Data Security Rules

The FCC's CPNI Rules: Section 222, Customer Approval, Authentication and the Annual Certification

October 5, 2026

Customer proprietary network information is the record of whom a phone customer calls, when, for how long and on what plan. Section 222 of the Communications Act limits how carriers use it, and the FCC's rules in subpart U of part 64 add a two-tier customer approval system, password and ID checks before disclosure, and an officer-signed compliance certificate filed every March 1.

Read more →
Breach Notification

The FCC's Telecom Data Breach Reporting Rule: What FCC 23-111 Adopted, Why Its Core Amendments Are Not in Force, and Where the Sixth Circuit Stands

October 5, 2026

In December 2023 the FCC rewrote its carrier breach rule to reach personally identifiable information and inadvertent exposures, add itself as a recipient, and swap a mandatory waiting period for a 30-day limit. Those amendments still await an effective date, and on July 31, 2026 the Sixth Circuit vacated the panel decision upholding the order.

Read more →
Data Brokers

$196 Million, Three Circuits and a Supreme Court Ruling: The FCC's Carrier Location Data Fines

October 5, 2026

In April 2024 the FCC fined the four national wireless carriers a combined $196,486,875 for selling access to customer location data through aggregators without adequate safeguards. All four paid and sued. Two circuits upheld the fines, one vacated AT&T's, and in June 2026 the Supreme Court held the FCC's forfeiture process does not violate the Seventh Amendment.

Read more →
TCPA

The FCC's One-to-One Consent Rule, Vacated Before It Ever Took Effect

September 1, 2026

The FCC's 2023 order would have required consumers to consent to telemarketing robocalls one seller at a time, and limited each call's subject matter to the site where consent was given. The Eleventh Circuit vacated both restrictions on January 24, 2025, before the rule took effect, and the Commission removed the text from the CFR in August 2025.

Read more →
TCPA

Revoking TCPA Consent: The 2024 FCC Rule, and the Part of It Still Waived

September 1, 2026

A February 2024 FCC order codified the right to revoke TCPA consent by any reasonable means, fixed seven per se opt-out words for reply texts, capped the processing window at ten business days, and permitted one confirmation message. The cross-message-type portion of that rule has been waived twice and is now scheduled to take effect January 31, 2027.

Read more →
TCPA

TCPA Consent: What Is Required Before a Call or Text

August 12, 2026

The TCPA converts a single unwanted marketing text into statutory damages with no proof of harm, which is why it produces class action volume out of proportion to its age. This guide covers which calls need which grade of consent, what survived the Supreme Court's narrowing of the autodialer definition, how consent is revoked, and where the exemptions sit.

Read more →