In May 2005, Colorado's governor signed a bill adding one sentence to a telemarketing statute. It made it unlawful to knowingly list a cellular telephone number in a directory for a commercial purpose without the subscriber's affirmative consent. Then nothing happened. For twenty years the provision sat in the code, essentially unlitigated.

In March 2025 a plaintiff invoked it against BeenVerified. Since then roughly two dozen class actions have been filed under that single sentence, against people-search sites, business-contact platforms, real-estate lead tools, and, most recently, both Equifax and Experian.

Every one of them pleads exactly one count.

There is no backup theory, no alternative claim, nothing to fall back on. The entire campaign rides on whether a court decides that the products these companies sell are directories.

The sentence itself

The provision is C.R.S. § 6-1-304(4)(a)(I), added by HB05-1288 and signed by Governor Bill Owens on May 27, 2005. It treats the commercial listing of a cell number without affirmative consent as an unlawful telemarketing practice. Consent can be written, oral, or electronic, but it has to exist, and the burden of showing it falls on the party doing the listing.

What turns a dormant consumer-protection provision into an existential problem is the remedy.

Because the PTFA sits inside the Colorado Consumer Protection Act, a successful plaintiff can recover the greater of actual damages or $500, trebled on clear and convincing proof of bad faith, plus attorney fees and costs. Now do the arithmetic on a class.

Colorado has roughly six million residents. A national people-search platform or contact database may list a large share of the adult ones.

At $500 a head, a class that reaches even a few hundred thousand Coloradans produces nine-figure statutory exposure before anyone argues about trebling, and the fee-shifting provision guarantees the plaintiffs' side gets paid for trying.

How the campaign is built

Reading the complaints side by side, this is plainly one coordinated effort rather than two dozen independent discoveries of an obscure statute. The architecture is consistent:

One template. Nearly every complaint opens with the same legislative history, the 2005 signing, the bill number, and a quotation from the bill's sponsor on its privacy purpose. The class definition and prayer for relief track each other closely.
One count. The complaints plead the listing provision and nothing else. No unjust enrichment, no invasion of privacy, no negligence. It is a deliberate, high-conviction bet.
Two venue strategies at once. Some cases are anchored in Colorado, in Denver County District Court and the District of Colorado. Others are filed in the defendant's home forum, in New York, California, Illinois, Florida, Massachusetts, and Washington, while still asserting a Colorado-resident class.
A small bench of firms. Bursor & Fisher is the engine, typically pairing with Peluso Law as Colorado counsel. Crosner Legal, Anderson + Wanca, Kopelowitz Ostrow, Emery Reddy, and Ahdoot & Wolfson round out the field.
A recurring cast of plaintiffs. Several named plaintiffs appear in more than one case against different defendants, which is lawful but hands the defense a ready argument about adequacy of representation.

The targets, in order

The sequence tells you how the theory has been stress-tested and expanded. It began with the easiest fit and has been moving steadily toward harder, larger targets:

People-search sites, where a public profile displaying a phone number looks most like a directory. BeenVerified, Spokeo, Radaris, CheckPeople, Thryv.
Business-contact platforms, where the number sits behind a paid subscription rather than a public page. Lusha, UpLead, Smarte, Dun & Bradstreet, People Data Labs, Pipl, Clay Labs, Similarweb, and Oracle.
Real-estate lead tools, where the number is delivered inside a workflow. Buildout's ProspectNow, Forewarn, Red Violet, DealMachine, REDX, Crexi, and Remine.
Credit and identity bureaus, the hardest and highest-value fit, and the newest. Equifax was sued in Denver County and the case removed to federal court; Experian followed weeks later.

Each step outward makes the core question harder. A public people-search profile is at least recognizable as a listing. A permissioned enrichment record inside a customer's CRM is a different animal, and a regulated bureau product is different again.

The first ruling went the plaintiffs' way

For most of 2025 the defense bar treated this as a novel theory unlikely to survive contact with a judge.

That assumption took a hit on April 21, 2026, when a federal judge in the Western District of Washington declined to strike the class allegations in a PTFA case against Whitepages, holding it was too early to say the claims could not be litigated classwide.

The court also signaled skepticism toward the First Amendment defense, treating the challenged conduct as commercial speech, which receives less protection than other expression.

That is not a merits ruling and it decides nothing about whether these products are directories. But it removed the assumption that the theory would die early, and the filing curve reflects it.

The pace roughly doubled after the spring, and June 2026 was the heaviest month of the campaign so far.

What the defense actually has

The theory is genuinely contestable, and the defenses are stronger than the filing volume suggests:

Directory status. The threshold question and the whole case. A statute written in 2005 about telephone directories may not reach a searchable database, a permissioned API, a skip-tracing output, or a CRM enrichment field.
Listing versus downstream use. There is a real difference between publishing a number and appending one to a record a customer already holds.
Knowledge. The statute requires knowing conduct. Defendants will contest whether they knew a given number was cellular, belonged to a Coloradan, and lacked consent.
Consent and provenance. Affirmative consent may exist somewhere in the data supply chain, in a self-submitted form or a vendor's opt-in. Proving or disproving it is a records fight.
Standing and extraterritoriality. Federal defendants will press concrete-injury arguments, and national platforms operating outside Colorado will raise dormant Commerce Clause and reach-of-statute defenses.
How damages count. Per person, per number, per listing, per search, or per sale? The answer moves the exposure by orders of magnitude.

The constitutional arguments, including First Amendment and vagueness challenges, remain live, though the Whitepages court's early commercial-speech framing suggests they will be harder to win than defendants hoped.

Where it goes next

The pipeline is visible in public. Plaintiff firms post investigation pages before they file, and in this campaign the gap between the two has been short.

Ahdoot & Wolfson opened a public investigation into Experian on June 9, 2026, and sued Experian eight days later.

The firm currently has open investigations into other large data holders, including TransUnion and Demandbase, that have not yet produced complaints.

The profile of an exposed company is now clear enough to state plainly: if a product lets a paying customer obtain a mobile number for a person who never handed it over, and the company cannot document affirmative consent for that number, it fits the fact pattern the plaintiffs are pleading.

That description covers a large part of the contact-data economy, which is why defense commentators have started treating this as an industry-wide compliance problem rather than a Colorado curiosity.

What makes this wave unusual is how much rests on so little.

There is no alternative count, no second theory, no fallback if the statute does not stretch.

Two dozen cases, several of them against the largest data companies in the country, are pinned to whether a 2005 legislature that was thinking about phone books wrote a sentence broad enough to cover a subscription database.

Plaintiffs have cleared the first procedural hurdle and are filing as fast as they can. The defense has not yet had its answer on the only question that matters.

When a court finally rules on what a directory is, it will either end this campaign or license a much larger one.

The next defendant is already on a list.

This PTFA campaign moved from one obscure statute to two dozen defendants in fifteen months, and it is still working down the list of companies that sell access to a phone number.

Rain Intelligence tracks emerging theories like this one and maps them to the companies, industries, and forums most exposed, before the complaint lands.

Book a demo to see it matched to your practice, clients, and jurisdictions.