*Pages 1--112 from  Microsoft Word - FCC 02-214.doc*
 Federal  Communications  Commission  FCC  02-  214 
 Before  the  Federal  Communications  Commission 
 Washington,  D.  C.  20554 

 In  the  Matter  of 
 Implementation  of  the  Telecommunications  Act  of  1996: 

 Telecommunications  Carriers  Use  of  Customer  Proprietary  Network  Information 
 and  Other  Customer  Information; 
 Implementation  of  the  Non-  Accounting  Safeguards  of  Sections  271  and  272  of  the 
 Communications  Act  of  1934,  As  Amended 
 2000  Biennial  Regulatory  Review  --  Review  of  Policies  and  Rules  Concerning 
 Unauthorized  Changes  of  Consumers  Long  Distance  Carriers 

 )  ) 
 )  ) 
 )  ) 
 )  ) 
 )  ) 
 )  ) 
 )  ) 
 )  ) 
 ) 

 CC  Docket  No.  96-  115 
 CC  Docket  No.  96-  149 
 CC  Docket  No.  00-  257 
 THIRD  REPORT  AND  ORDER  AND  THIRD  FURTHER  NOTICE  OF  PROPOSED  RULEMAKING 
 Adopted:  July  16,  2002  Released:  July  25,  2002 
 Comment  Date:  30  Days  after  Federal  Register  Publication  of  this  NPRM  Reply  Comment  Date:  60  Days  after  Federal  Register  Publication  of  this  NPRM 

 By  the  Commission:  Chairman  Powell  issuing  a  statement;  Commissioners  Abernathy  and  Martin  issuing  separate  statements  and  Commissioner  Copps  approving  in  part,  dissenting  in  part 
 and  issuing  a  separate  statement. 

 TABLE  OF  CONTENTS  Paragraph 

 I.  INTRODUCTION  1 
 II.  BACKGROUND.  5 
 A.  SECTION  222  OF  THE  ACT.  5  B.  CPNI  ORDER...  10 

 C.  CPNI  RECONSIDERATION  ORDER...  15 
1
 Federal  Communications  Commission  FCC  02-  214 
 2 
 D.  TENTH  CIRCUIT  OPINION  ...............................................................................................................................  20  E.  AT&  T  AND  WORLDCOM  PETITIONS..............................................................................................................  21 
 F.  CLARIFICATION  ORDER  AND  FURTHER  NOTICE  OF  PROPOSED  RULEMAKING  ................................................  23 
 III.  THIRD  REPORT  AND  ORDER...............................................................................................................  26 
 A.  APPROVAL  STANDARD...................................................................................................................................  26  1.  Intra-  Company  and  Joint  Venture  Use  of  CPNI  by  Telecommunications  Carriers  ..................................  31 

 2.  Third  Parties  and  Carriers  Affiliates  That  Do  Not  Provide  Communications-  Related  Services  .............  50  3.  State  Choice..............................................................................................................................................  69 
 B.  OTHER  APPROVAL  ISSUES..............................................................................................................................  75  1.  The  Tenth  Circuits  Order  Vacated  Only  Those  CPNI  Rules  Related  to  Opt-  In......................................  79 
 2.  Total  Service  Approach............................................................................................................................  83  3.  Grandfathering  of  Previously  Obtained  CPNI  Approvals  ........................................................................  85 
 4.  Customer  Right  to  Restrict  Carrier  Use  of  CPNI  for  Marketing  Purposes  ...............................................  86  C.  CUSTOMER  NOTIFICATION  REQUIREMENTS  ...................................................................................................  89 
 1.  Form  of  Notice  .........................................................................................................................................  90  2.  Content  of  Notice  .....................................................................................................................................  97 
 3.  Frequency  of  Notice  ...............................................................................................................................  107  4.  Waiting  Period  for  Opt-  Out  Notification................................................................................................  112 
 5.  Methods  by  Which  Customers  Can  Exercise  CPNI  Rights  Under  Opt-  Out  or  Opt-  In  ...........................  118  D.  COMPETITION  ISSUES  ...................................................................................................................................  120 
 1.  Forbearance  for  Preferred  Carrier  Freeze  Information  ...........................................................................  120  2.  Denial  of  CPNI  to  Another  Carrier  With  Customer  Authorization  ........................................................  129 
 3.  Winback  and  Retention  Marketing.........................................................................................................  131  4.  Interplay  Between  Sections  222  and  272................................................................................................  135 

 IV.  THIRD  FURTHER  NOTICE  OF  PROPOSED  RULEMAKING........................................................  143 
 A.  REGULATION  OF  FOREIGN  STORAGE  OF  AND  ACCESS  TO  DOMESTIC  CPNI..................................................  144  B.  PROTECTIONS  FOR  CARRIER  INFORMATION  AND  ENFORCEMENT  MECHANISMS  ..........................................  145 

 C.  CPNI  IMPLICATIONS  WHEN  A  CARRIER  GOES  OUT  OF  BUSINESS  ................................................................  146 
 V.  PROCEDURAL  MATTERS.........................................................................................................................  148 
 A.  THIRD  REPORT  AND  ORDER  .........................................................................................................................  148  1.  Final  Regulatory  Flexibility  Analysis.....................................................................................................  148 

