The FCC's CPNI Rules: Section 222, Customer Approval, Authentication and the Annual Certification

Section 222 of the Communications Act

47 U.S.C. § 222, titled "Privacy of customer information," was added by section 702 of the Telecommunications Act of 1996 and amended in 1999 and 2008. Subsection (a) gives every telecommunications carrier "a duty to protect the confidentiality of proprietary information of, and relating to, other telecommunication carriers, equipment manufacturers, and customers." Subsection (b) bars a carrier that receives another carrier's proprietary information from using it for its own marketing.

The core customer rule is subsection (c)(1). "Except as required by law or with the approval of the customer," a carrier that obtains CPNI by providing a telecommunications service may use, disclose or permit access to individually identifiable CPNI only in providing that service or services "necessary to, or used in" providing it, including directory publishing. Subsection (c)(2) requires disclosure to anyone the customer designates on "affirmative written request," and (c)(3) frees aggregate customer information, with a nondiscrimination condition for local exchange carriers.

Subsection (d) lists four uses that need no approval: to initiate, render, bill and collect for service; to protect the carrier's rights or property or protect users and other carriers from fraud and abuse; to provide inbound telemarketing, referral or administrative services for the duration of a customer-initiated call, with the customer's approval; and to provide call location information to emergency responders, to family members in an emergency, or to emergency database providers. Subsection (f) raises the bar for two kinds of data. Without "the express prior authorization of the customer," a customer is not considered to have approved use or disclosure of wireless or IP-enabled voice call location information, outside the emergency exceptions, or of automatic crash notification information beyond operating a crash notification system.

What Counts as CPNI

Section 222(h)(1) defines customer proprietary network information in two parts: "information that relates to the quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service subscribed to by any customer," made available to the carrier "solely by virtue of the carrier-customer relationship"; and "information contained in the bills pertaining to telephone exchange service or telephone toll service." Subscriber list information, meaning listed names, numbers, addresses and advertising classifications that have been published in a directory, is excluded.

The Commission has never published a complete list. In its 2023 SIM swap order, FCC 23-95, it summarized CPNI as including "the phone numbers called by a consumer; the frequency, duration, and timing of such calls; and any services purchased by the consumer, such as call waiting." The rules carve out a narrower category for authentication purposes. Section 64.2003(d) defines call detail information as any information about the transmission of specific calls, including the number called or calling and "the time, location, or duration of any call."

Whether section 222(a)'s broader phrase, "proprietary information of, and relating to . . . customers," reaches personal information beyond CPNI is contested. A Sixth Circuit panel held in August 2025 that it does not, in the litigation over the FCC's 2023 breach order, but the court vacated that decision when it granted rehearing en banc on July 31, 2026.

Opt-Out and Opt-In Approval Under §§ 64.2007 and 64.2008

The implementing rules are in 47 CFR part 64, subpart U, whose current text the eCFR dates to 82 FR 44419 of September 21, 2017. The Sixth Circuit panel opinion recounts that the Commission that month rescinded the 2016 broadband privacy order Congress had disapproved and reinstated the earlier rules. They sort uses of CPNI into three tiers.

No approval. Section 64.2005 lets a carrier use CPNI to market offerings within the categories of service (local, interexchange and CMRS) the customer already buys from it, and to share it among affiliates that serve a customer who subscribes to more than one category. A wireless provider may use CMRS-derived CPNI for equipment and information services, and a wireline carrier for equipment, voice mail and similar services. The section also covers inside wiring, CMRS health effects research, the marketing of features such as caller ID and call waiting, and protection against fraud. It separately prohibits using CPNI "to identify or track customers that call competing service providers."

Opt-out or opt-in. Section 64.2007(b) allows either method for using individually identifiable CPNI to market "communications-related services" to the customer, and for disclosing it for that purpose to the carrier's agents and to affiliates that provide communications-related services. Communications-related services are telecommunications services, information services typically provided by carriers, and equipment-related services; the definition excludes retail services offered over websites, "such as travel reservation services or mortgage lending services."

Opt-in only. Every other use, disclosure or access, beyond section 64.2005 and the statute's own exceptions, requires opt-in approval, defined in section 64.2003(k) as "affirmative, express consent" given after notice.

Section 64.2008 sets the notice that precedes any solicitation. It must tell the customer of the right to restrict CPNI and the carrier's duty to protect it, specify the types of CPNI, the entities that will receive it and the purposes, explain the precise steps to grant or deny access, and "clearly state that a denial of approval will not affect the provision of any services." It may not encourage a customer to freeze third-party access. For opt-out, notice must be written or electronic, the carrier must wait at least 30 days before assuming approval (counted from the third day after mailing for paper notices), and the notice must be repeated every two years. Email opt-out notices require prior express approval to use email, a reply-to-opt-out function and an accurate subject line, and a free opt-out method must be available around the clock. Oral notice may be used for one-time use of CPNI for the duration of a call.

Authentication Before Disclosure on Calls, Online and in Store

Section 64.2010, added in 2007 to address pretexting, begins with a general duty: carriers "must take reasonable measures to discover and protect against attempts to gain unauthorized access to CPNI" and must authenticate a customer before disclosing CPNI on a customer-initiated call, online, or in a store. The three channels are treated differently:

• Telephone: call detail information may be disclosed only if the customer gives a password "not prompted by the carrier asking for readily available biographical information, or account information." Without one, the carrier may only send it to the address of record or call the telephone number of record, though it may discuss call details the customer raises unprompted
• Online: the carrier must authenticate the customer without biographical or account information, and later online access must use a password set the same way
• In store: CPNI may be disclosed to a customer who presents a valid, unexpired government-issued photo ID matching the account information

Readily available biographical information includes a Social Security number or its last four digits, mother's maiden name, home address and date of birth; account information includes account numbers, the telephone number and the bill amount. Back-up authentication for forgotten passwords may not rely on either. A carrier must notify the customer "immediately" when a password, back-up answer, online account or address of record is created or changed, by voicemail or text to the number of record or by mail to the address of record, without revealing the changed information. Since July 15, 2024 that notice does not apply to line separations under the Safe Connections Act. Business customers with a dedicated account representative and a contract addressing CPNI may agree to a different regime.

Paragraph (h), added by FCC 23-95, requires wireless providers to use secure methods to authenticate SIM change requests, without relying on biographical, account, recent payment or call detail information, to review those methods at least annually, to keep employees from seeing CPNI until a customer is authenticated, and to train employees on SIM swap fraud. Paragraph (h)(9) states that compliance "will not be required until this paragraph is removed or contains a compliance date," and the eCFR text current through October 1, 2026 contains no compliance date.

The Annual Certification

Section 64.2009 collects the internal safeguards. A carrier must be able to establish a customer's approval status before using CPNI, train personnel on when use is authorized and maintain "an express disciplinary process," keep a one-year record of sales and marketing campaigns using CPNI and of every disclosure to third parties, and require supervisory approval of outbound marketing requests for customer approval. If opt-out mechanisms fail "to such a degree that consumers' inability to opt-out is more than an anomaly," the carrier must send the Commission a letter within five business days.

Paragraph (e) is the filing most carriers encounter. An officer, acting as the carrier's agent, must sign and file a compliance certificate stating "personal knowledge that the company has established operating procedures that are adequate to ensure compliance." It must be accompanied by a statement explaining how those procedures do or do not ensure compliance, "an explanation of any actions taken against data brokers," and "a summary of all customer complaints received in the past year concerning the unauthorized release of CPNI." The filing is made with the Enforcement Bureau "on or before March 1 in EB Docket No. 06-36, for data pertaining to the previous calendar year."

Which Providers the Rules Reach

Section 64.2003(o) adopts the Communications Act's definition of telecommunications carrier and adds that the term "shall include an entity that provides interconnected VoIP service." According to FCC 23-95, the Commission extended the CPNI rules to interconnected VoIP in its 2007 order because wireline, wireless and interconnected VoIP services, "from the perspective of a customer making an ordinary telephone call, are virtually indistinguishable," and Congress ratified the extension in the New and Emerging Technologies 911 Improvement Act of 2008 by adding IP-enabled voice service to section 222's location and emergency provisions.

Telecommunications relay service providers follow a parallel set of CPNI rules in subpart DD of part 64. Section 64.2003(i) keeps retail web services that may technically be information services outside the communications-related services category. Breaches of CPNI are handled by section 64.2011, whose 2007 text remains in force while amendments adopted in the FCC's 2023 data breach order await an effective date.

Frequently Asked Questions