The Telephone Consumer Protection Act pays $500 a call. That is the easy part. The hard part — the part that kills most of these cases before a complaint is ever drafted — is naming the defendant.
Since the TRACED Act was signed on December 30, 2019, the federal government has built a genuinely impressive machine for finding out where an illegal robocall came from. Providers must cryptographically sign the calls they originate. They must answer a traceback request in 24 hours. They must file in a public database or their traffic gets refused. And every piece of that machine was built for the Federal Communications Commission, for law enforcement, and for the carriers. Not one line of it hands a private plaintiff a right to a traceback, to the traceback’s result, or to the identity of the person who paid for the call.
That is the honest shape of this practice area, and the rest of this article is about working inside it. Minnesota’s own telemarketing statute is a separate question, and I covered it in what actually governs robocalls to a Minnesota number. Everything below is federal.
What is left of the autodialer claim after Duguid?
Almost nothing, and lawyers still plead it.
The statute defines the machine narrowly. 47 U.S.C. § 227(a)(1):
The term “automatic telephone dialing system” means equipment which has the capacity—
(A) to store or produce telephone numbers to be called, using a random or sequential number generator; and
(B) to dial such numbers.
In Facebook, Inc. v. Duguid, 592 U.S. 395 (2021), the Court read the modifier as reaching both verbs, and no Justice disagreed with that reading. Justice Sotomayor wrote for eight; Justice Alito concurred in the judgment, agreeing that the equipment must have the capacity to store telephone numbers using a random or sequential number generator, and writing separately only to warn against the Court’s “heavy reliance” on the series-qualifier canon. The holding:
To qualify as an “automatic telephone dialing system,” a device must have the capacity either to store a telephone number using a random or sequential generator or to produce a telephone number using a random or sequential number generator.
And at the close:
We hold that a necessary feature of an autodialer under §227(a)(1)(A) is the capacity to use a random or sequential number generator to either store or produce phone numbers to be called.
The facts matter. Noah Duguid never had a Facebook account and never gave Facebook his number, and Facebook’s login-notification system texted him anyway. He lost. A system that pulls a specific stored number out of a database and dials it is not an autodialer, however automated it is, because it does not use a number generator. The Court said so plainly: expanding the definition “would take a chainsaw to these nuanced problems when Congress meant to use a scalpel.”
There is a seam, and it sits in footnote 7. Answering the argument that “store or” would be surplusage, the Court wrote:
For instance, an autodialer might use a random number generator to determine the order in which to pick phone numbers from a preproduced list. It would then store those numbers to be dialed at a later time.
I read that footnote for what it is — an illustration offered to defeat a surplusage argument, not an invitation. A plaintiff who wants to build a case on it has to plead facts about the defendant’s dialing platform that he almost never has before discovery. I do not build claims on footnote 7.
What survives Duguid is the part of the statute the Court went out of its way to protect. Its own words:
The statute separately prohibits calls using “an artificial or prerecorded voice” to various types of phone lines, including home phones and cell phones, unless an exception applies. See 47 U. S. C. §§227(b)(1)(A) and (B). Our decision does not affect that prohibition.
That is the claim to plead. Section 227(b)(1)(B) makes it unlawful:
to initiate any telephone call to any residential telephone line using an artificial or prerecorded voice to deliver a message without the prior express consent of the called party, unless the call is initiated for emergency purposes, is made solely pursuant to the collection of a debt owed to or guaranteed by the United States, or is exempted by rule or order by the Commission under paragraph (2)(B)
Subparagraph (A) reaches the same prerecorded-voice conduct directed at cell phones, emergency lines, and hospital and patient rooms. Neither requires a number generator. A recorded voice, a cell phone, and no consent is a complete violation. Add the do-not-call route in § 227(c)(5), whose damages ceiling and due-care affirmative defense I worked through in the Minnesota piece, and the autodialer question drops out of most well-pleaded cases entirely.
Consent is the caller’s paperwork, not your problem
For a marketing call, the standard is not consent. It is a signed writing. 47 C.F.R. § 64.1200(f)(9) defines “prior express written consent” as:
an agreement, in writing, bearing the signature of the person called that clearly authorizes the seller to deliver or cause to be delivered to the person called advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice, and the telephone number to which the signatory authorizes such advertisements or telemarketing messages to be delivered.