 2.  Final  Paperwork  Reduction  Act  Analysis...............................................................................................  149  B.  THIRD  FURTHER  NOTICE  OF  PROPOSED  RULEMAKING.................................................................................  150 
 1.  Ex  Parte  Presentations  ............................................................................................................................  150  2.  Initial  Regulatory  Flexibility  Act  Analysis.............................................................................................  151 
 3.  Initial  Paperwork  Reduction  Act  Analysis  .............................................................................................  152  4.  Comment  Filing  Procedures  ...................................................................................................................  153 

 VI.  ORDERING  CLAUSES............................................................................................................................  155 
 Appendix  A  --  List  of  Commenters 

 Appendix  B  --  Final  Rules 
 Appendix  C  --  Final  Regulatory  Flexibility  Analysis  (Third  Report  and  Order) 
 Appendix  D  --  Initial  Regulatory  Flexibility  Analysis  (Third  Further  NPRM) 
2
 Federal  Communications  Commission  FCC  02-  214 
 3 
 I.  INTRODUCTION 
 1.  We  resolve  in  this  Order  several  issues  in  connection  with  carriers  use  of  customer  proprietary  network  information  (  CPNI)  pursuant  to  section  222  of  the 

 Telecommunications  Act  of  1996.  1  Through  section  222,  Congress  recognized  both  that  telecommunications  carriers  are  in  a  unique  position  to  collect  sensitive  personal  information   
 including  to  whom,  where  and  when  their  customers  call    and  that  customers  maintain  an  important  privacy  interest  in  protecting  this  information  from  disclosure  and  dissemination.  The 
 rules  we  adopt  today  focus  on  the  nature  of  the  customer  approval  needed  before  a  carrier  can  use,  disclose  or  permit  access  to  CPNI.  In  formulating  the  required  approval  mechanism 
 described  below,  we  carefully  balance  carriers  First  Amendment  rights  and  consumers  privacy  interests  so  as  to  permit  carriers  flexibility  in  their  communications  with  their  customers  while 
 providing  the  level  of  protection  to  consumers  privacy  interests  that  Congress  envisioned  under  section  222. 

 2.  More  specifically,  we  adopt  an  approach  that  comports  with  the  decision  2  of  the  United  States  Court  of  Appeals  for  the  Tenth  Circuit  (  Tenth  Circuit)  vacating  the 
 Commissions  requirement  that  carriers  obtain  express  customer  consent  for  all  sharing  between  a  carrier  and  its  affiliates,  as  well  as  unaffiliated  entities.  3  We  adopt  today  an  approach  that  is 
 derived  from  a  careful  balancing  of  harms,  benefits,  and  governmental  interests.  First,  use  of  CPNI  by  carriers  or  disclosure  to  their  affiliated  entities  providing  communications-  related 
 services  4  ,  as  well  as  third-  party  agents  and  joint  venture  partners  providing  communications-related  services,  requires  a  customers  knowing  consent  in  the  form  of  notice  and  opt-  out 
 approval.  5  Second,  disclosure  of  CPNI  to  unrelated  third  parties  or  to  carrier  affiliates  that  do  not  provide  communications-  related  services  requires  express  customer  consent,  described  as  opt-in 
 approval.  6  Finally,  this  Order  affirms  the  finding  that  the  Tenth  Circuit  vacated  only  those 

 1  Telecommunications  Act  of  1996,  Pub.  L.  No.  104-  104,  110  Stat.  56  (1996  Act)  (codified  at  47  U.  S.  C.    151 
 et  seq.).  Hereinafter,  all  citations  to  the  1996  Act  will  be  to  the  1996  Act  as  it  is  codified  in  the  United  States  Code.  The  1996  Act  amended  the  Communications  Act  of  1934.  We  will  refer  to  the  Communications  Act  of  1934,  as 

 amended,  as  the  Communications  Act  or  the  Act. 
 2  U.  S.  West,  Inc.  v.  FCC,  182  F.  3d  1224  (10  th  Cir.  1999),  cert.  denied,  530  U.  S.  1213  (June  5,  2000)  (No.  99-1427) 
 (U  S  WEST  v.  FCC). 
 3  Implementation  of  the  Telecommunications  Act  of  1996:  Telecommunications  Carriers  Use  of  Customer 
 Proprietary  Network  Information  and  Other  Customer  Information;  and  Implementation  of  the  Non-  Accounting  Safeguards  of  Sections  271  and  272  of  the  Communications  Act  of  1934,  as  amended,  Second  Report  and  Order  and 

 Further  Notice  of  Proposed  Rulemaking,  13  FCC  Rcd  8061  (1998)  (CPNI  Order). 
 4  In  this  Order  and  Further  NPRM,  we  use  the  term  "communications-  related  services"  to  mean 
 telecommunications  services,  information  services  typically  provided  by  telecommunications  carriers,  and  services  related  to  the  provision  or  maintenance  of  customer  premises  equipment.  We  use  this  term  only  for  convenience  in 

 this  Order  and  Further  NRPM  and  not  for  any  other  purposes. 
 5  See  section  III.  A.  1,  infra. 

