--- title: "47 CFR 64.2010 CPNI: Safeguards on the disclosure of customer proprietary network information" canonical: "https://dposchool.com/cpni/section/64.2010" source: "https://www.ecfr.gov/current/title-47/section-64.2010" source_note: "Source: United States Code, title 47, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 47, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 47 CFR 64.2010 CPNI ยท Subpart U: Privacy of Customer Information # 47 CFR 64.2010 CPNI: Safeguards on the disclosure of customer proprietary network information eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text Link to an amendment published at 88 FR 85814, Dec. 8, 2023. Link to a correction published at 88 FR 88261, Dec. 21, 2023. ### 47 CFR 64.2010(a) **(a)** Safeguarding CPNI. Telecommunications carriers must take reasonable measures to discover and protect against attempts to gain unauthorized access to CPNI. Telecommunications carriers must properly authenticate a customer prior to disclosing CPNI based on customer-initiated telephone contact, online account access, or an in-store visit. ### 47 CFR 64.2010(b) **(b)** Telephone access to CPNI. Telecommunications carriers may only disclose call detail information over the telephone, based on customer-initiated telephone contact, if the customer first provides the carrier with a password, as described in paragraph (e) of this section, that is not prompted by the carrier asking for readily available biographical information, or account information. If the customer does not provide a password, the telecommunications carrier may only disclose call detail information by sending it to the customer's address of record, or by calling the customer at the telephone number of record. If the customer is able to provide call detail information to the telecommunications carrier during a customer-initiated call without the telecommunications carrier's assistance, then the telecommunications carrier is permitted to discuss the call detail information provided by the customer. ### 47 CFR 64.2010(c) **(c)** Online access to CPNI. A telecommunications carrier must authenticate a customer without the use of readily available biographical information, or account information, prior to allowing the customer online access to CPNI related to a telecommunications service account. Once authenticated, the customer may only obtain online access to CPNI related to a telecommunications service account through a password, as described in paragraph (e) of this section, that is not prompted by the carrier asking for readily available biographical information, or account information. ### 47 CFR 64.2010(d) **(d)** In-store access to CPNI. A telecommunications carrier may disclose CPNI to a customer who, at a carrier's retail location, first presents to the telecommunications carrier or its agent a valid photo ID matching the customer's account information. ### 47 CFR 64.2010(e) **(e)** Establishment of a password and back-up authentication methods for lost or forgotten passwords. To establish a password, a telecommunications carrier must authenticate the customer without the use of readily available biographical information, or account information. Telecommunications carriers may create a back-up customer authentication method in the event of a lost or forgotten password, but such back-up customer authentication method may not prompt the customer for readily available biographical information, or account information. If a customer cannot provide the correct password or the correct response for the back-up customer authentication method, the customer must establish a new password as described in this paragraph. ### 47 CFR 64.2010(f) **(f)** Notification of account changes. (1) Telecommunications carriers must notify customers immediately whenever a password, customer response to a back-up means of authentication for lost or forgotten password, online account, or address of record is created or changed. This notification is not required when the customer initiates service, including the selection of a password at service initiation. This notification may be through a carrier-originated voicemail or text message to the telephone number of record, or by mail to the address of record, and must not reveal the changed information or be sent to the new account information. #### 47 CFR 64.2010(f)(2) **(2)** Beginning on July 15, 2024, paragraph (f)(1) of this section does not apply to a change made in connection with a line separation request under 47 U.S.C. 345 and subpart II of this part. ### 47 CFR 64.2010(g) **(g)** Business customer exemption. Telecommunications carriers may bind themselves contractually to authentication regimes other than those described in this section for services they provide to their business customers that have both a dedicated account representative and a contract that specifically addresses the carriers' protection of CPNI. ### 47 CFR 64.2010(h) **(h)** Subscriber Identity Module (SIM) changes. A provider of commercial mobile radio service (CMRS), as defined in 47 CFR 20.3, including resellers of wireless service, shall only effectuate SIM change requests in accordance with this section. For purposes of this section, SIM means a physical or virtual card associated with a device that stores unique information that can be identified to a specific mobile network. #### 47 CFR 64.2010(h)(1) **(1)** Customer authentication. A CMRS provider shall use secure methods to authenticate a customer that are reasonably designed to confirm the customer's identity before executing a SIM change request, except to the extent otherwise required by 47 U.S.C. 345 (Safe Connections Act of 2022) or subpart II of this part. Authentication methods shall not rely on readily available biographical information, account information, recent payment information, or call detail information unless otherwise permitted under 47 U.S.C. 345 or subpart II of this part. A CMRS provider shall regularly, but not less than annually, review and, as necessary, update its customer authentication methods to ensure that its authentication methods continue to be secure. A CMRS provider shall establish safeguards and processes so that employees who receive inbound customer communications are unable to access CPNI in the course of that customer interaction until after the customer has been properly authenticated. #### 47 CFR 64.2010(h)(2) **(2)** -(6) \[Reserved\] #### 47 CFR 64.2010(h)(7) **(7)** Employee training. A CMRS provider shall develop and implement training for employees to specifically address fraudulent SIM change attempts, complaints, and remediation. Training shall include, at a minimum, how to identify potentially fraudulent SIM change requests, how to identify when a customer may be the victim of SIM swap fraud, and how to direct potential victims and individuals making potentially fraudulent requests to employees specifically trained to handle such incidents. #### 47 CFR 64.2010(h)(8) **(8)** \[Reserved\] #### 47 CFR 64.2010(h)(9) **(9)** Compliance. This paragraph (h) contains information-collection and/or recordkeeping requirements. Compliance with this paragraph (h) will not be required until this paragraph is removed or contains a compliance date. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 47, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[82 FR 44419, Sept. 21, 2017, as amended at 88 FR 85814, Dec. 8, 2023; 88 FR 84448, Dec. 5, 2023; 88 FR 88261, Dec. 21, 2023; 89 FR 47870, June 4, 2024\] [47 CFR 64.2010 on eCFR](https://www.ecfr.gov/current/title-47/section-64.2010) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [CPNI Navigator](https://dposchool.com/cpni) / 47 CFR 64.2010 Previous: [47 CFR 64.2009 CPNI: Safeguards required for use of customer proprietary network information](https://dposchool.com/cpni/section/64.2009) Next: [47 CFR 64.2011 CPNI: Notification of customer proprietary network information security breaches](https://dposchool.com/cpni/section/64.2011) ## For AI agents - Machine-readable index: https://dposchool.com/cpni/llms.txt - JSON API: https://dposchool.com/cpni/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents