public-service · CPNI notice requirements
The Notice a Phone Carrier Must Give Before Using Your CPNI
47 CFR 64.2008 sets what a carrier's CPNI notice must say before it asks to use your account data for marketing.
In this article
Updated: Sources: 1
Start here
What matters now
- A carrier must notify you of your CPNI rights before it asks for approval to use your data.
- The notice must state your right and the carrier's duty to protect CPNI confidentiality.
- It must specify what counts as CPNI and which entities will receive it.
- It must clearly state that denying approval won't affect your existing service.
- Carriers can't use the notice to push you toward freezing third-party CPNI access, and must keep records for at least a year.
Before a telecommunications carrier can ask for your approval to use your Customer Proprietary Network Information (CPNI) — for example, for marketing — federal rule 47 CFR 64.2008 requires it to send you a notice first, and that notice must contain specific statements while omitting others. “Prior to any solicitation for customer approval, a telecommunications carrier must provide notification to the customer of the customer’s right to restrict use of, disclosure of, and access to that customer’s CPNI” (47 CFR 64.2008).
This original record-reading guide is a general reading aid, not cited evidence. It does not depict a source record; the article text and source links provide the facts.
Key points
- A carrier must notify the customer of CPNI rights before it solicits approval to use that data, not at the same time or after (47 CFR 64.2008).
- The notice must “state that the customer has a right, and the carrier has a duty, under federal law, to protect the confidentiality of CPNI” (47 CFR 64.2008).
- The notice must “specify the types of information that constitute CPNI and the specific entities that will receive the CPNI” (47 CFR 64.2008).
- The notice must “clearly state that a denial of approval will not affect the provision of any services to which the customer subscribes” (47 CFR 64.2008).
- The carrier “may not include in the notification any statement attempting to encourage a customer to freeze third-party access to CPNI” (47 CFR 64.2008), and it must keep notification records for at least one year (47 CFR 64.2008).
When the notice has to arrive
The rule fixes the sequence, not just the content. “Prior to any solicitation for customer approval, a telecommunications carrier must provide notification to the customer of the customer’s right to restrict use of, disclosure of, and access to that customer’s CPNI” (47 CFR 64.2008). The notice has to come first, before any ask for approval to use the data.
What the notice must state
Three required elements appear directly in the text of the rule.
The notice must “state that the customer has a right, and the carrier has a duty, under federal law, to protect the confidentiality of CPNI” (47 CFR 64.2008).
It must also “specify the types of information that constitute CPNI and the specific entities that will receive the CPNI” (47 CFR 64.2008) — telling the customer, in that specific notice, what kind of data is at stake and who would get it.
And it must “clearly state that a denial of approval will not affect the provision of any services to which the customer subscribes” (47 CFR 64.2008) — making clear that saying no does not put existing service at risk.
What the notice must not say
The rule also bars one kind of statement. A carrier “may not include in the notification any statement attempting to encourage a customer to freeze third-party access to CPNI” (47 CFR 64.2008). The notice cannot be used to steer the customer toward locking out other companies’ access to the data.
Proof Retention
The recordkeeping duty runs alongside the notice content requirements. “A telecommunications carrier must maintain records of notification, whether oral, written or electronic, for at least one year.” (47 CFR 64.2008)
What this article does not cover
This piece answers only what 47 CFR 64.2008 requires of the pre-solicitation CPNI notice itself. It does not define what counts as CPNI — that definition sits elsewhere in the statute and the rest of Subpart U. It does not describe the broader approval framework, including how opt-in and opt-out approval mechanics work beyond the fact that a notice must precede solicitation. It does not address what happens to customer information a carrier holds that is not CPNI. And it does not give you a mechanism for actually restricting use of your CPNI or a remedy if a carrier fails to send or follow this notice requirement — for either of those, you would need to look beyond this section of the rule.