FCC CPNI and Telecom Data Breach Rule Guide: Notification Duties, Status and Compliance Steps

US carriers hold some of the most sensitive data any company keeps, call records, location and account details, and the Federal Communications Commission (FCC) rules on protecting and reporting breaches of that data are in a legally unsettled state. The Customer Proprietary Network Information (CPNI) rules in 47 CFR Part 64 Subpart U have required carriers to authenticate customers, certify compliance every year and notify the Secret Service and FBI of CPNI breaches for almost two decades. In December 2023 the FCC adopted a Data Breach Order that would widen those duties to personally identifiable information, inadvertent breaches and notice to the FCC itself, but the codified amendments are not yet in effect and the order is back before the full Sixth Circuit. This guide sets out what applies today, what the 2023 order would change, how the FCC enforces, and how to build one breach process that works under either outcome. It is written for telecom security, privacy and compliance teams, and for vendors that process carrier customer data.

Status line (checked 27 October 2026): the eCFR text of 47 CFR 64.2011, up to date as of 22 October 2026, is still the pre-2023 CPNI breach rule. The 2023 amendments to 64.2011 and 64.5111 were "delayed indefinitely" pending an FCC effective-date notice. On 31 July 2026 the Sixth Circuit granted rehearing en banc in Ohio Telecom Association v. FCC, vacated its August 2025 panel decision upholding the order and stayed the mandate; argument was set for 21 October 2026. Check both before relying on this page.

Key takeaways

• The current rule is narrow but strict. Section 64.2011 covers intentional, unauthorised access to CPNI and requires electronic notice to the US Secret Service and FBI within seven business days of reasonably determining a breach, before customers are told.
• Customer notice waits for law enforcement. Carriers generally may not notify customers or the public until seven full business days after the federal notice, unless urgent harm justifies earlier notice after consulting the investigating agency, and an agency can ask for an initial delay of up to 30 days.
• The 2023 order is a moving target. FCC 23-111 would cover PII as well as CPNI, include inadvertent breaches, add the FCC as a recipient, use a harm-based trigger for customer notice and set a 30-day customer deadline, but its rule text is not yet effective.
• Enforcement uses Section 222 and Section 201(b). The FCC has fined the four national carriers about USD 196 million over location data (April 2024) and settled with AT&T for USD 13 million over a vendor's cloud breach of CPNI (September 2024).
• Machine access is where CPNI leaks. APIs, vendor integrations and service accounts reach CPNI at scale; the rule's authentication and account-change duties apply to people, so carriers have to add equivalent controls for non-human access themselves.

Scope: who and what is covered

The CPNI rules implement Section 222 of the Communications Act (47 U.S.C. 222). Section 222(a) gives every telecommunications carrier a duty to protect the confidentiality of proprietary information of customers, other carriers and equipment manufacturers. Section 222(c)(1) limits use and disclosure of individually identifiable CPNI to providing the service from which it was obtained, unless the law requires otherwise or the customer approves.

CPNI is defined in Section 222(h)(1) as information relating to the quantity, technical configuration, type, destination, location and amount of use of a telecommunications service, made available to the carrier solely because of the carrier-customer relationship, plus information in bills for telephone exchange or toll service. Subscriber list information (directory names, numbers and addresses) is excluded by Section 222(h)(3).

The Sixth Circuit panel decision of 13 August 2025 found that Section 222(a) does not reach personal information beyond CPNI but upheld the order under Section 201(b). That decision has now been vacated for en banc rehearing, so neither the holding nor the order's PII expansion should be treated as settled. State breach laws continue to apply alongside Section 64.2011, which displaces them only where they are inconsistent (64.2011(f)).

Key obligations

Breach notification today (64.2011)

1. Determine: start the clock when the carrier reasonably determines that a CPNI breach has occurred, not when the investigation ends.
2. Notify law enforcement: submit an electronic notice to the USSS and FBI through the FCC's central reporting facility as soon as practicable and in no event later than seven business days.
3. Hold customer notice: wait seven full business days after the federal notice unless the investigating agency directs a delay (an initial period of up to 30 days, extendable) or an extraordinarily urgent need to avoid immediate and irreparable harm justifies earlier notice after consulting the agency.
4. Notify customers: once the law enforcement process is complete, tell affected customers.
5. Keep records: retain records of each breach, the federal notice and the customer notices, with dates and descriptions where available, for at least two years.

Safeguards that sit around the breach rule

Business customers with a dedicated account representative and a contract that addresses CPNI may use other authentication methods (64.2010(g)). That exemption is narrow and should be recorded per contract.

Timeline and current status

Commentators have also noted that the current FCC leadership dissented from the 2023 order and that the agency has not said whether it will keep, revise or rescind it. Plan for three outcomes: the order survives and the FCC sets an effective date; it survives in part (for example, CPNI only); or it is vacated or withdrawn and 64.2011 stays as it is.

Enforcement and penalties

• Forfeitures under Section 222: the April 2024 location data orders fined AT&T more than USD 57 million, Sprint more than USD 12 million, T-Mobile more than USD 80 million and Verizon almost USD 47 million. The FCC found that the carriers sold access to location data through aggregators, shifted consent duties to downstream recipients and kept selling after learning their safeguards were ineffective.
• Consent decrees: the September 2024 AT&T settlement followed a breach at a marketing vendor where CPNI for roughly nine million customers remained in the vendor's cloud for years after it should have been deleted or returned. AT&T agreed to a USD 13 million civil penalty, a security programme, data inventory tracking, vendor oversight, retention and disposal obligations on vendors, and annual compliance audits.
• Certification failures: a missed or deficient annual 64.2009(e) certificate is a separate violation that the Enforcement Bureau pursues on its own.
• Parallel exposure: the same incident can trigger state breach laws, SEC disclosure for listed carriers and contractual notice to wholesale partners. See the Breach Notification Laws by Country Guide.

