Federal Communications Commission Enforcement Bureau 45 L Street, NE Washington, DC 20554 January 24, 2023 VIA CERTIFIED MAIL - RETURN RECEIPT REQUESTED To: Mr. Jeff Lawson CEO Twilio Inc. 101 Spear Street, First Floor San Francisco, CA 94105 Cc: Melissa Blassingame Senior Director of Business Development Twilio Inc. mblassingame@twilio.com Re: Notice of Suspected Illegal Robocall Traffic Dear Mr. Lawson: We have determined that Twilio Inc. (Twilio) is apparently originating illegal robocall traffic on behalf of one or more of its clients. As explained further below, this letter provides notice of important legal obligations and steps Twilio must take to address this apparently illegal traffic. Twilio should investigate the identified traffic and take the steps described below, including blocking the traffic if necessary, and take steps to prevent Twilio’s network from continuing to be a source of apparently illegal robocalls. Failure to comply with the steps outlined in this letter may result in downstream voice service providers blocking all of Twilio’s traffic, permanently. Why Twilio Is Receiving This Letter. Twilio is receiving this letter because one or more investigations that the Federal Communications Commission (Commission or FCC) conducted, in conjunction with the USTelecom’s Industry Traceback Group (Traceback Consortium), revealed that a Twilio client, PhoneBurner, Inc. (PhoneBurner), has enabled an apparently illegal robocall campaign on behalf of PhoneBurner’s client, MV Realty PBC, LLC (MV Realty). Several state attorneys general have sued MV Realty for allegedly deceiving consumers through its Homeowner Benefit Program.1 These apparently 1 The lawsuits allege that the calls deceived consumers by hiding the terms of the Homeowner Benefit Program. Consumers were led to believe that the loan was not a traditional mortgage and were not told that they would not be able to refinance their loans. See, Press Release, Fla. Office of the Att’y Gen., Attorney General Moody Takes Legal Action Against MV Realty for Swindling Florida Homeowners (Nov. 29, 2022), http://www.myfloridalegal.com/newsrel nsf/newsreleases/E9E4A2F7281415CE85258909007259EC; see also Press Release, Mass. Office of the Att’y Gen., AG Healey Sues Florida Company for Scamming Financially Struggling Residents Into Mortgaging Their Homes in Exchange for Small Cash Payments (Dec. 14, 2022), https://www.mass.gov/news/ag-healey-sues-florida-company-for-scamming-financially-struggling-residents-into- mortgaging-their-homes-in-exchange-for-small-cash-payments; Press Release, Pa. Office of Att’y Gen., AG Shapiro Sues Real Estate Brokerage Firm MV Realty Over Misleading Homeowner Benefit Program (Dec. 14, 2022), https://www.attorneygeneral.gov/taking-action/ag-shapiro-sues-real-estate-brokerage-firm-mv-realty-over- misleading-homeowner-benefit-program/. illegal robocalls originated on Twilio’s network. The FCC’s Enforcement Bureau (Bureau) works closely with the Traceback Consortium, which is the registered industry consortium selected pursuant to the TRACED Act to conduct tracebacks.2 Between May 1, 2022 and December 6, 2022, the Traceback Consortium investigated prerecorded voice message calls that YouMail, a robocall tracking software company, flagged as robocalls made to wireless numbers without consent.3 The Traceback Consortium conducted tracebacks and determined that Twilio was originating apparently unlawful robocalls on behalf of MV Realty through its dialing provider PhoneBurner. The Traceback Consortium notified Twilio of these calls and provided access to supporting data identifying each call, as indicated in Attachment A. Twilio told the Traceback Consortium that PhoneBurner had obtained called parties’ consent for the robocalls. Neither Twilio nor PhoneBurner provided the Traceback Consortium with evidence of consent. Under our rules (and as explained further below) originating providers that originate illegal robocall traffic face serious consequences, including blocking by downstream providers of all of the originating provider’s traffic. To avoid such blocking, Twilio must take corrective actions immediately. Applicable FCC Rules. This letter is based on FCC rules that apply to originating providers like Twilio. First, under the safe harbor set forth in section 64.1200(k)(4),4 any provider may block all traffic from an originating provider that, when notified by the Commission, fails to effectively mitigate illegal traffic within 48 hours or fails to implement effective measures to prevent new and renewing customers from using its network to originate illegal calls. This letter provides notice under section 64.1200(k)(4) and describes the mitigation steps you must take. Second, section 64.6305(e)5 permits providers to accept calls directly from an originating provider only if that originating provider’s filing appears in the FCC’s Robocall Mitigation Database. As explained below, if Twilio continues to transmit illegal robocalls, the Bureau may initiate proceedings to remove Twilio’s certification from the database, thereby requiring providers to cease accepting calls directly from Twilio. Third, sections 64.1200(n)6 and 64.6305 prescribe various additional obligations for mitigating and preventing illegal robocalls. We remind Twilio that failure to comply with any of these obligations may result in additional enforcement action pursuant to the Communications Act and the Commission’s rules.7 Mitigation Requirements Under Section 64.1200(k)(4). This letter serves as a notice that Twilio must immediately take certain actions to address the identified apparently illegal traffic in order to avoid downstream providers blocking all of Twilio’s traffic.8 Specifically Twilio should: 1. Promptly investigate the transmissions identified in Attachment A. 2 Implementing Section 13(d) of the Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence Act (TRACED Act), EB Docket No. 20-22, Report and Order, DA 22-870, para. 40 (EB 2022). See also Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence Act, Pub. L. No. 116-105, 133 Stat. 3274, Sec. 13(d) (2019) (TRACED Act). 