The writing must disclose, clearly and conspicuously, that signing authorizes such calls and that the person “is not required to sign the agreement (directly or indirectly), or agree to enter into such an agreement as a condition of purchasing any property, goods, or services.” An electronic or digital signature counts under (f)(9)(ii).
Practical consequence: the defendant either produces a document naming your client’s telephone number, or it does not. That demand belongs in your first set of requests for production, phrased to reach the lead-generation vendor’s records and not merely the seller’s own.
Revocation is stronger than most people assume. Section 64.1200(a)(10) provides that a called party may revoke consent “by using any reasonable method to clearly express a desire not to receive further calls or text messages from the caller or sender,” and that replying with “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe” to a text is a reasonable means per se. It closes with two sentences that decide cases:
All requests to revoke prior express consent or prior express written consent made in any reasonable manner must be honored within a reasonable time not to exceed ten business days from receipt of such request. Callers or senders of text messages covered by paragraphs (a)(1) through (3) and (c)(2) of this section may not designate an exclusive means to request revocation of consent.
Paragraph (a)(11) adds that any other reasonable method — a voicemail, an email — “creates a rebuttable presumption that the consumer has revoked consent” once the called party produces evidence the request was made. That is an evidentiary gift, and it is why I tell people to send the opt-out in writing and keep the sent copy.
The law requires the caller to name itself. Use that.
Attribution is not purely a technical problem. Congress and the Commission both imposed identification duties on the caller, and a violation of those duties is itself evidence.
47 U.S.C. § 227(d)(3)(A) directs the Commission to require that:
all artificial or prerecorded telephone messages (i) shall, at the beginning of the message, state clearly the identity of the business, individual, or other entity initiating the call, and (ii) shall, during or after the message, state clearly the telephone number or address of such business, other entity, or individual
The Commission’s rule goes further. Section 64.1200(b)(1) requires the message to state, at the beginning, “the identity of the business, individual, or other entity that is responsible for initiating the call,” and then:
If a business is responsible for initiating the call, the name under which the entity is registered to conduct business with the State Corporation Commission (or comparable regulatory authority) must be stated;
Not the brand. Not the campaign name. The registered entity name. And for live telemarketing, § 64.1200(d)(4) requires the caller to give “the name of the individual caller, the name of the person or entity on whose behalf the call is being made, and a telephone number or address at which the person or entity may be contacted.”
Now the limitation, because it matters to how you plead. Section 227 creates exactly two private rights of action: § 227(b)(3) for violations of subsection (b) and the regulations under it, and § 227(c)(5) for violations of the do-not-call regulations under subsection (c). I read the whole section; there is no third. Subsection (d) makes noncompliance with the technical standards unlawful under § 227(d)(1) and gives the private party nothing. So if your claim turns on the caller refusing to identify itself, do not plead § 227(d). Plead the prerecorded-voice violation, cite § 64.1200(b) as the rule the caller broke, and use the missing identification as proof of willfulness rather than as a freestanding count.
What a traceback actually is, and who gets one
A traceback is a hop-by-hop walk backward through the carriers that carried a specific call, conducted by a private consortium the FCC selects.
The statutory basis is not in the U.S. Code. Section 13 of the TRACED Act, Pub. L. 116-105, was never codified; it is set out as a note under 47 U.S.C. § 227. Section 13(d)(1) required the Commission, within 90 days, to establish a registration process for “a single consortium that conducts private-led efforts to trace back the origin of suspected unlawful robocalls,” and imposed four conditions on the registrant, beginning with:
Be a neutral third party competent to manage the private-led effort to trace back the origin of suspected unlawful robocalls in the judgement of the Commission.
The implementing rule is 47 C.F.R. § 64.1203, which directs the Enforcement Bureau to issue a public notice by April 28 each year seeking registration. The registered consortium is USTelecom’s Industry Traceback Group. The FCC’s Enforcement Bureau said so again in its annual information request of March 20, 2026 (DA 26-257): “On July 27, 2020, the Bureau selected the Traceback Group as the registered consortium to conduct private-led traceback efforts, and it has reselected the Traceback Group on multiple occasions since.”
