Skip to main content

​
TCPA Known-Litigator Gate

US carriers and industry services (Numeracle, Blacklist Alliance, DNC.com) maintain lists of professional plaintiffs — recipients who file TCPA complaints against senders as a business. A single non-consented A2P SMS to one of them costs 500–500–1,500 per message under 47 U.S.C. § 227(b)(3). Orbit’s known-litigator gate blocks those sends before they dispatch. The gate is scoped by design to US (+1, NANP) SMS and MMS traffic — the TCPA is a US statute, and SMS/MMS are the channels that trigger it. Voice traffic carries its own TCPA dialing-window guard; see Send Gates.
This is a tenant risk control you opt into, not a platform screen. The gate rides on the send path only when your organization turns it on, and it reduces (not eliminates) your exposure to serial TCPA filers. It is not legal advice — confirm your TCPA obligations with counsel.

​
How the check resolves

Every send on an enabled organization resolves the recipient against a layered chain, cheapest first:
  1. Contact pre-flag — if a bulk import already stamped the contact’s is_tcpa_litigator flag, the lookup is skipped entirely and the send resolves flagged without touching the network or the cache. One computation per import, not per send.
  2. Redis cache — a cached verdict from an earlier lookup.
  3. Numeracle live lookup — used when the operator configured the Numeracle key (Orbit’s hosted SaaS sets it for you).
  4. Static seed — the platform-bundled litigator list, used as the last-resort source when the live lookup is unavailable.
Each verdict reports its source back through the audit trail and the admin lookup surface, so you can tell a cached hit from a live one. Admin-set manual overrides live in the same cache layer, so a force-flag or force-clear persists across lookups. See Admin manual overrides below.

​
Enable the gate

The gate is off by default. It ships off for non-US operators: a US TCPA check on traffic that never touches +1 recipients adds lookup latency and audit noise for no benefit. Turn it on per organization by setting tcpa_check_enabled in your general settings:
Until the flag is true, every send skips the chain entirely. Setting false (or never setting the key) means off. The dashboard compliance settings expose the same toggle.
Voice calls are not gated by this check. The scope is sms and mms sends to +1 destinations. To extend litigator screening to outbound voice, use the admin manual-override surface below or screen recipients before a campaign with the admin lookup.

​
What a blocked send looks like

A blocked send throws 403 TCPA_KNOWN_LITIGATOR_BLOCKED (the code the class is named once it lands — the legacy listing name MESSAGING_TCPA_KNOWN_LITIGATOR was replaced). The response body:
The block is resolved before billing, so a blocked send never charges. details.source tells you which layer flagged the recipient (contact_flag, cache, numeracle, seed, or manual_override). When the gate has a confidence score from Numeracle, it passes through in details.score (0–100, higher is riskier).

​
Non-US destinations

Non-+1 recipients that match the list get a soft warn rather than a hard block: the send proceeds, a Sentry breadcrumb and an audit entry of messages.tcpa_litigator_soft_warn record the flag, and you can review it post-hoc. The TCPA’s hard-block scope is NANP only.

​
Consented bypass

If the recipient has an opted_in consent record for the same channel, the gate allows the send — but writes an audit entry (messages.tcpa_litigator_consented_bypass) plus a Sentry breadcrumb so your compliance team can review the decision post-hoc. The audit entry carries the recipient (redacted), the channel, the flag source, and the score. Blocked sends write messages.tcpa_litigator_blocked entries instead. Query either class from the Admin console or your SIEM sink.

​
Failure mode: fail-open

An outage in the Redis cache, the database probe, or the Numeracle API does not block your sends. The chain catches the fault, logs a warning, captures it in Sentry, and treats the recipient as un-flagged — the send goes through. This is deliberate: a TCPA preflight outage must never black-hole all outbound messaging. If you would rather fail closed (e.g. during a live complaint), turn the toggle off and rely on the admin manual-override surface — force- flag the affected numbers so they block without depending on upstream lookup availability.

​
Admin manual overrides

Platform staff manage the list itself through the super-admin surface (/dashboard/tcpa-litigators):
  • GET /admin/compliance/tcpa-litigators/seed — the static seed envelope (source, entry count, last-updated).
  • GET /admin/compliance/tcpa-litigators/lookup?phone=… — run the live chain against one phone to debug a complaint.
  • POST /admin/compliance/tcpa-litigators/override — force-flag or force-clear a number (persists across lookups until removed).
  • DELETE /admin/compliance/tcpa-litigators/override/:phone — drop an override.
  • GET /admin/compliance/tcpa-litigators/overrides — list active overrides with provenance (who set it, when, why).
  • POST /admin/compliance/tcpa-litigators/diff + /merge — bulk-import a CSV of flags.
  • GET /admin/compliance/tcpa-litigators/match-stats — hourly blocked / consented-bypass / soft-warn counts for the sparkline.
All of these are super-admin only and audit-logged.
  • Send Gates — quiet hours, DNC, RND, RMD, and the emergency stop run alongside this gate at send time.
  • DNC Scrubbing — the Do-Not-Call pre-flight against your own lists and the national registries.
  • Consent Management — the consent records the bypass reads.
  • Error Codes — the TCPA_KNOWN_LITIGATOR_BLOCKED row with the full payload shape.