 6  See  section  III.  A.  2,  infra. 
3
 Federal  Communications  Commission  FCC  02-  214 
 4 
 CPNI  rules  related  to  opt-  in  and  left  intact  the  remainder  of  the  Commissions  rules,  7  including  the  total  service  approach,  which  permits  the  carrier  to  use  CPNI  to  market  new  product 
 offerings  within  the  carrier-  customer  service  relationship,  on  the  basis  of  the  customers  implied  consent.  8 

 3.  In  this  Order,  we  also  further  refine  the  rules  governing  the  process  by  which  carriers  provide  notification  to  customers  of  their  CPNI  rights.  Specifically,  we  clarify  the  form, 
 content  and  frequency  of  carrier  notices.  9  In  addition,  although  we  decline  to  reconsider  our  conclusion  that  customers  preferred  carrier  (PC)  freeze  information  constitutes  CPNI  and 
 thereby  continue  to  accord  it  privacy  protection  pursuant  to  section  222,  we  choose  to  forbear  from  imposing  the  express  consent  requirements  announced  in  this  Order  with  respect  to  PC-freezes. 
 Through  our  limited  exercise  of  forbearance,  we  balance  customers  privacy  concerns  with  carriers  meaningful  commercial  interests,  resulting  in  PC-  freeze  information  being  made 
 more  readily  available  among  competing  carriers,  consistent  with  the  public  interest.  10  We  also  affirm  our  previous  determination  that  the  word  information  in  section  272  does  not  include 
 CPNI,  which  is  governed  instead  by  section  222  of  the  Act.  11 
 4.  Finally,  we  accompany  this  Order  with  a  Further  Notice  of  Proposed  Rulemaking  (  Further  NPRM)  to  refresh  the  record  on  two  issues  raised  in  the  CPNI  Order  Further  NPRM: 

 foreign  storage  of  and  access  to  domestic  CPNI,  and  CPNI  safeguards  and  enforcement  mechanisms.  We  additionally  request  comment  on  what,  if  any,  appropriate  regulations  should 
 govern  the  CPNI  held  by  carriers  that  go  out  of  business,  sell  all  or  part  of  their  customer  base,  or  seek  bankruptcy  protection.  12 

 II.  BACKGROUND 
 A.  Section  222  of  the  Act 
 5.  This  proceeding  was  initiated  in  1996  to  implement  section  222  of  the  Act,  which  governs  carriers  use  and  disclosure  of  CPNI.  13  Section  222,  entitled  Privacy  of  Customer 

 Information,  obligates  carriers  to  protect  the  confidentiality  of  certain  information.  Section 

 7  See  Implementation  of  the  Telecommunications  Act  of  1996:  Telecommunications  Carriers  Use  of  Customer 
 Proprietary  Network  Information  and  Other  Customer  Information;  and  Implementation  of  the  Non-  Accounting  Safeguards  of  Sections  271  and  272  of  the  Communications  Act  of  1934,  as  amended,  Clarification  Order  and 

 Second  Further  Notice  of  Proposed  Rulemaking,  16  FCC  Rcd  16506,  16510  (2001)  (CPNI  Clarification  Order). 
 8  See  section  III.  B.  2,  infra. 

 9  See  section  III.  C,  infra. 
 10  See  section  III.  D.  1,  infra. 
 11  See  section  III.  D.  4,  infra. 
 12  See  section  IV.  C,  infra. 
 13  47  U.  S.  C.    222. 
4
 Federal  Communications  Commission  FCC  02-  214 
 5 
 222(  a)  imposes  a  general  duty  on  telecommunications  carriers  to  protect  the  confidentiality  of  proprietary  information.  14  Carriers  owe  this  duty  to  other  carriers,  equipment  manufacturers,  and 
 customers.  15  Section  222(  b)  states  that  a  carrier  that  receives  or  obtains  proprietary  information  of  other  carriers  in  order  to  provide  a  telecommunications  service  can  only  use  that  information 
 for  that  purpose  and  cannot  use  that  information  for  its  own  marketing  efforts.  16  Finally,  section  222(  c)  protects  the  confidentiality  of  customer  information  and  specifically  delineates  the 
 exceptions  to  the  general  principle  of  confidentiality.  17 
 6.  In  section  222,  Congress  laid  out  a  framework  for  carriers  use  of  customer  information  based  on  the  sensitivity  of  the  information.  In  particular,  the  statute  allows  easier 

 dissemination  of  information  beyond  the  existing  customer-  carrier  relationship  where  information  is  not  sensitive,  or  where  the  customer  so  directs.  Thus,  section  222  establishes 
 three  categories  of  customer  information  to  which  different  privacy  protections  and  carrier  obligations  apply:  (1)  individually  identifiable  CPNI,  (2)  aggregate  customer  information,  and 
 (3)  subscriber  list  information.  The  Wireless  Communications  and  Public  Safety  Act  of  1999  (911  Act)  amended  section  222  with  respect  to  privacy  of  wireless  location  information.  18 