The mechanics live in two rules. Section 64.1200(n)(1) provides:
Upon receipt of a traceback request from the Commission, civil law enforcement, criminal law enforcement, or the industry traceback consortium, the provider must fully respond to the traceback request within 24 hours of receipt of the request.
The 24-hour clock is business-hours only: it does not start outside 8 a.m. to 5:30 p.m. on a business day, and it does not run over weekends or federal holidays. A request landing at 3 p.m. on a Friday is due at 3 p.m. the following Monday.
Section 64.1200(n)(2)(i)(B) is the sentence that makes the chain walk backward. If the notified provider concludes it was not the gateway or originating provider, then “if it is a non-gateway intermediate or terminating provider for the identified traffic, it must identify the upstream provider(s) from which it received the identified traffic and, if possible, take lawful steps to mitigate this traffic.” Each hop names the hop above it. The walk ends at the provider that originated the call onto the U.S. network, or at the gateway provider that let it in from abroad.
Read that list of requesters once more: the Commission, civil law enforcement, criminal law enforcement, or the industry traceback consortium. A consumer is not on it. Neither is a consumer’s lawyer. The parallel commitments in § 64.6305(a)(2), (b)(2), and (c)(2) — voice service providers, gateway providers, and non-gateway intermediate providers each promising a 24-hour response — run to “the Commission, law enforcement, and the industry traceback consortium,” and to no one else. Nothing in the TRACED Act, in part 64, or in § 227 gives a private litigant a right to initiate a traceback or to receive its output. That is a verified negative, and it is the single most important structural fact in this practice.
What a STIR/SHAKEN attestation certifies — and what it does not
47 U.S.C. § 227b, added by TRACED Act § 4, defines the framework as “the secure telephone identity revisited and signature-based handling of asserted information using tokens standards proposed by the information and communications technology industry,” and then directs the Commission, within 18 months, to:
(A) require a provider of voice service to implement the STIR/SHAKEN authentication framework in the internet protocol networks of the provider of voice service; and (B) require a provider of voice service to take reasonable measures to implement an effective call authentication framework in the non-internet protocol networks of the provider of voice service.
The rule is 47 C.F.R. § 64.6301: absent an extension under § 64.6304 or an exemption under § 64.6306, by June 30, 2021 a voice service provider had to obtain a Service Provider Code token, use it to get a certificate, and authenticate the caller ID information on the SIP calls it originates. Intermediate providers came in under § 64.6302, gateway providers had to authenticate unauthenticated U.S.-numbered traffic under § 64.6302(d), and non-gateway intermediate providers receiving calls directly from an originating provider under § 64.6302(e).
The signature carries a grade. The Commission described the three levels in its first Caller ID Authentication order, published at 85 Fed. Reg. 22029, 22030–31 (Apr. 21, 2020). The originating provider indicates that:
(i) it can confirm the identity of the subscriber making the call, and that the subscriber is using its associated telephone number (“full” or “A” attestation); (ii) it can confirm the identity of the subscriber but not the telephone number (“partial” or “B” attestation); or merely that (iii) it is the point of entry to the IP network for a call that originated elsewhere, such as a call that originated abroad or on a domestic network that is not STIR/SHAKEN-enabled (“gateway” or “C” attestation).
Look hard at what an A attestation asserts. It asserts that the signing carrier knows its own subscriber and that the subscriber is entitled to the number in the caller ID field. It says nothing about who wrote the script, who bought the lead list, or who gets paid when someone presses 1. If the carrier’s subscriber is a VoIP reseller who resells to a dialing shop that works for a lead broker that works for the seller, an A attestation is entirely truthful and tells you nothing you can put in a complaint.
The Robocall Mitigation Database is the one public artifact
Every voice service provider, gateway provider, and non-gateway intermediate provider must certify in the Robocall Mitigation Database — defined at § 64.6300(j) as “a database accessible via the Commission’s website that lists all entities that make filings pursuant to § 64.6305(b).” Filings must be signed by an officer, updated within 10 business days of any change, and recertified annually “on or before March 1” under § 64.6305(h).
