FCC CPNI and Data-Breach Rules: What Communications Firms Must Retain

CPNI, Customer Proprietary Network Information, is the data a carrier learns about a customer by providing service: numbers called, services bought, usage. The FCC’s CPNI rules require carriers to protect it, restrict access, train staff, and file annual compliance certifications (47 CFR §§ 64.2001-64.2011). The control that matters in an investigation is the access record: who inside the carrier touched a customer’s CPNI, and under what authority.

The breach regime raises the stakes. In its 2024 update, the FCC expanded the definition of a reportable breach to include inadvertent disclosures and broadened the categories of covered data, while setting notification timeframes to the Commission, law enforcement, and customers (FCC, 2024). A firm cannot notify within a deadline it cannot detect, which makes logging and retention the precondition for compliance, not an afterthought.

The Telephone Consumer Protection Act adds a third records duty. The TCPA restricts certain calls and texts without prior express consent, and enforcement, and private litigation, routinely turns on whether the caller can produce that consent (FCC, telemarketing and robocalls). Consent that is not recorded, timestamped, and retrievable is, for legal purposes, consent that did not happen.

Log CPNI access at the record level. The annual certification is only credible if the underlying access trail exists. Capture who viewed or exported customer data, when, and why.

Instrument breach detection to the notification clock. Work backwards from the FCC’s timeframes: if you must notify within a deadline, your detection and triage have to be faster than it.

Treat consent as a retained record. For every TCPA-governed contact, keep the consent artefact, source, timestamp, scope, where it can be produced years later.

Reconcile the same way finance does. The recurring failure is an access or consent log that exists in theory and cannot be produced in practice.

The FCC does not publish a uniform CPNI penalty schedule, but enforcement actions give the picture. In 2023 and 2024, the Commission pursued carriers for failing to protect CPNI after data brokers purchased records directly by impersonating customers or their representatives, a practice known as pretexting. AT&T, T-Mobile, and Verizon paid a combined $196.3 million in 2024 to resolve allegations that they sold customers' real-time location data to aggregators who resold it to bail bondsmen and bounty hunters, with no adequate controls on downstream use (FCC, 2024). The finding was not that a breach occurred, it was that the access and use controls were insufficient.

On the breach side, the 2023 update to the notification rule tightened the clock because the FCC had seen repeated examples of carriers waiting to notify until they had certainty rather than a reasonable determination. The rule now uses a "reasonably determined" standard: a carrier that waits for forensic confirmation before starting the notification clock is likely already late. Detection velocity is itself a compliance requirement.

TCPA enforcement comes from both the FCC and private plaintiffs. Class actions under the TCPA can aggregate statutory damages of $500-$1,500 per violation at scale; a campaign of 500,000 unconsented contacts could generate exposure in the hundreds of millions before punitive enhancement. The deterrence arithmetic is why consent architecture is not a nice-to-have.