 7.  CPNI  is  defined  as  (  A)  information  that  relates  to  the  quantity,  technical  configuration,  type,  destination,  location,  and  amount  of  use  of  a  telecommunications  service 
 subscribed  to  by  any  customer  of  a  telecommunications  carrier,  and  that  is  made  available  to  the  carrier  by  the  customer  solely  by  virtue  of  the  carrier-  customer  relationship;  and  (B)  information 
 contained  in  the  bills  pertaining  to  telephone  exchange  service  or  telephone  toll  service  received  by  a  customer  of  a  carrier.  19  Practically  speaking,  CPNI  includes  personal  information  such  as 
 the  phone  numbers  called  by  a  consumer,  the  length  of  phone  calls,  and  services  purchased  by  the  consumer,  such  as  call  waiting.  Congress  accorded  CPNI    which  includes  personal, 
 individually  identifiable  information    the  greatest  level  of  protection.  A  carrier  can  use  customers  CPNI  only  in  limited  circumstances,  except  as  required  by  law  or  with  the  customers 
 approval.  As  specified  in  section  222(  c)(  1),  a  carrier  can  only  use,  disclose  or  permit  access  to  CPNI  in  its  provision  of  (A)  the  telecommunications  service  from  which  such  information  is 

 14  47  U.  S.  C.    222(  a). 
 15  Id. 
 16  47  U.  S.  C.    222(  b). 
 17  47  U.  S.  C.    222(  c). 
 18  Wireless  Communications  and  Public  Safety  Act  of  1999,  Pub.  L.  No.  106-  81,  enacted  Oct.  26,  1999,  113  Stat. 
 1286  (911  Act). 
 19  47  U.  S.  C.    222(  f)(  1)  and  47  U.  S.  C.    222(  h)(  1)(  A)  (The  911  Act  amended  the  definition  of  CPNI  at  section 
 222(  h)  to  include  location  among  a  customers  information  that  carriers  are  required  to  protect  under  the  privacy  provisions  of  section  222). 
5
 Federal  Communications  Commission  FCC  02-  214 
 6 
 derived,  or  (B)  services  necessary  to,  or  used  in,  the  provision  of  such  telecommunications  service,  including  the  publishing  of  directories.  20 
 8.  The  narrow  exceptions  to  this  general  rule  allow  carriers  to  use  individually  identifiable  CPNI  without  customer  approval  for  four  additional  reasons.  21  CPNI  may  be  used  by 
 a  telecommunications  carrier,  either  directly  or  through  its  agents,  to  (1)  initiate,  render,  bill  and  collect  for  telecommunications  services;  (2)  protect  the  rights  or  property  of  the  carrier,  or  to 
 protect  users  and  other  carriers  from  fraudulent  or  illegal  use  of,  or  subscription  to,  such  services;  or  (3)  provide  inbound  marketing,  referral  or  administrative  services  to  the  customer  for  the 
 duration  of  the  call,  if  the  call  was  initiated  by  the  customer  and  the  customer  approves  of  the  carriers  use  to  provide  such  service;  or  (4)  provide  call  location  information  concerning  the  user 
 of  a  commercial  mobile  service  in  certain  specified  emergency  situations.  22 
 9.  Aggregate  customer  information  and  subscriber  list  information,  in  contrast,  do  not  involve  personal,  individually  identifiable  information,  but  nevertheless  are  valuable  to 

 competitors.  23  Aggregate  customer  information  means  collective  data  that  relates  to  a  group  or  category  of  services  or  customers,  from  which  individual  customer  identities  and  characteristics 
 have  been  removed.  24  Subscriber  list  information  generally  includes  subscribers  names,  addresses  and  telephone  numbers.  25  Accordingly,  under  sections  222(  c)(  3)  and  222(  e),  aggregate 
 customer  information  and  subscriber  list  information  receive  less  protection  from  use  and  disclosure  in  order  to  promote  competition.  In  particular,  aggregate  customer  information   
 which  by  definition  has  been  stripped  of  individually  identifiable  information    may  be  used  beyond  the  purposes  identified  in  section  222(  c)(  1)  for  CPNI,  but  local  exchange  carriers  (LECs) 
 must  make  aggregate  customer  information  available  to  competitors  on  reasonable  and  nondiscriminatory  terms  and  conditions.  26  Subscriber  list  information    which  is  generally 

 20  47  U.  S.  C.    222(  c)(  1).  We  note  that,  subsequent  to  the  adoption  of  section  222(  c)(  1),  Congress  added  section 
 222(  f).  Section  222(  f)  states  that  for  purposes  of  section  222(  c)(  1),  without  the  express  prior  authorization  of  the  customer,  a  customer  shall  not  be  considered  to  have  approved  the  use  or  disclosure  of  or  access  to  (1)  call  location 

 information  concerning  the  user  of  a  commercial  mobile  service  or  (2)  automatic  crash  notification  information  of  any  person  other  than  for  use  in  the  operation  of  an  automatic  crash  notification  system.  Thus,  section  222  adopts  a 
 different  standard  for  use  of  wireless  location  information  than  for  use  of  other  kinds  of  CPNI.  The  standard  for  use  of  wireless  location  information  will  be  addressed  in  a  separately  docketed  proceeding.  Wireless 
 Telecommunications  Bureau  Seeks  Comment  on  Request  to  Commence  Rulemaking  to  Establish  Fair  Location  Information  Practices,  WT  Docket  No.  01-  72,  Public  Notice,  DA  01-  696  (rel.  March  16,  2001)  . 