The enforcement teeth are in § 64.6305(g)(1):
Intermediate providers and voice service providers shall accept calls directly from a domestic voice service provider only if that voice service provider’s filing appears in the Robocall Mitigation Database in accordance with paragraph (d) of this section and that filing has not been de-listed pursuant to an enforcement action.
Paragraphs (g)(2) through (g)(4) extend the same rule to foreign providers, gateway providers, and non-gateway intermediate providers, with the foreign and gateway obligations running from April 11, 2023. De-listing is, in commercial terms, a death sentence: the provider’s traffic is refused by everyone downstream.
For a plaintiff, the database is the most useful public object in the entire regime. It carries each filer’s primary address, its other business names, “All business names previously used by the voice service provider,” an officer’s signature, and a named human responsible for robocall mitigation. It also requires the filer to disclose whether it or any commonly owned or managed entity has been the subject, in the prior two years, of a formal Commission, law enforcement, or regulatory agency action or investigation carrying findings of actual or suspected wrongdoing involving illegal robocalls or spoofing. That the rule had to demand a history of prior names tells you exactly what problem the Commission was solving.
Why attribution still fails
Now the part nobody advertises.
Spoofing breaks the front of the call. The FCC’s own words in DA 26-257: “Spoofed caller ID makes it more difficult to identify the source of the call.” The number on the handset is an assertion by the caller, not a fact about the caller. Where the number is spoofed, the only path back is through the carriers — and that path is not open to you.
Non-IP legs are authenticated on paper. Section 64.6303 allows a provider that has not upgraded to satisfy the non-IP obligation by an alternative that is not authentication at all:
Maintain and be ready to provide the Commission on request with documented proof that it is participating, either on its own or through a representative, including third party representatives, as a member of a working group, industry standards group, or consortium that is working to develop a non-internet Protocol caller identification authentication solution, or actively testing such a solution.
Membership in a working group is the compliance option. The same alternative appears for gateway providers as of June 30, 2023, and for non-gateway intermediate providers receiving calls directly from an originating provider as of December 31, 2023. A call that crosses a time-division-multiplexing segment loses its Identity header, and no rule puts it back. Section 64.6304(b) goes further and exempts outright a provider that is “incapable of obtaining an SPC token due to Governance Authority policy” until it can obtain one.
Most of the traffic starts outside the country. In adopting the gateway-provider rules the Commission recited the Industry Traceback Group’s data: of 347 providers identified in the group’s 2021 report as responsible for transmitting illegal robocalls, 111 were gateway providers that brought the traffic into the U.S. network and 115 were foreign providers originating illegal robocalls. The Commission also recorded that, per the same source, 10% of all providers that are not responsive to traceback requests accounted for 48% of all non-responsive traceback requests, and over two-thirds of that 10% were foreign providers. Those are the FCC’s recitations of the record, not my estimates. A traceback that ends at a foreign originating provider ends. Federal Rule 4 does not reach it, a Minnesota subpoena does not reach it, and a judgment against it is decorative.
The rules themselves concede the caller is out of reach. This is the sentence I would read aloud to anyone who thinks STIR/SHAKEN identifies robocallers. In the 2022 gateway-provider order the Commission adopted a know-your-upstream-provider duty instead of a know-your-customer duty, and explained why:
Recognizing the difficulty posed by a requirement for gateway providers to know information about the caller, who is likely not their customer and with whom they have no relationship, the Commission instead requires gateway providers to “know” the immediate upstream foreign provider from which they receive traffic with U.S. numbers in the caller ID field.
The regulator, writing rules for the choke point, could not require the choke point to know who the caller is. Neither can you.
Entities are disposable. The mitigation obligations bite an entity. Entities are formed in a week and abandoned in a month, which is precisely why § 64.6305(d)(4)(iii) requires disclosure of all previously used business names and why (d)(2)(iv) requires disclosure of common ownership, management, directors, or control. Chasing a dialing shop through three LLCs is a collection problem before it is a liability problem.
