CPNI Compliance: Safeguarding Customer Information and Protecting Your Telecom Business

What is CPNI? Defining Sensitive Customer Data

Customer Proprietary Network Information (CPNI) refers to the data that telecommunications carriers and interconnected Voice over Internet Protocol (VoIP) providers collect about their subscribers. This information is a byproduct of the customer-carrier relationship and is highly sensitive.

According to the Federal Communications Commission (FCC), CPNI includes:

Type of Services Purchased: What services a customer subscribes to (e.g., call waiting, voicemail, specific data plans).

Calling Patterns: The number of minutes a customer uses, the numbers they call, the time of calls, and the frequency of calls.

Billing Information: Details regarding their telecom bills.

Location Information: Data relating to the geographic location of a mobile customer.

Crucially, CPNI excludes a customer’s name, address, and telephone number, which fall under the separate category of subscriber list information. However, this basic contact information remains subject to broader privacy regulations — and, as covered below, the FCC’s breach notification rules now extend well beyond CPNI alone.

Who CPNI Rules Apply To

The FCC’s CPNI rules apply to telecommunications carriers and interconnected Voice over Internet Protocol (VoIP) providers. This broad definition means that if you are offering any of the following, you are almost certainly subject to CPNI regulation:

• Traditional wireline phone service (CLECs, ILECs).

• Wireless mobile service.

• Voice over IP (VoIP) service that connects to the public switched telephone network (PSTN).

The rules apply regardless of the size of your operation, from large national carriers to smaller, growing VoIP providers.

What the Rules Require: Core CPNI Safeguards

The FCC’s CPNI rules are comprehensive, mandating robust protection for customer data. Key requirements include:

Authorization for Use: Providers generally cannot use or disclose CPNI without customer approval, except for specific exceptions (e.g., providing the service, billing, fraud prevention, legal mandates).

Customer Authentication: Before disclosing CPNI to a customer over the phone or online, providers must implement strict authentication protocols to verify the customer’s identity. This prevents unauthorized access.

Opt-Out Mechanisms: Customers must be provided clear methods to “opt-out” of certain uses of their CPNI for marketing purposes.

Supervisory Review: Employees who handle CPNI must be trained, and their activities must be subject to appropriate supervisory review.

Security Measures: Robust internal security measures are required to protect CPNI from unauthorized access or disclosure. This includes technical safeguards, physical security, and clear internal policies.

Reporting Breaches: The FCC substantially expanded these rules in 2024. They now cover both CPNI and personally identifiable information (PII), and apply to inadvertent as well as intentional disclosures. Providers must notify the FCC, the FBI and the Secret Service through the central reporting facility within seven business days of reasonably determining a breach has occurred. Customers must then be notified without unreasonable delay, and no later than 30 days after that determination.

The Annual CPNI Certification: A Mandate for Accountability

Beyond day-to-day compliance, a critical annual obligation is the CPNI Annual Certification. Telecommunications carriers and interconnected VoIP providers must file an annual certification with the FCC (via their Electronic Comment Filing System – ECFS) by March 1st of each year.

This certification includes:

• A statement that the company has established operating procedures to ensure CPNI compliance.

• An explanation of these procedures.

• A statement that the company has trained all personnel (including sales, marketing, and customer service) on CPNI rules.

• A summary of any customer complaints regarding CPNI during the past year.

• A summary of any attempts by pretexters to obtain CPNI from the company through fraudulent impersonation.

• A statement of compliance with breach reporting requirements.

Most importantly, the certification must be signed by a senior corporate officer, affirming under penalty of perjury that the company has a comprehensive CPNI compliance program in place.

Consequences of Non-Compliance: Severe and Costly

The FCC views CPNI violations with extreme gravity, leading to severe penalties that can devastate a business:

Monetary Fines: The FCC can levy substantial fines for CPNI violations. These fines can reach into the tens or hundreds of thousands of dollars per violation, often escalating for multiple incidents or repeated failures.

Cease and Desist Orders: The FCC can order a carrier to cease specific practices or even stop offering service until compliance is achieved.

Reputational Damage: CPNI breaches erode customer trust, leading to churn, negative press, and long-term harm to a company’s brand.

Legal Action: Customers or other entities may pursue civil litigation for privacy violations.

What to Do If You’re Non-Compliant or Experience a Breach

If your firm discovers a CPNI violation or, critically, experiences a breach, immediate and decisive action is required:

Containment: Stop the unauthorized use or disclosure of CPNI immediately.

Notification:

• Federal Agencies: Notify the FCC, the FBI and the Secret Service through the central reporting facility within seven business days of reasonably determining a breach occurred. For breaches affecting 500 or more customers this is mandatory regardless of likely harm. For breaches affecting fewer than 500 customers, notification is not required if you reasonably determine that no harm to customers is likely.

• Customers: Notify affected customers without unreasonable delay after federal notification, and no later than 30 days after the determination — unless law enforcement requests a delay. Notification is not required where the data was encrypted and you have evidence the encryption key was not compromised.

Investigation & Remediation: Conduct a thorough internal investigation to determine the cause of the breach or non-compliance and implement robust corrective measures to prevent recurrence.

Review & Update Procedures: Re-evaluate and strengthen your CPNI compliance program, including training, security protocols, and internal controls.

Seek Expert Counsel: Engage specialized telecom legal and compliance experts immediately. Navigating a breach and its aftermath is highly complex and carries immense risk.

CPNI Compliance — A Pillar of Telecom Integrity

CPNI compliance is more than a regulatory hurdle; it is a fundamental pillar of integrity for any telecommunications business. It demands continuous vigilance, robust internal controls, and a deep understanding of FCC requirements. Proactive measures, from employee training to secure data handling, are essential to protect your customers’ sensitive information and safeguard your firm from devastating penalties.

At ZIA CPA Associates, we understand the intricate intersection of telecom operations, compliance, and financial risk. We assist US-based telecom and VoIP providers in establishing, maintaining, and certifying comprehensive CPNI compliance programs, ensuring you protect your customers, your reputation, and your bottom line.

Is your firm’s CPNI compliance program robust and ready for its annual certification? Connect with ZIA CPA Associates for expert guidance.