 21  47  U.  S.  C.    222(  d). 
 22  47  U.  S.  C.    222(  d). 
 23  CPNI  Order,  13  FCC  Rcd  8061,  8064,  para.  2. 
 24  47  U.  S.  C.    222(  f)(  2). 
 25  47  U.  S.  C.    222(  f)(  3).  The  term  subscriber  list  information  means  any  information    (A)  identifying  the 
 listed  names  of  subscribers  of  a  carrier  and  such  subscribers  telephone  numbers,  addresses  or  primary  advertising  classifications  (as  such  classifications  are  assigned  at  the  time  of  the  establishment  of  such  service),  or  any 

 combination  of  such  listed  names,  numbers,  addresses,  or  classifications;  and  (B)  that  the  carrier  or  an  affiliate  has  published,  caused  to  be  published,  or  accepted  for  publication  in  any  directory  format.  Id. 
6
 Federal  Communications  Commission  FCC  02-  214 
 7 
 publicly  available    must  be  provided  to  third  parties  for  the  purpose  of  publishing  directories  on  a  timely  and  unbundled  basis,  under  nondiscriminatory  and  reasonable  rates,  terms,  and 
 conditions.  27  In  addition,  subscriber  listed  and  unlisted  information  must  be  disclosed  to  providers  of  emergency  service  and  emergency  support  services  under  the  circumstances  set 
 forth  in  section  222(  g).  28 
 B.  CPNI  Order 
 10.  On  May  17,  1996,  the  Commission  initiated  a  rulemaking  in  response  to  requests  for  guidance  from  the  telecommunications  industry  regarding  the  obligations  of 

 telecommunications  carriers  under  section  222  of  the  Act  and  related  issues.  29  The  Commission  released  the  CPNI  Order  on  February  26,  1998,  in  which  it  addressed  the  scope  and  meaning  of 
 section  222  and  promulgated  implementing  regulations.  30 
 11.  In  the  CPNI  Order,  the  Commission  found  that  in  order  to  ensure  the  informed  consent  of  consumers  for  use  of  their  CPNI  in  a  manner  other  than  specifically  allowed  under 

 section  222(  c)(  1),  carriers  would  be  required  to  obtain  express  written,  oral  or  electronic  consent  from  their  customers,  i.  e.,  an  opt  in  requirement,  before  a  carrier  could  use  CPNI  to  market 
 services  outside  the  customers  existing  service  relationship  with  that  carrier.  31  The  Commission  reasoned  that  approval  by  implied  consent  (or  opt-  out)  would  not  fulfill  the  statutory  purpose 
 of  affording  consumers  with  meaningful  privacy  protection.  The  Commission  also  concluded  that  a  carrier  must  notify  the  customer  of  the  customers  rights  under  section  222  before 
 soliciting  approval  to  use  the  customers  CPNI. 
 12.  At  the  same  time,  the  Commission  adopted  what  is  called  the  total  service  approach  allowing  carriers  and  their  affiliates  to  use  customers  CPNI,  without  notice  or 

 approval,  to  market  services  within  the  package  of  services  to  which  the  customer  already  subscribes.  32  The  total  service  approach  recognized  existing  customer  relationships  for  local, 
 interexchange,  and  wireless  services.  Under  the  total  service  approach,  a  carrier  that  provides  local  service  to  a  customer  may  use  that  customers  local  service  CPNI  to  sell  that  customer 
 other  product  offerings  within  the  existing  local  service  relationship  (e.  g.,  caller  ID)  without  customer  approval  of  the  use  of  the  CPNI.  As  service  relationships  expanded  (e.  g.,  the  customer 

 (Continued  from  previous  page)  26  47  U.  S.  C.    222(  c)(  3). 
 27  47  U.  S.  C.    222(  e). 
 28  47  U.  S.  C.    222(  g). 
 29  In  the  Matter  of  Implementation  of  the  Telecommunications  Act  of  1996:  Telecommunications  Carriers  Use  of 
 Customer  Proprietary  Network  Information  and  Other  Customer  Information,  Notice  of  Proposed  Rulemaking,  11  FCC  Rcd  12513  (1996)  (1996  NPRM). 

 30  CPNI  Order,  13  FCC  Rcd  8061. 
 31  CPNI  Order,  13  FCC  Rcd  at  8128-  8150,  paras.  87-  114. 
 32  CPNI  Order,  13  FCC  Rcd  at  8080-  81,  paras.  24-  25. 
7
 Federal  Communications  Commission  FCC  02-  214 
 8 
 selected  both  local  and  wireless  service),  so  too  did  the  parameters  of  the  permissible  use  of  CPNI  to  market  new  product  offerings.  This  approach  recognizes  that  the  customer  may  be 
 fairly  considered  to  have  given  implied  consent  to  the  carriers  use  of  CPNI  within  the  total  service  package  to  which  the  customer  subscribes. 