The FCC’s own escalation path is not a plaintiff’s path. Section 64.1200(n)(2) sets out a sequence: the Enforcement Bureau issues a Notification of Suspected Illegal Traffic identifying the traffic and giving the provider a minimum of 14 days; the provider must investigate and, if it was the gateway or originating provider, block the traffic and substantially similar traffic going forward; an inadequate response draws an Initial Determination Order with another 14-day minimum; and a Final Determination Order, published in EB Docket No. 22-174, requires every immediately downstream provider to cut the offender off 30 days after release. That machinery works. It works for the Commission, and it produces a public record you can read — which is worth doing before you file, because a Final Determination Order naming your caller’s carrier is a fact you want in your complaint.
The seller who benefited is not the caller who dialed
This is where most identifiable cases are actually won, and where the burden sits on the plaintiff.
The FCC resolved the question in 2013. In re Joint Petition Filed by DISH Network, LLC, CG Docket No. 11-50, Declaratory Ruling, FCC 13-54 (rel. May 9, 2013), holds that a seller does not ordinarily “initiate” a call its telemarketer places, but can be reached through agency law. The Commission construed “initiate” narrowly:
We conclude that a person or entity “initiates” a telephone call when it takes the steps necessary to physically place a telephone call, and generally does not include persons or entities, such as third-party retailers, that might merely have some role, however minor, in the causal chain that results in the making of a telephone call.
And then it opened the other door:
we find that the seller may be held vicariously liable under federal common law principles of agency for TCPA violations committed by third-party telemarketers. In this regard, we explain below that a seller may be liable for violations by its representatives under a broad range of agency principles, including not only formal agency, but also principles of apparent authority and ratification.
The Commission also said what the standard is not: “we do not think that an action taken for the benefit of a seller by a third-party retailer, without more, is sufficient to trigger the liability of a seller under section either section 227(c) or section 227(b).” Benefit alone is not enough. That is the burden, and it is yours.
The ruling then supplies the roadmap — evidence that supports apparent authority includes the seller giving the outside sales entity access to information and systems normally within the seller’s exclusive control, including detailed product and pricing information or the seller’s customer information; the outside entity’s ability to enter consumer information into the seller’s sales or customer systems; authority to use the seller’s trade name, trademark, and service mark; and whether the seller “approved, wrote or reviewed the outside entity’s telemarketing scripts.” The Commission added a knowledge theory: a seller is responsible for a telemarketer’s unauthorized conduct if the seller knew or reasonably should have known of the violations and “failed to take effective steps within its power to force the telemarketer to cease that conduct.” Evidence of those relationships, the Commission said, is enough “to place upon the seller the burden of demonstrating that a reasonable consumer would not sensibly assume that the telemarketer was acting as the seller’s authorized agent.”
Two more things about that ruling. First, the Commission was explicit that “nothing in this order requires a consumer to provide proof — at the time it files its complaint — that the seller should be held vicariously liable for the offending call,” and it expected the relationships to be established “through discovery.” Second, it has not been superseded. The Commission reaffirmed its continuing force in 2021 when it reversed course on federal-contractor liability and distinguished the DISH ruling as governing non-governmental principals and agents. I checked for that specifically rather than assuming it.
Section 227(c)(5) helps here in a way § 227(b)(3) does not: it runs to a person who received more than one call “by or on behalf of the same entity.” The Commission’s do-not-call rule carries the same idea in § 64.1200(d)(3) — where a third party keeps the do-not-call records, “the person or entity on whose behalf the call is made will be liable for any failures to honor the do-not-call request.” And § 64.1200(a)(2) reaches the party that never touched a dialer: no person or entity may “Initiate, or cause to be initiated, any telephone call that includes or introduces an advertisement or constitutes telemarketing” using an autodialer or an artificial or prerecorded voice to a cell phone without prior express written consent.
When is a case realistically identifiable?
