--- title: "47 CFR 64.2009 CPNI: Safeguards required for use of customer proprietary network information" canonical: "https://dposchool.com/cpni/section/64.2009" source: "https://www.ecfr.gov/current/title-47/section-64.2009" source_note: "Source: United States Code, title 47, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 47, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 47 CFR 64.2009 CPNI ยท Subpart U: Privacy of Customer Information # 47 CFR 64.2009 CPNI: Safeguards required for use of customer proprietary network information eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 47 CFR 64.2009(a) **(a)** Telecommunications carriers must implement a system by which the status of a customer's CPNI approval can be clearly established prior to the use of CPNI. ### 47 CFR 64.2009(b) **(b)** Telecommunications carriers must train their personnel as to when they are and are not authorized to use CPNI, and carriers must have an express disciplinary process in place. ### 47 CFR 64.2009(c) **(c)** All carriers shall maintain a record, electronically or in some other manner, of their own and their affiliates' sales and marketing campaigns that use their customers' CPNI. All carriers shall maintain a record of all instances where CPNI was disclosed or provided to third parties, or where third parties were allowed access to CPNI. The record must include a description of each campaign, the specific CPNI that was used in the campaign, and what products and services were offered as a part of the campaign. Carriers shall retain the record for a minimum of one year. ### 47 CFR 64.2009(d) **(d)** Telecommunications carriers must establish a supervisory review process regarding carrier compliance with the rules in this subpart for outbound marketing situations and maintain records of carrier compliance for a minimum period of one year. Specifically, sales personnel must obtain supervisory approval of any proposed outbound marketing request for customer approval. ### 47 CFR 64.2009(e) **(e)** A telecommunications carrier must have an officer, as an agent of the carrier, sign and file with the Commission a compliance certificate on an annual basis. The officer must state in the certification that he or she has personal knowledge that the company has established operating procedures that are adequate to ensure compliance with the rules in this subpart. The carrier must provide a statement accompanying the certificate explaining how its operating procedures ensure that it is or is not in compliance with the rules in this subpart. In addition, the carrier must include an explanation of any actions taken against data brokers and a summary of all customer complaints received in the past year concerning the unauthorized release of CPNI. This filing must be made annually with the Enforcement Bureau on or before March 1 in EB Docket No. 06-36, for data pertaining to the previous calendar year. ### 47 CFR 64.2009(f) **(f)** Carriers must provide written notice within five business days to the Commission of any instance where the opt-out mechanisms do not work properly, to such a degree that consumers' inability to opt-out is more than an anomaly. #### 47 CFR 64.2009(f)(1) **(1)** The notice shall be in the form of a letter, and shall include the carrier's name, a description of the opt-out mechanism(s) used, the problem(s) experienced, the remedy proposed and when it will be/was implemented, whether the relevant state commission(s) has been notified and whether it has taken any action, a copy of the notice provided to customers, and contact information. #### 47 CFR 64.2009(f)(2) **(2)** Such notice must be submitted even if the carrier offers other methods by which consumers may opt-out. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 47, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. [47 CFR 64.2009 on eCFR](https://www.ecfr.gov/current/title-47/section-64.2009) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [CPNI Navigator](https://dposchool.com/cpni) / 47 CFR 64.2009 Previous: [47 CFR 64.2008 CPNI: Notice required for use of customer proprietary network information](https://dposchool.com/cpni/section/64.2008) Next: [47 CFR 64.2010 CPNI: Safeguards on the disclosure of customer proprietary network information](https://dposchool.com/cpni/section/64.2010) ## For AI agents - Machine-readable index: https://dposchool.com/cpni/llms.txt - JSON API: https://dposchool.com/cpni/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents