The FCC's Telecom Data Breach Reporting Rule: What FCC 23-111 Adopted, Why Its Core Amendments Are Not in Force, and Where the Sixth Circuit Stands

The 2023 Order and 47 CFR § 64.2011

The Commission adopted its Report and Order in WC Docket No. 22-21, Data Breach Reporting Requirements, FCC 23-111, on December 13, 2023 and released it on December 21, 2023. The summary appeared in the Federal Register at 89 FR 9968 on February 12, 2024. Its stated aim was to revise a breach rule first adopted in 2007 against pretexting, which the Commission said had not kept pace with breaches that "have only grown in frequency and severity."

The effective date clause is what governs the rule today. The notice states: "This rule is effective March 13, 2024, except for the amendments codified at 47 CFR 64.2011 and 64.5111, instructions 3 and 4, respectively, which are delayed indefinitely. The Commission will publish a document in the Federal Register announcing the effective dates for the amendments." Instruction 2, the only other amendment, retitled subpart U "Privacy of Customer Information." The substantive breach changes are all in instructions 3 and 4.

The eCFR shows that announcement has not been made. The text of section 64.2011 current through October 1, 2026 is still headed "Notification of customer proprietary network information security breaches" and carries a link to the amendment "published at 89 FR 10002, Feb. 12, 2024" rather than the amended text. A Federal Register search for FCC documents after February 2024 returned no effective-date notice for either section, and the Commission's 2026 Unified Agenda lists the docket's next action as "Undetermined" and "To Be Determined."

The rule actually in force therefore remains the 2007 version. It requires a carrier to notify the United States Secret Service and the FBI through a central reporting facility within seven business days after "reasonable determination" of a breach. The carrier may not notify customers or the public until seven full business days after that report, unless it identifies an extraordinarily urgent need and consults the investigating agency, and the agency may direct a further delay of up to 30 days, extendable. Customers are notified afterward, records are kept for two years, and a breach occurs only when a person "has intentionally gained access to, used, or disclosed CPNI."

Breach Defined to Include Inadvertent Access

The adopted section 64.2011(e) defines a breach as occurring "when a person, without authorization or exceeding authorization, gains access to, uses, or discloses covered data." The word "intentionally" is gone, which is how the order reaches inadvertent exposures. A good-faith exception is new: a breach "shall not include a good-faith acquisition of covered data by an employee or agent of a telecommunications carrier where such information is not used improperly or further disclosed."

Covered data is CPNI plus personally identifiable information. The adopted PII definition has three parts:

• A first name or first initial and last name combined with a government-issued identification number, information on a government document used to verify identity, or another unique identification number used for authentication
• A username or email address combined with a password, security question and answer, "or any other authentication method or information necessary to permit access to an account"
• "Unique biometric, genetic, or medical data"

Two further clauses widen it. Dissociated data that would be PII if linked counts as PII if the means to link it were accessed along with it, and any single element or combination counts if it "would enable a person to commit identity theft or fraud." Information lawfully available from government records or widely distributed media is excluded. The order said the Commission relied on section 222(a) and, independently, on section 201(b)'s just-and-reasonable-practices requirement for this expansion beyond CPNI.

Notice to the FCC, Secret Service and FBI

Adopted section 64.2011(a) keeps the seven-business-day clock but adds the Commission: a carrier "shall electronically notify the Commission, the United States Secret Service (Secret Service), and the Federal Bureau of Investigation (FBI) through a central reporting facility." The report must include at least seven items: the carrier's address and contact information, a description of the incident, the method of compromise, its date range, the approximate number of customers affected, an estimate of financial loss to the carrier and customers, and the types of data breached.

Paragraph (a)(3) exempts from agency notice a breach that "affects fewer than 500 customers" where the carrier "reasonably determines that no harm to customers is reasonably likely to occur." If later information defeats the exemption, the carrier reports within seven business days of that discovery. Exempt breaches do not vanish: paragraph (d) requires an officer to sign and file, by February 1 each year, a summary of the prior year's breaches that affected fewer than 500 individuals and posed no reasonably likely harm. Recordkeeping under paragraph (c) is extended to cover the bases for any determination about the number of customers affected or the likelihood of harm.