 13.  Such  sharing  was  intended  to  allow  carriers  with  a  pre-  existing  relationship  with  the  customer  to  develop  packages  of  services  best  tailored  to  their  customers  needs.  The 
 Commission  noted  that  customers  would  reasonably  expect  carriers  with  whom  they  dealt  to  review  their  CPNI  to  fashion  service  packages  tailored  to  their  needs,  and  thus  would  not  object 
 to  inter-  affiliate  sharing  if  each  affiliate  already  has  a  relationship  with  the  customer.  Because  the  order  required  express  consent  for  any  type  of  disclosures  beyond  those  permitted  by  section 
 222(  c)(  1),  the  order  did  not  distinguish  between  disclosure  to  an  affiliate  or  other  carrier  for  telecommunications  marketing  purposes  or  disclosure  to  an  unrelated  third  party  for  non-telecommunications 
 purposes  (e.  g.,  divorce  actions,  insurance  reviews,  or  random  product  marketing). 

 14.  The  CPNI  Order  also  included  a  Further  Notice  of  Proposed  Rulemaking  (CPNI  Order  Further  NPRM)  that  sought  comment  regarding:  (1)  customers  rights  to  restrict  carrier 
 use  of  CPNI  for  marketing  purposes;  (2)  protections  for  carrier  information  and  related  enforcement  mechanisms;  and  (3)  foreign  storage  of  and  access  to  domestic  CPNI.  33 

 C.  CPNI  Reconsideration  Order 
 15.  On  August  16,  1999,  the  Commission  adopted  the  CPNI  Reconsideration  Order  in  response  to  a  number  of  petitions  for  reconsideration,  forbearance,  and  clarification  of  the 

 CPNI  Order.  34  The  CPNI  Reconsideration  Order  was  adopted  to  preserve  the  consumer  protections  mandated  by  Congress  while  more  narrowly  tailoring  [the  CPNI]  rules,  where 
 necessary,  to  enable  telecommunications  carriers  to  comply  with  the  law  in  a  more  flexible  and  less  costly  manner.  35 

 16.  In  the  CPNI  Reconsideration  Order,  the  Commission  denied  petitions  for  reconsideration  that  sought  to  amend  the  CPNI  rules  to  differentiate  among  types  of 
 telecommunications  carriers.  36  The  Commission  declined  to  modify  or  forbear  from  the  total  service  approach  and  clarified  a  number  of  aspects  of  the  total  service  approach  in  response  to 

 33  CPNI  Order,  13  FCC  Rcd  8200-  8204,  paras.  203-  210.  The  first  issue  is  dealt  with  in  this  Order  while  the 
 second  and  third  issues  are  addressed  in  the  Further  NPRM  contained  herein. 
 34  Implementation  of  the  Telecommunications  Act  of  1996;  Telecommunications  Carriers  Use  of  Customer 
 Proprietary  Network  Information;  and  Implementation  of  the  Non-  Accounting  Safeguards  of  Sections  271  and  272  of  the  Communications  Act  of  1934,  as  amended,  Order  on  Reconsideration  and  Petitions  for  Forbearance,  14  FCC 

 Rcd  14409  (1999)  (CPNI  Reconsideration  Order). 
 35  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14412,  para.  2. 

 36  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14418-  14420,  paras.  11-  15.  For  example,  some  petitioners 
 sought  stricter  requirements  for  incumbent  local  exchange  carriers  as  opposed  to  competitive  local  exchange  carriers  or  less  stringent  requirements  for  small  and  rural  carriers.  Id. 
8
 Federal  Communications  Commission  FCC  02-  214 
 9 
 petitioners  requests.  37  The  Commission  determined  that  PC-  freeze  information  38  falls  squarely  within  the  definition  of  CPNI  set  out  in  both  sections  222(  f)(  1)(  A)  and  (B),  39  and  thus  denied 
 MCIs  request  to  classify  this  information  otherwise.  40 
 17.  The  Commission  granted,  in  part,  petitions  for  reconsideration  requesting  that  all  carriers  be  allowed  to  use  CPNI  to  market  customer  premises  equipment  (  CPE)  and 

 information  services  under  section  222(  c)(  1)  without  customer  approval.  In  particular,  the  Commission  allowed  all  carriers  to  use  CPNI,  without  customer  approval,  to  market  CPE.  41  The 
 Commission  also  allowed  CMRS  carriers  to  use,  without  customer  approval,  CPNI  to  market  all  information  services,  while  allowing  wireline  carriers  to  do  so  for  most  information  services.  42 
 Further,  the  Commission  eliminated  the  restrictions  on  a  carriers  ability  to  use  CPNI  to  regain  customers  who  have  switched  to  another  carrier.  43  However,  the  CPNI  Reconsideration  Order 
 concluded  that  a  carriers  use  of  information  regarding  a  customers  decision  to  switch  carriers  derived  from  its  wholesale  operations  to  retain  the  customer  would  violate  the  prohibitions  in 
 section  222(  b).  44 
 18.  The  Commission  also  addressed  various  aspects  of  the  customer  approval  required  to  use  CPNI  in  accordance  with  section  222.  The  Commission  rejected  requests  to 

 adopt  preemptive  national  rules  and  affirmed  its  previous  decision  to  exercise  its  preemption  authority  on  a  case-  by-  case  basis  for  conflicting  state  rules,  concluding  that  in  connection  with 
 CPNI  regulation,  the  Commission  may  preempt  state  regulation  of  intrastate  telecommunications  matters  where  such  regulation  would  negate  the  Commissions  exercise  of 
 its  lawful  authority  because  regulation  of  the  interstate  aspects  of  the  matter  cannot  be  severed 