Here is how I triage a call log.
| Signal | What it means |
|---|---|
| The recording names a company, a product, or a website | Identifiable. § 64.1200(b)(1) required the name; the seller is the defendant. |
| A live transfer to a licensed agent, dealer, or agency | Identifiable. Follow the transfer, not the dialer. |
| A callback number that answers as a business | Identifiable. Call it back, record what you can lawfully record, and write it down. |
| You gave information and received a follow-up email, contract, or policy | Identifiable, and often the strongest case in the file. |
| Pure fraud pitch — warranty, IRS, utility disconnect, prize | Almost never identifiable. Offshore origination, spoofed number, no seller to sue. |
| Nothing but a spoofed number and dead air | Not identifiable. There is no defendant behind it that process will reach. |
The dividing line is not the technology. It is whether there is a real American business at the end of the call that wants your money. A robocall selling solar, insurance, warranties, or debt relief exists to route a live human to a licensed seller — and that seller has an address, a registered agent, assets, and a lead-vendor contract. A robocall that exists to steal is a criminal enterprise operating from outside the reach of a civil subpoena. The first kind is a case. The second kind is a police report.
What to preserve, and what to demand
Keep the audio. Voicemails, call-recording app files, and screenshots of texts. Date and time to the minute, the number displayed, the number the recording gave for callback, the exact words identifying the business. A carrier’s call detail for your own line is obtainable and worth requesting early; most carriers purge it on a rolling schedule.
Write the opt-out down. Section 64.1200(a)(10) makes “stop” per se reasonable in reply to a text, forbids the sender from designating an exclusive method, and requires the request to be honored within ten business days. A dated, provable revocation converts every subsequent call into a separate violation and makes willfulness argument easy.
Search the Robocall Mitigation Database before you draft. Names, prior names, addresses, an officer’s signature, and a responsible person. It is free, it is public, and it is where corporate identity in this ecosystem is least well hidden.
Read EB Docket No. 22-174. Final Determination Orders live there by rule. If a provider in your chain is already on the Commission’s list, that is admissible-quality context and a good reason for the carrier’s counsel to take your letter seriously.
Then aim your discovery at the seller, not the switch. Ask for the lead-source contract, the vendor’s compensation schedule, the scripts and who approved them, the CRM access granted to the vendor, the trademark license, complaint logs, and the signed consent document bearing your client’s number. That is the DISH list, and it is the list the Commission said would shift the burden.
Then tell the client the ceiling, in the first meeting. If the only artifact is a spoofed number, the answer is that there is no defendant. I would rather say so on day one than bill a client to find it out in month six. Where the caller was selling a Minnesota consumer something, the state-law overlay and the private attorney general route in Minn. Stat. § 8.31 may add remedies, and the Consumer Fraud Act and deceptive trade practices may reach the pitch even where the TCPA reaches the call. If you intend to record the calls yourself, read Minnesota’s recording-consent rules first. And for how this fits the rest of the state’s privacy law, see the three Minnesota privacy regimes.
Madgett Law, LLC
Madgett Law, LLC represents Minnesota consumers in TCPA, debt collection, credit reporting, and consumer fraud matters in Minnesota state and federal court. If you are getting prerecorded calls or texts you did not consent to, we will tell you whether the log supports a claim, whether the caller can be identified, and who the real defendant is. Call 612-470-6529 or send us a message.
