The Compliance Obligation You Might Be Overlooking

When telecom carriers think about FCC compliance, they usually focus on call blocking, STIR/SHAKEN, and robocall mitigation. But another critical compliance area is often overlooked: Customer Proprietary Network Information (CPNI).

CPNI is the information telecommunications carriers collect about their customers, including call details, service usage, and billing information. Under federal law, carriers must protect the confidentiality of this information.

And the FCC takes CPNI compliance very seriously.

What Is CPNI?

CPNI is defined in 47 U.S.C. § 222(h)(1) as information that relates to the quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service subscribed to by any customer.

Examples of CPNI include:

– Phone numbers called

– Call duration and frequency

– Service plans and features

– Billing information

– Customer location data

What CPNI is NOT:

Basic subscriber information such as name, address, and phone number (though this information is also protected under separate privacy rules).

The Annual CPNI Certification Requirement

Every year, telecommunications carriers and interconnected VoIP providers subject to the FCC‘s CPNI rules must file an annual CPNI certification.

The Deadline: March 3rd of every year.

What the Certification Must Include:

– A statement that the carrier has implemented policies and procedures to protect CPNI

– A summary of consumer complaints related to CPNI and actions taken

– A description of any security breaches and how they were addressed

– An officer’s signature certifying the accuracy of the filing

Filing Location: The certification must be filed with the FCC.

The Expanded Breach Notification Rules

In 2024, the FCC revised its data breach reporting and customer notification rules. These rules were upheld by the Sixth Circuit Court of Appeals in August 2025.

Key Changes:

Expanded Scope: Carriers must now disclose breaches of any customer personally identifiable information (PII), not just CPNI.

Intentional and Inadvertent Breaches: The rules apply to both intentional and inadvertent breaches.

Notification Requirements: Carriers must notify affected customers and law enforcement of security breaches involving CPNI.

What This Means for Carriers: You must have systems in place to detect, report, and respond to data breaches—regardless of whether they involve CPNI specifically or other types of customer PII.

How to Achieve CPNI Compliance

CPNI compliance requires a systematic approach:

Implement Policies and Procedures: Develop and document policies for protecting CPNI. These should cover data access, storage, transmission, and disposal.

Train Your Team: Ensure that all employees understand CPNI requirements and their responsibilities for protecting customer data.

File Annual Certifications: Submit your CPNI certification to the FCC by March 3 each year.

Monitor for Breaches: Implement systems to detect unauthorized access to customer data.

Respond to Breaches: If a breach occurs, notify affected customers and law enforcement as required by FCC rules.

Maintain Records: Keep detailed records of your CPNI compliance efforts.

The Consequences of Non-Compliance

Failing to comply with CPNI rules can have serious consequences:

Fines: The FCC can impose significant penalties for CPNI violations.

Enforcement Actions: Public enforcement actions damage your reputation and customer trust.

Legal Liability: Customers affected by CPNI breaches may bring lawsuits.

Regulatory Scrutiny: CPNI failures can trigger broader FCC investigations.

The Bottom Line

CPNI compliance is not optional for carriers. The annual March 3 deadline is approaching, and the FCC is actively enforcing CPNI rules.

At Microtalk, we help carriers implement CPNI compliance programs that protect customer data and meet FCC requirements. Because protecting your customers’ privacy isn’t just the law—it’s good business.

Is your carrier business CPNI-compliant? Have you filed your annual certification?