- 1A loan brokerage that avoided TCPA risk by using inbound leads still faced a tracking-based damages demand.
- 2Claims have reached tens or hundreds of thousands of dollars, per Captain Compliance's CEO.
- 3Nearly two dozen states have their own privacy compliance rules.
Small business finance companies that avoid phone-based marketing risk may still be exposed to a different kind of lawsuit: privacy claims over website tracking.
A claim from an unexpected direction
One small business loan brokerage had steered clear of the TCPA compliance minefield. Instead of robodialing, it ran ads on Facebook and Instagram and had merchants call in. Then one inquiry arrived as a demand for damages for having been tracked online. The merchant alleged they were served ads only because they had been tracked from an earlier website visit, that they did not want to be tracked, and that there was no way to opt out.
Why the exposure is broad
Richart Ruddie, CEO of Captain Compliance, a firm that protects companies against privacy litigation, said nearly any business that advertises is a potential target. That includes TikTok, Facebook and Instagram ads, session-replay tools that watch cursor movement and Google Analytics, all of which he said have been litigated. He said companies in small business finance, including a few in MCA, have been hit with claims and are now working with his firm to prevent a repeat.
The picture is complicated by nearly two dozen states having their own compliance rules. A growing group of serial litigants, Ruddie said, runs automated website scans to pick targets. He has seen claims reach into the tens of thousands or hundreds of thousands of dollars.
Pretty much every MCA company is potentially a victim because they’re all doing advertising
Tools that do not work
Ruddie also warned that some companies already aware of the risk rely on solutions that are not compliant. He said certain cookie-banner products fail in practice, creating bigger problems when a user opts out of the sale or sharing of personal information and is still tracked.
His company sells software that lets users opt in or out of ad targeting, tracking and session replay, and that keeps privacy notices current with a business's tracking and data handling. Ruddie said a new customer can be made compliant in one to three business days, and noted that it is easy to see what technology a site runs by viewing its code.
Source reporting: deBanked.
