THE BOOT IS NOW ON THE OTHER FOOT: Parking Companies That Threatened to Boot Drivers Now Face a $2,500-Per-Person Privacy Class Action.

Hi TCPAWorld! Keerti here, with no TCPA case today. But stick around, because a TCPA case ends up doing all the heavy lifting.

Imagine swinging into a private lot to drop off your kids, never park, and drive away. A few days later, an “invoice” lands in your mailbox saying you were parked for nearly four hours and threatening to boot or tow your car. You never gave these people your name. You never gave them your address. So how did they even find you?

Your plate has been run through the DMV. And the Driver’s Privacy Protection Act has thoughts on that.

Quick primer for the telecom folks. The DPPA, 18 U.S.C. §§ 2721–2725, makes it unlawful to knowingly obtain or disclose personal information from a motor vehicle record for any use the statute does not permit. There are fourteen permitted uses. If your information gets obtained, disclosed, or used outside of them, you can sue for actual damages, but not less than $2,500 in liquidated damages, plus punitive damages for willful or reckless conduct and attorneys’ fees. Per person. In a class action. One can do the math.

Enter Levine v. Municipal Parking Services, Inc., No. 8:25-cv-2920-KKM-NHA, 2026 WL 3342815 (M.D. Fla. Nov. 5, 2026).

We have two plaintiffs. Jaquelyn Deppe, who drove through a private lot in Redington Shores twice on the same day to drop off and pick up family members. She never parked in a space. Days later, she got an invoice claiming her car sat there for nearly four hours. And Steve Levine’s daughter, who parked his car in the same lot, and Levine (who had never dealt with these companies) got an invoice mailed to his home threatening booting or towing.

The defendants were the Municipal Parking and Premium Parking, which run the lots, and GovCIO, which allegedly handled the DMV lookups and passed the registered owners’ names and home addresses along to the parking companies and their mailing vendors. Per the complaint, the lookups happened after the cars left, as part of a standardized, automated invoicing workflow. The invoice called itself an invoice, did not threaten litigation, and even said it was not subject to civil penalties.

All three defendants moved to dismiss for lack of standing and failure to state a claim. Judge Mizelle denied both motions.

On standing, the plaintiffs pleaded lost time spent figuring out who these companies were and how they got their addresses. But lost time only counts in the Eleventh Circuit if it was spent responding to something that is itself a concrete harm. So everything turned on two intangible privacy theories, both pegged to the common-law tort of intrusion upon seclusion: (1) the defendants unlawfully pulled the plaintiffs’ information from DMV records, and (2) the defendants used that information to mail an invoice to Levine’s home.

Before getting to either theory, the court swatted away a line of Southern District of Florida decisions that tossed similar DPPA claims because Florida’s version of intrusion upon seclusion requires an intrusion into a “place.” Wrong comparator, said the court. The question is the common law as developed in English or American courts, not one state’s quirky version of the tort.

Now comes the fun part. On the first theory, the defendants basically conceded that improperly pulling someone’s DMV data is offensive. Their fight was over the “seclusion” element, arguing nobody has a privacy expectation in motor vehicle records. They leaned on Corbitt, an Eleventh Circuit constitutional privacy case, and on In re Municipal Parking Services, Inc. DPPA Litigation, a 2025 Northern District of Florida decision on materially similar facts that found the seclusion element missing.

Judge Mizelle wasn’t buying it. Constitutional privacy is a different animal, and the Eleventh Circuit has already let a DPPA statutory claim go forward where a parallel constitutional claim failed. As for the Northern District decision? “I disagree.” Short and sweet.

Here’s where TCPAWorld comes in. The court leaned hard on Drazen v. Pinto, 74 F.4th 1336 (11th Cir. 2023) (en banc), the en banc TCPA decision holding that a single unwanted text message is a concrete injury. Drazen says the comparison is about the kind of harm, not the degree. One text would never support an actual intrusion claim, but it is still “offensive to some degree to a reasonable person,” and deciding how many texts are enough is Congress’s call, not the courts’.