 37  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14420-  14429,  paras.  16-  38. 
 38  Under  section  64.1190(  a)  of  our  rules,  [  a]  preferred  carrier  freeze  (or  freeze)  prevents  a  change  in  a 
 subscribers  preferred  carrier  selection  unless  the  subscriber  gives  the  carrier  from  whom  the  freeze  was  requested  his  or  her  express  consent.  47  C.  F.  R.    64.  1190(  a). 

 39  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14488,  para.  148.  See  also  BellSouth  Opposition  and  Comments 
 at  5. 
 40  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14488,  para  148. 

 41  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14430-  14439,  paras.  39-  56. 
 42  Id.  The  Commission  found  that  CMRS  providers  historically  have  bundled  CPE  and  information  services  with 
 the  underlying  telecommunications  service,  and  therefore,  due  primarily  to  customer  expectations,  those  services  fell  within  the  meaning  of  necessary  to,  or  used  in  the  provision  of  service.  Id.  While  wireline  carriers  traditionally 

 have  bundled  CPE  with  wireline  services,  wireline  carriers  had  not  bundled  Internet  access  services  with  wireline  services.  As  a  result,  the  Commission  found  that  Internet  access  services  are  not  necessary  to,  or  used  in  the 
 provision  of  service.  Id.  at  14434,  para.  46. 
 43  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14442-  14448,  paras.  64-  74.  This  activity  is  commonly  referred  to 
 as  winback  marketing. 
 44  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14448-  14450,  paras.  75-  79.  This  activity  is  commonly  referred  to 
 as  retention  marketing. 
9
 Federal  Communications  Commission  FCC  02-  214 
 10 
 from  the  intrastate  aspects.  45  Further,  in  order  to  lessen  the  burden  on  carriers,  the  Commission  modified  various  CPNI  safeguards,  while  allowing  carriers  more  flexibility  in  determining  how 
 best  to  safeguard  customers  privacy.  46 
 19.  The  Commission  also  affirmed  the  conclusion  reached  in  the  CPNI  Order  regarding  the  interpretation  of  the  interplay  between  sections  222  and  272  that  information,  as 

 defined  in  section  272,  does  not  include  CPNI.  47  As  a  result,  Bell  operating  companies  (  BOCs)  are  not  obligated  by  section  272  to  make  CPNI  available  to  other  carriers  on  a  non-discriminatory 
 basis  when  they  share  it  with  their  long  distance  affiliates.  Finally,  the  Commission  determined  that  section  254  does  not  confer  any  special  status  on  carriers  seeking 
 to  use  CPNI  to  market  enhanced  services  and  CPE  in  rural  exchanges  to  select  customers.  48 
 D.  Tenth  Circuit  Opinion 
 20.  On  August  18,  1999,  the  Tenth  Circuit  issued  an  opinion  vacating  a  portion  of  the  CPNI  Order  in  U  S  WEST.  49  U  S  WEST  (now  Qwest)  contended  that  the  opt-  in  approach 

 adopted  by  the  Commission  violated  the  First  and  Fifth  Amendments  of  the  Constitution.  50  The  Tenth  Circuit  struck  down  the  Commissions  original  customer  approval  rules,  finding  that  the 
 CPNI  rules  impermissibly  regulated  protected  commercial  speech  and  thus  violated  the  First  Amendment.  51  Specifically,  the  court  found  that  the  opt-  in  regime  was  not  narrowly  tailored 
 because  the  Commission  had  failed  to  adequately  consider  an  opt-  out  option.  52 

 45  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14465-  66,  para  112-  13,  quoting  CPNI  Order,  13  FCC  Rcd  at 
 8075-  78,  paras.  16-  18. 
 46  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14468-  14479,  paras.  117-  134.  In  the  CPNI  Order,  the 
 Commission  had  required  carriers  to  develop  and  implement  software  systems  that  flag  customer  service  records  in  connection  with  CPNI  (  flagging)  and  to  maintain  an  electronic  audit  mechanism  (  audit  trail)  that  tracks 

 access  to  customer  accounts.  CPNI  Order,  13  FCC  Rcd  at  8198-  8200,  paras.  198-  199.  In  the  CPNI  Reconsideration  Order,  the  Commission  allowed  carriers  more  flexibility  by  requiring  carriers  only  to  implement  a 
 system  by  which  the  status  of  a  customers  CPNI  approval  can  be  clearly  established  prior  to  access  to  CPNI.  Carriers  no  longer  had  to  implement  an  electronic  system.  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14474, 
 para.  126.  The  Commission  also  eliminated  the  audit  trail  requirement  and  instead  required  carriers  to  maintain  a  record  of  their  sales  and  marketing  campaigns  that  use  CPNI.  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14474- 
 75,  para.  127. 
 47  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14481-  88,  paras.  137-  145. 

