smaller, like VoIP companies that were really at the forefront of, uh, creating Facilitating, not creating. They were assisting and fac- and facilitating with their knowledge of these type of, uh, fraudulent schemes taking place.

But there’s only a [00:34:00] handful of them. So, from a practical point, it’s just very difficult and probably u-unrealistic to hold the big telecoms responsible. That just doesn’t make any sense. Unless they recklessly or knowingly ignore, you know, they see what’s happening and they just willfully close their eyes on it Yeah, I think some of these tools that the telecom providers provide are good at first, you know, like the spam blockers, you install it.

Mm-hmm. At first, once it’s immediately launched, it works super, super well, and then a couple weeks later the, the spammers figure out how to bypass them, and then you’re getting all the same calls again. Um, or, you know, I’ve had this happen to me many times, where you get a voicemail from one of these scam companies, you block it and report it as spam in, in your phone, and then not even 10 minutes later, it’s literally the same exact message but the phone number’s slightly different.

I mean, it, just in the conversation that we’ve had here over [00:35:00] the last 30 or so minutes, I’ve gotten three spam texts. Interesting. Yeah. Wow. And I will block all of them. I will mark them all as spam, and 20 minutes later I’ll get the same exact message just from a different phone number. So, it just seems like the technology’s not fully there yet from the telecom side.

The enforcement isn’t there from the regulatory side, and it just, it’s kinda just a, an endless series of misfortunes that cause us to get these things, and it’s just… Man, it’s just very, very annoying. Um, you know, I know this is a really big problem that has multiple solutions, some of which work, some of which don’t, but in your opinion, if you could personally change one thing about the current legal framework to make the biggest difference for consumers, what would that be?

Well, number one is I don’t know if that’s a legal framework or more a policy question. I think that, um, [00:36:00] we already have a DNC list, right? Anybody could put their, uh, cell phone or residential phone number, not a business line number on, on the list. And, uh, I just, I feel from a policy point of view when something is on the low radar for politicians, right?

Like today, the big question is the data centers, right? Which somehow is getting attention for both of the parties. Sure. But then from a policy perspective, things are gonna start evolving, uh, both in the federal, state, and local levels. When it comes to phone calls, I don’t know whether you know, um, people have just the regulators, the states and both federal and state level have sort of given up because it’s just very difficult to stop, like is there a practical way- Yeah

To stop. But i-i- from a policy point of view, I, I feel that there just needs to be more, Re– there need to be more resources given to the agencies to enforce the laws that the legislators enact, particularly in the telecom [00:37:00] space. Because what’s the point of enacting laws that you…

Okay, so the state of New York had, whatever, 34 in total, 20 in, in two years. It’s not a lot, right? I mean, I can’t imagine how many, you know, hundreds of millions if not billions of text messages and phone calls New York consumers received. Yeah. Uh, I think I tallied up from what’s publicly available, and if my memory serves me well, in 2024, the total penalty paid was, uh, like 600 and thousand and change, and ’25 was 1.2 million.

In the grand scheme of things, it’s really nothing, right? Yeah. You know, you’re, you’re, you’re more likely to if, you know, you know, if you’re speeding and you get pulled over by a state trooper, you know, it’s not just the fine penalty, it’s the points. So that’s how it kind of prevents people. But if they, if they’re, if, uh, from a policy point of view, if, uh, there’s, uh, very little reprimand and there’s, you know, very little enforcement happening, I don’t wanna say it’s almost encourages, but it [00:38:00] also doesn’t make things easier for consumers.

For sure. One way, the other policy ways I think that could work is in some of these states, uh, you know, not just in the federal level, but in the state level, you could open up a private cause of action. Not to say that I would like or en- encourage, uh, floodgates of litigation to be opened, but I do think companies that, uh, when they get sued, they typically, you know, learn their lesson because they have to pay lawyers, they have to pay, you know, it, it adds up.

And a third policy, again, these are not legal framework, because I think we, we actually have pretty decent legal framework generally across the country is I think that, um, they, there has to be, and I, and I, this is where I’m hoping that AI technology would be used for the benefit of consumers to prohibit non-US companies from reaching US consumers.

Uh, whether it is, uh, creating a, um, some kind of a firewi- uh, there has to be some kind of a way to create… I imagine there could be a [00:39:00] firewall created ultimately to prevent somebody, From overseas to just a mass dial US consumer. So I can understand if it’s within the US, but then y- within the US you could probably prosecute them through enforcement means or through private cause of action.

But overseas, that’s why very little is being done, because many of them are from overseas. Yeah. Yeah. Agreed. I think it’s, um, there’s several different possible solutions- Yeah … but I definitely feel like our regulators and legislators and, and then telecoms and everybody else needs to do something about this, because it’s just an absolute nightmare for so many people, where you’re just constantly bombarded at all hours of day and night with these spam and scam calls that you don’t want.

And, you know, you try to mark them as spam, you try to block them, you try to file complaints, and there’s just not much that, that actually gets done. So I really do hope that something is done about this in the near future, because it’s just a nightmare [00:40:00] problem. Agree. Agree. Well, Felix, thanks so much for joining me on the podcast today.

I really appreciate it. Thanks for having me, Donata. It was a pleasure. Absolutely. And to our listeners, make sure to subscribe to Privacy Lawls, um, so that you don’t miss our next episode.