The high court's ruling for the Menlo Park, California-based social media giant was unanimous.
Democratic lawmakers and consumer groups said the court opened a gaping hole in the law, the Telephone Consumer Protection Act, that would subject anyone with a cellphone to endless automated calls and messages.
The 1991 consumer law bars abusive telemarketing practices. The law restricts calls made using an “automatic telephone dialing system," a device that can “store or produce telephone numbers to be called, using a random or sequential number generator” and then call that number.
The question for the court was whether the law covers equipment that can store and dial telephone numbers even if the equipment does not use a random or sequential number generator.
Justice Sonia Sotomayor wrote for the court that it does not.
Facebook spokesman Andy Stone said in an emailed statement, “As the Court recognized, the law’s provisions were never intended to prohibit companies from sending targeted security notifications and the court’s decision will allow companies to continue working to keep the accounts of their users safe.”
But Sen. Edward Markey, D-Mass., and Rep. Anna Eshoo, D-Calif., said in a joint statement that the court ignored Congress' intent when it passed the law and now will allow “companies the ability to assault the public with a non-stop wave of unwanted calls and texts, around the clock.”
The lawmakers said they would introduce legislation to expressly prohibit Facebook's practice.
"If the Justices find their private mobile phones ringing non-stop from now until our legislation becomes law, they’ll only have themselves to blame,” Markey and Eshoo said.
Facebook had argued the lawsuit should be dismissed because Duguid had not claimed Facebook was sending messages that were randomly generated. Facebook said it sends targeted, individualized texts to numbers linked to specific accounts. A trial court agreed, but an appeals court reversed that decision.
Facebook said it was possible Duguid's cellphone number previously belonged to a Facebook user who opted to receive login notifications.
The case is Facebook v. Duguid, 19-511.