The lesson from both cases is that the FCC treats unreasonable data handling, not only a confirmed intrusion, as the violation. A vendor holding data it no longer needs is a finding in itself.

What it means for AI agents and non-human identities

Most CPNI does not leave a carrier through a customer care agent being tricked. It leaves through machine paths: customer APIs, partner and wholesale integrations, analytics exports, marketing vendors and, increasingly, AI assistants that read account data to answer customers. The T-Mobile API breach exposed account numbers, number of lines and plan features for about 37 million accounts through a single API used without authorisation, exactly the kind of account and usage data Section 222 protects.

• Service accounts and API clients: every identity that can query billing, call detail or location stores needs an owner, a documented purpose that matches Section 222(c)(1) and least-privilege scopes. See the Service Account Security Guide.
• Vendor credentials: the AT&T decree turns vendor retention into an access control problem. Revoke tokens and keys when a contract ends and require deletion evidence. See the NHI Offboarding and Decommissioning Guide.
• AI customer agents: an assistant that discloses call detail on a customer-initiated contact must apply the same 64.2010(b)-(c) authentication a human agent would, with no fallback to biographical questions, and should not carry standing access to all accounts. See the AI Agent Authorisation Guide.
• Account-change notices from automation: if bots or workflows change addresses of record or online credentials, 64.2010(f) notices must still fire. Test them for non-human changes.
• Breach scoping: the 2023 order's PII definition includes account credentials. If it takes effect, leaked customer portal tokens or API keys tied to customers become reportable data in their own right.

Compliance steps

1. Map CPNI and PII stores: list every system holding call detail, location, billing and account information, plus every vendor copy, with the identities (human and machine) that can read each.
2. Write a dual-track breach procedure: one decision tree that meets today's 64.2011 (USSS and FBI within seven business days, customer hold) and the 2023 order (FCC as recipient, 500-customer threshold, harm analysis, 30-day customer deadline), with a switch that compliance can flip if the order takes effect.
3. Pre-register and rehearse: confirm who can file through the central reporting facility, store the procedure in the incident response plan and run a tabletop that includes a law enforcement delay request.
4. Close authentication gaps: remove knowledge-based recovery, enforce 64.2010 rules in every channel including chat and AI assistants, and verify SIM change controls.
5. Govern vendors: add CPNI clauses on purpose, retention, deletion attestation and breach notice timing (shorter than seven business days) to every contract, and audit them annually.
6. Build the certification file: collect training, marketing campaign records, third-party disclosures, data broker actions and complaint summaries monthly so the 1 March certificate is evidence-based.
7. Track the litigation: assign an owner to monitor the Sixth Circuit docket and the Federal Register for an effective-date notice.

Framework mapping

Detection and measurement

• Time to determination: hours from first alert to a documented breach determination; the seven-day clock depends on it.
• Federal notice timeliness: percentage of CPNI breaches filed within five business days (a margin inside the seven).
• Machine access coverage: share of identities with CPNI access that have an owner, a purpose and a review in the last 90 days.
• Vendor data hygiene: number of vendors holding CPNI beyond contract term; target zero.
• Account-change alert coverage: percentage of credential and address changes, including automated ones, that generated a 64.2010(f) notice.
• Anomalous query volume: alerts on API clients reading more customer records than their baseline, a common signal of API abuse.

Common failure patterns

• Starting the clock too late: waiting for forensic certainty before declaring a determination, which pushes the federal notice past seven business days.
• Telling customers first: state law or public pressure drives early customer notice, breaching the 64.2011(a) sequencing without the required agency consultation.
• Forgotten vendor copies: marketing or analytics vendors keep CPNI after contracts end, the pattern behind the AT&T consent decree.
• Consent pushed downstream: relying on aggregators or partners to collect customer approval, which the FCC rejected in the location data orders.
• Bots outside the rules: chatbots, APIs and automated workflows that disclose call detail or change account data without the authentication and notice controls applied to staff.
• Treating the 2023 order as law, or ignoring it: both mistakes; build for today's rule and keep the expanded process ready.

Practitioner checklist

• Confirm the current 64.2011 text on eCFR and the Sixth Circuit status at each quarterly review.
• Inventory CPNI and PII stores and every human and machine identity with access.
• Document a breach determination standard and who signs it.
• Test filing through the central reporting facility and record the confirmation.
• Build the customer notice hold and law enforcement delay workflow into the incident plan.
• Apply 64.2010 authentication to AI assistants, chat and API channels, not only voice and store.
• Review vendor contracts for retention, deletion attestation and notice timing.
• Prepare the 1 March annual certificate from evidence collected through the year.
• Pre-draft notices that fit both the current rule and the 2023 order.

Standards and references

• eCFR: 47 CFR Part 64 Subpart U, Customer Proprietary Network Information
• Cornell LII: 47 U.S. Code 222, Privacy of customer information
• Federal Register: Data Breach Reporting Requirements, FCC 23-111
• US Court of Appeals for the Sixth Circuit: Ohio Telecom Association v. FCC, order granting rehearing en banc
• FCC: Fines against wireless carriers for sharing customer location data
• SecurityWeek: AT&T to pay USD 13 million in settlement over 2023 data breach
• Davis Wright Tremaine: Sixth Circuit upholds FCC data breach order, with en banc update

Related NHI Mgmt Group resources: UK Telecommunications Security Act Guide · Telecoms Identity Security Guide · Breach Notification Laws by Country Guide · Third-Party Access Guide. This guide summarises the FCC CPNI rules and the 2023 Data Breach Order as at 27 October 2026 and is not legal advice.