Sources: 47 U.S.C. § 227(a)(1) (definition of “automatic telephone dialing system”), (b)(1)(A)–(B) (prohibitions on autodialed and artificial or prerecorded voice calls), (b)(3) (private right of action for subsection (b) and regulations thereunder), (c)(5) (private right of action for more than one call “by or on behalf of the same entity”), (d)(1) and (d)(3)(A) (technical and procedural standards; identification requirements for artificial or prerecorded messages; no private remedy supplied), all retrieved from uscode.house.gov; 47 U.S.C. § 227b(a)(1) (STIR/SHAKEN authentication framework defined), (b)(1)(A)–(B) (IP and non-IP implementation mandates), enacted as Pub. L. 116-105, § 4, Dec. 30, 2019, 133 Stat. 3276; Pallone-Thune TRACED Act, Pub. L. 116-105, § 13(a)–(f), Dec. 30, 2019, 133 Stat. 3287, uncodified and set out as a note under 47 U.S.C. § 227 (annual robocall report; registration of the single traceback consortium; § 13(d)(1)(A)–(D) registrant criteria; § 13(f)(1)–(3) definitions); Facebook, Inc. v. Duguid, 592 U.S. 395 (2021) (slip op. at 1, 5–8, 10 n.7, 12), retrieved from supremecourt.gov (No. 19-511, decided April 1, 2021) (autodialer definition; footnote 7 illustration; artificial-or-prerecorded-voice prohibition unaffected); 47 C.F.R. § 64.1200(a)(1)–(3) (prohibitions), (a)(10)–(a)(12) (revocation of consent; per se reasonable methods; ten-business-day deadline; no exclusive method; rebuttable presumption), (b)(1)–(3) (prerecorded-message identification, callback number, and opt-out mechanism), (d)(3)–(d)(4) (company-specific do-not-call list; liability of the entity on whose behalf the call is made; caller identification), (f)(2) (autodialer), (f)(9) (prior express written consent), (f)(10) (seller), (f)(12) (telemarketer), (f)(19) (gateway provider), (n)(1) (24-hour traceback response; business-hours clock), (n)(2)(i)–(iii) and (n)(3) (Notification of Suspected Illegal Traffic; Initial and Final Determination Orders; EB Docket No. 22-174; 30-day downstream blocking), (n)(4)–(n)(5) (know your customer; know your upstream provider); 47 C.F.R. § 64.1203(a)–(d) (consortium registration process; annual April 28 public notice); 47 C.F.R. § 64.6300(d), (f), (j), (l), (m) (definitions of gateway provider, industry traceback consortium, Robocall Mitigation Database, SPC token, STIR/SHAKEN); § 64.6301(a) (June 30, 2021 implementation; SPC token and certificate); § 64.6302(d)–(e) (gateway and non-gateway intermediate provider authentication); § 64.6303(a)(2), (b), (c) (non-IP alternative — documented proof of working-group participation; June 30, 2023 and December 31, 2023 dates); § 64.6304(b) (exemption where a provider cannot obtain an SPC token); § 64.6305(a)(2), (b)(2), (c)(2) (24-hour traceback commitments), (d)(2)(iv) and (d)(4)(iii) (prior enforcement disclosure; all previously used business names), (g)(1)–(4) (accepting traffic only from database filers; April 11, 2023 dates), (h) (annual March 1 recertification) — all C.F.R. text retrieved from eCFR, title 47 as of August 28, 2026; Call Authentication Trust Anchor, Report and Order, 85 Fed. Reg. 22029, 22030–31 (Apr. 21, 2020) (FCC 20-42) (A, B, and C attestation levels; certificate governance); Advanced Methods to Target and Eliminate Unlawful Robocalls; Call Authentication Trust Anchor, Report and Order, 87 Fed. Reg. 42916, 42916, 42917, 42919, 42928 (July 18, 2022) (FCC 22-37) (Industry Traceback Group 2021 data recited by the Commission — 347 providers, 111 gateway, 115 foreign; 10%/48% non-responsiveness figures; gateway provider definition; 24-hour traceback rule; know-your-upstream-provider duty and the Commission’s stated reason for it); Implementing Section 13(d) of the Pallone-Thune TRACED Act, Report and Order, 85 Fed. Reg. 21785, 21785 (Apr. 20, 2020) (traceback defined as tracing spoofed robocalls to their origination); FCC Enforcement Bureau, Public Notice, DA 26-257 (rel. Mar. 20, 2026), EB Docket No. 20-195 (USTelecom – The Broadband Association’s Industry Traceback Group as the registered consortium; selected July 27, 2020 and reselected since; spoofing makes the source harder to identify); In re Joint Petition Filed by DISH Network, LLC, the United States, and the States of California, Illinois, North Carolina, and Ohio, CG Docket No. 11-50, Declaratory Ruling, FCC 13-54 (rel. May 9, 2013), paras. 1, 24, 26, 28, 46, 47 (seller does not generally “initiate”; vicarious liability under federal common law agency including apparent authority and ratification; benefit alone insufficient; illustrative evidence and burden-shifting; no proof required at the complaint stage); Government and Government Contractor Calls Under the Telephone Consumer Protection Act, 86 Fed. Reg. 9299, 9300 (Feb. 12, 2021) (FCC confirming the DISH Declaratory Ruling governs non-governmental principals and agents). This article is general legal information about federal and Minnesota law. It is not legal advice, it does not create an attorney–client relationship, and no particular outcome is promised or implied.