← Global Privacy Laws Research Library
47 CFR Part 64, Subpart U
FCC Customer Proprietary Network Information (CPNI) Rules
Prepared by Shubhank Suman · Last reviewed
Status not verified beyond supplied text
- Legal character
- Federal regulation
- Region
- North America
What it covers
Implements section 222 of the Communications Act for telecommunications carriers, including interconnected VoIP providers. Covers permitted CPNI uses, approval methods, notices, internal safeguards, customer authentication, account changes and breach reporting.
Why it matters
Distinguishes carrier customer-information duties from general internet privacy and from government access to stored communications. Customers can be individuals or entities, not only household consumers.
Refer to it when
Research carrier marketing with call/customer data, CPNI consent, customer account authentication, SIM changes or carrier breaches.
AI, privacy and cybersecurity relevance
- AI: Low
- Privacy: High
- Cyber: High
AI
LOW RELEVANCE
No general AI rules; carrier-data analytics can engage CPNI restrictions.
Privacy
HIGH RELEVANCE
Controls access, disclosure and marketing use of carrier customer data.
Cybersecurity
HIGH RELEVANCE
Customer authentication, safeguards and breach procedures.
Applicability
Telecommunications carriers and interconnected VoIP providers handling CPNI, subject to the subpart’s permitted uses and specific exceptions.
Read first
§§ 64.2001, 64.2003 → .2005-.2008 → .2009-.2010 (including (h)(9)) → .2011 and its amendment notices.
Provisions / sections covered
§§ 64.2001 and 64.2003 - Basis and definitions
Statutory basis is 47 U.S.C. 222. Carrier definition includes interconnected VoIP; call details and customer account information have specific definitions.
§§ 64.2005-.2008 - Uses, approval and notice
Some subscribed-service and protective uses do not require approval. Other uses require the appropriate approval method and sufficient notice; not every use is opt-in.
§§ 64.2009-.2010 - Safeguards and authentication
Training, records and certification accompany authentication controls. Qualifying business customers may contract for a different authentication regime. Section 64.2010(h)(9) defers compliance with paragraph (h) until removed or a compliance date is supplied.
§ 64.2011 - Breach notification in the supplied version
The displayed text provides law-enforcement notification and customer notice after that process, with delay exceptions and at least two years’ records. Amendment cross-references mean these displayed procedures must not be treated as independently verified present deadlines.
Subject-matter tags
- Consent
- Data breach
- Enforcement and penalties
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.