3 See 47 U.S.C. § 227(b) (stating that it is unlawful to make a call using an automated telephone dialing system or a prerecorded voice to a telephone number assigned to a cellular telephone service without prior express consent, unless the call is made for emergency purposes); 47 CFR § 64.1200(a) (same). 4 47 CFR § 64.1200(k)(4). 5 Id. § 64.6305(e). 6 Id. § 64.1200(n). 7 47 U.S.C. § 503; 47 CFR §§ 64.1200(n), 64.6305. 8 47 CFR § 64.1200(k)(4). 2 2. If necessary, “effectively mitigate” the identified unlawful traffic by determining the source of the traffic and preventing that source from continuing to originate such traffic.9 3. Implement effective safeguards to prevent customers from using your network as a platform to originate illegal calls.10 4. Within 48 hours of the time stamp on the e-mail transmission of this letter, inform the Commission and the Traceback Consortium of steps taken to mitigate the identified apparent illegal traffic.11 If Twilio has evidence that the transmissions identified in Attachment A were legal calls, present that evidence to the Commission and the Traceback Consortium. 5. Within fourteen (14) days of the date of this letter January 24, 2023 inform the Commission and the Traceback Consortium of the steps Twilio is taking to prevent new or renewing customers from using its network to transmit illegal robocalls.12 Twilio must also include a declaration attesting to the truthfulness and accuracy of its response under section 1.17 of the Commission’s rules.13 Failure to provide this information within 14 days shall be equivalent to having failed to put effective measures in place.14 If after 48 hours Twilio continues to originate unlawful robocall traffic from the entities involved in this campaign, downstream U.S.-based voice service providers may begin blocking all calls from Twilio after notifying the Commission of their decision and providing a brief summary of their basis for making such a determination.15 Furthermore, if after 14 days, Twilio has not taken sufficient actions to prevent its network from continuing to be used to transmit illegal robocalls, then downstream U.S.-based providers may block calls following notice to the Commission.16 U.S.-based voice service providers may block ALL call traffic transmitting from Twilio’s network if it fails to act within either deadline. Additional Consequences Under 64.6305(e) And Other Robocalling Rules. If Twilio fails to take the actions listed above, or knowingly or negligently continues to originate illegal robocalls after responding to this letter, it may be subject to additional consequences. Continued transmission of illegal robocalls following this notice may be used as evidence that Twilio’s certification in the Robocall Mitigation Database is deficient, and the Bureau may initiate proceedings to remove its certification from the database.17 If Twilio’s certification is removed from the Robocall Mitigation 9 Id. § 64.1200(k)(4), (f)(18). 10 47 CFR § 64.1200(k)(4). 11 See Advanced Methods to Target and Eliminate Unlawful Robocalls, CG Docket No. 17-59, Third Report and Order, Order on Reconsideration, and Fourth Further Notice of Proposed Rulemaking, 35 FCC Rcd 7614, 7630, para. 42 (2020) (Call Blocking Safe Harbor Report and Order). 12 See id. at 7630, para. 43. 13 47 CFR § 1.17. See also 47 CFR § 1.16 (describing the format such declarations). 14 Twilio is encouraged to reach out to the Commission before the deadline if it anticipates needing more time to execute this step. 15 47 CFR § 64.1200(k)(4); Call Blocking Safe Harbor Report and Order, 35 FCC Rcd at 7628-30, paras. 39, 42. 16 Id. at paras. 39, 43. 17 See Call Authentication Trust Anchor, WC Docket No. 17-97, Second Report and Order, 36 FCC Rcd 1859, 1902- 03, para. 83 (2020) (Second Caller ID Authentication Report and Order); see also 47 CFR § 64.6305(c) (prescribing Robocall Mitigation Database certification requirements for originating providers). 3 Database, all intermediate providers and terminating voice service providers must immediately cease accepting all of its calls.18 If the Bureau initiates a proceeding to remove Twilio’s certification from the Robocall Mitigation Database, it will have an opportunity to respond.19 Finally, Twilio may also be subject to additional enforcement penalties, including monetary penalties, for failing to take steps to address illegal robocall traffic on its network as required by the Commission’s rules.20 Please direct any inquiries or responses regarding this letter to Raul Rojo and Monica Echevarria Attorney Advisors, Telecommunications Consumers Division, Enforcement Bureau, FCC, at Raul.Rojo@fcc.gov or (202) 418-1336; at Monica.Echevarria@fcc.gov or (202) 418-1334 and cc: Kristi Thompson, Division Chief, Telecommunications Consumers Division, Enforcement Bureau, FCC, at Kristi.Thompson@fcc.gov. A copy of this letter has been sent to the Traceback Consortium Sincerely, Loyaan A. Egal Chief Enforcement Bureau Federal Communications Commission 18 47 CFR § 64.6305(e). See Second Caller ID Authentication Report and Order, 36 FCC Rcd at 1904, para. 86. 19 Second Caller ID Authentication Report and Order, 36 FCC Rcd at 1903, para. 83. 20 See 47 CFR § 64.1200(n)(1)-(3) (prescribing steps voice service providers must take to address and prevent illegal robocalls); Second Caller ID Authentication Report and Order, 36 FCC Rcd at 1902, para. 83; see also 47 U.S.C. § 503 (providing that a forfeiture penalty may be imposed on any person who willfully or repeatedly violates the Commission’s rules). 4