Customer Notice and the Harm-Based Trigger

The adopted rule removes the mandatory wait. Paragraph (b) requires notice to affected customers "without unreasonable delay after notification to the Commission and law enforcement" and "no later than 30 days after reasonable determination of a breach," subject to a written law enforcement or national security hold of up to 30 days that can be extended. The notice needs only "sufficient information so as to make a reasonable customer aware that a breach occurred on a certain date, or within a certain estimated timeframe, and that such a breach affected or may have affected that customer's data."

Customer notice is not required in two cases: where the carrier "reasonably determines that no harm to customers is reasonably likely to occur," or where the breach "solely involves encrypted data and the carrier has definitive evidence that the encryption key was not also accessed, used, or disclosed." The order describes this as a rebuttable presumption of harm: where a carrier cannot reasonably determine that harm is unlikely, notice remains due. It lists factors for that judgment, beginning with the sensitivity of the information "including in totality," and states that "no single factor on its own is sufficient." Unlike the customer trigger, agency notice is not harm-based for breaches affecting 500 or more customers.

The TRS Provider Rules

Telecommunications relay service providers have a parallel rule at section 64.5111, adopted in 2013 for CPNI. The current text tracks the 2007 carrier rule, with the same seven-business-day reports and waiting period, plus a requirement to file a copy of the notification with the Disability Rights Office of the Consumer and Governmental Affairs Bureau when customers are notified. Its eCFR entry also links to an amendment published in February 2024 that has not taken effect.

The adopted TRS text mirrors the carrier changes: notice to the Disability Rights Office, Secret Service and FBI within seven business days, the same 500-customer and no-harm exemptions, an annual summary, and a 30-day customer deadline. Its covered data is broader than the carriers' version in one respect. It includes CPNI, PII as defined in section 64.2011(e)(5), and "the content of any relayed conversation" within the meaning of section 64.604(a)(2)(i).

The Sixth Circuit Challenge

Petitions for review were filed in the Sixth, Fifth and D.C. Circuits. The Judicial Panel on Multidistrict Litigation consolidated the first two in the Sixth Circuit on March 4, 2024, the D.C. Circuit transferred the third, and Hamilton Relay intervened. On August 13, 2025, in Ohio Telecom Ass'n v. FCC, Nos. 24-3133/3206/3252, a divided panel denied the petitions. Judge Stranch wrote for the court, joined by Judge Mathis; Judge Griffin concurred in part and dissented.

The panel's holdings split the Commission's two theories. It concluded "that the FCC does not have the authority under § 222(a) to impose data breach reporting requirements regarding customer PII," reading section 222 as a whole to focus on a limited set of categories. It upheld the rule under section 201(b), concluding that the provision "gives the FCC the authority to impose reporting requirements in the event of a data breach of customer PII," and upheld the TRS rules under section 225. On the Congressional Review Act, it held the 2024 order was not "substantially the same" as the 2016 broadband privacy order Congress disapproved in Pub. L. 115-22. Judge Griffin would have set the rule aside on both the CRA and section 201(b).

Two later filings changed the posture. On September 29, 2025 the Commission filed an unopposed motion to hold the case in abeyance, stating that it "now has three sitting members, only one of whom (Commissioner Gomez) voted to approve the Order," and was "in the process of evaluating the agency's past actions, including the Order challenged here." Then, on July 31, 2026, the court issued an order granting rehearing en banc. Citing Sixth Circuit Rule 40(d), it ordered "that the previous decision and judgment of this Court are vacated, the mandate is stayed, and this case is restored to the docket as a pending appeal," with supplemental briefing and argument to be scheduled.

The result, as of October 5, 2026, is that no appellate decision on the order's validity is in effect, the full Sixth Circuit has the case, and the amendments that carry the order's substance have no announced effective date. The order's adopted text describes what the Commission voted for; the eCFR's 2007-era text describes what currently binds carriers.

Frequently Asked Questions