Same logic here. Through the DPPA, Congress decided DMV records are sensitive enough to protect. And while the common law did not punish someone for examining a public record, DMV records are not public records in that sense, because the statute only lets people get at them under enumerated conditions. So improperly accessing them looks a lot like the classic intrusion harm of rifling through someone’s private files without permission, even if it would never support a full-blown intrusion claim. The court also pointed to the Fourth and Eighth Circuits, which have treated improper DPPA access as a concrete injury, plus Seventh and Ninth Circuit decisions saying the same about impermissible credit report pulls. The defendants’ contrary district court cases? “None convince me.”

The second theory is the one that should make everybody sit up. Can a letter in your mailbox be the same kind of harm as a text buzzing in your pocket?

District courts in the Eleventh Circuit are split on this, and most of the cases come out of the FDCPA world. The Southern District of Florida line says no, a letter arrives silently and you read it whenever you want. Two Northern District of Alabama decisions say yes. Judge Mizelle went with Alabama: “There is no meaningful distinction between the kind of harm caused by an unwanted text message and an unwanted invoice in the mail.”

The buzz, the court explained, goes to how annoying the intrusion is, not what kind of intrusion it is. Under Drazen, that is a degree question, and degree is not the test. The court also flagged the practical point that it is far easier to silence or delete a text than to walk to the mailbox, open the thing, read it, and throw it out. And the court sided with the Ninth Circuit over the Seventh Circuit on whether an unwanted letter inflicts the kind of harm intrusion upon seclusion targets.

The defendants tried one more angle: a Restatement reporter’s note saying unsolicited mailings are not an actionable intrusion. The court actually went and read the two cases cited in that note. One wasn’t an intrusion case at all, and the other seemed to accept that an unsolicited mailing is an intrusion, just not an offensive enough one to sue over. Which, again, is a degree problem. Rejected.

This second theory only belonged to Levine, since he was the one who alleged the invoice-to-the-home injury. But it’s a concrete injury all the same.

GovCIO also argued nothing was traceable to it because it only did lookups and never mailed anything. The lookup injury is traceable to GovCIO for obvious reasons, since it allegedly pulled the records. The invoice injury was a closer call, but the court found it traceable too: without GovCIO handing over the names and addresses, there’s no invoice.

Now the merits: The defendants argued their lookups fit the litigation exception in § 2721(b)(4), which covers “investigation in anticipation of litigation.” The problem is Maracich v. Spears, 570 U.S. 48 (2013), where the Supreme Court read that exception narrowly and told courts to look at the defendant’s predominant purpose, based on the communication itself and the defendant’s whole course of conduct. The court noted, with some side-eye, that the defendants relied almost entirely on pre-Maracich case law.

Applying Maracich, this was not close. The communication was an invoice. It did not threaten litigation. It said it wasn’t subject to civil penalties. And the complaint alleged the defendants don’t file suits or arbitrations to collect these charges at all. “We could sue if we wanted to” is a possible purpose, not a predominant one. The parking companies even pointed to a single counterclaim they had filed in a separate case, which the court said, if anything, helped the plaintiffs.

The court did leave a door open. Had the defendants sent an attorney demand letter threatening suit, or shown a track record of actually filing collection actions, the outcome might have been different. “But they did not.”

Motions denied, and the defendants have to answer by November 19, 2026.

So why should TCPAWorld care about a parking lot case? Because Drazen keeps traveling. A decision about one unwanted text is now being used to say that one unwanted letter in your mailbox, and even a DMV lookup nobody ever sees, is a concrete Article III injury. Defendants in this circuit have long counted on standing as a real defense in privacy statute cases. That defense is getting thinner by the month, and it’s a TCPA case doing the thinning.

We’ll keep you posted, TCPAWorld!