 48  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14490,  para.  151. 
 49  U  S  WEST  v.  FCC,  182  F.  3d  1224. 
 50  U  S  WEST  v.  FCC,  182  F.  3d  at  1231. 
 51  Id.  at  1239. 
 52  Id. 
10
 Federal  Communications  Commission  FCC  02-  214 
 11 
 E.  AT&  T  and  WorldCom  Petitions 
 21.  On  October  8,  1999,  AT&  T  filed  a  petition  for  review  of  the  CPNI  Order  with  the  U.  S.  Circuit  Court  of  Appeals  for  the  District  of  Columbia,  challenging  the  Commissions  CPNI 

 decisions  as  they  relate  to  the  interplay  between  sections  222  and  272  of  the  Communications  Act.  53  On  July  25,  2000,  the  D.  C.  Circuit  granted  the  Commissions  motion  for  voluntary 
 remand  of  the  AT&  T  appeal.  54 
 22.  On  November  1,  1999,  MCI  WorldCom  filed  a  petition  for  further  reconsideration  arguing  that  the  Commission  should  reexamine  some  of  its  notice  requirements  as  applicable  to 

 competitive  carriers  access  to  CPNI  during  the  sales  and  provisioning  processes.  55  MCI  WorldCom  also  argued  that  the  Commission  should  reexamine  its  determination  that  preferred 
 carrier  freeze  56  information  is  CPNI,  as  well  as  its  refusal  to  issue  a  definitive  rule  governing  winbacks.  57 

 F.  Clarification  Order  and  Further  Notice  of  Proposed  Rulemaking 
 23.  On  August  28,  2001,  the  Commission  adopted  an  order  (CPNI  Clarification  Order)  clarifying  the  status  of  its  CPNI  rules  in  light  of  the  Tenth  Circuit  order  and  issuing  a 

 Further  Notice  of  Proposed  Rulemaking  (Clarification  Order  Further  NPRM).  58  The  Commission  affirmed  its  previous  determination  that  the  Tenth  Circuit  invalidated  only  the  opt-in 
 rule,  not  the  entire  CPNI  Order.  59  The  Commission  sought  comment  on  its  interpretation  of  the  scope  of  the  Tenth  Circuit  order,  and  on  what  type  of  approval  (opt-  in  or  opt-  out)  would  best 
 serve  the  governments  goals  while  respecting  constitutional  limits.  60  In  addition,  the 
 53  AT&  T  Petition  for  Review,  AT&  T  v.  FCC,  No.  99-  1413  (D.  C.  Cir.,  July  25,  2000)  (petition  for  review  filed 
 Oct.  8,  1999).  54 
 AT&  T  v.  FCC,  No.  94-  1413  (D.  C.  Cir.,  July  25,  2000)  (AT&  T  v.  FCC).  55 
 MCI  WorldCom  Petition  for  Further  Reconsideration  (filed  Nov.  1,  1999)  (MCI  WorldCom  Petition). 
 56  Preferred  carrier  freezes  and  primary  interexchange  carrier  freezes  are  sometimes  referred  to  as  PC-  freezes  and 
 PIC-  freezes,  respectively.  A  PC-  freeze  is  a  more  general  term,  applying  to  any  freeze  placed  on  a  customers  account  to  protect  her  preferred  carrier  selection  from  being  changed  without  her  explicit  permission.  PIC-  freeze 

 refers  specifically  to  a  freeze  on  a  customers  interexchange  carrier  selection.  A  PC-  freeze/  PIC-  freeze  prevents  a  change  in  a  subscribers  preferred  carrier  selection  unless  the  subscriber  gives  the  carrier  from  whom  the  freeze  was 
 requested  his  or  her  express  written  or  oral  consent.  Implementation  of  the  Subscriber  Carrier  Selection  Changes  Provisions  of  the  Telecommunications  Act  of  1996,  Second  Report  and  Order  and  Further  Notice  of  Proposed 
 Rulemaking,  14  FCC  Rcd  1508,  1575,  para.  112,  n.  348  (1998)  (Slamming  Order). 
 57  MCI  Petition  at  17.  Winback  activities  involve  carriers  attempts  to  regain  the  business  of  customers  who  have 
 switched  to  another  carrier. 
 58  Implementation  of  the  Telecommunications  Act  of  1996;  Telecommunications  Carriers  Use  of  Customer 
 Proprietary  Network  Information  and  Other  Customer  Information;  Implementation  of  the  Non-  Accounting  Safeguards  of  Sections  271  and  272  of  the  Communications  Act  of  1934,  as  Amended;  Clarification  Order  and 

 Second  Further  Notice  of  Proposed  Rulemaking,  16  FCC  Rcd  16506  (2001)  (CPNI  Clarification  Order). 
 59  CPNI  Clarification  Order,  16  FCC  Rcd  at  16510,  para.  7. 

 60  CPNI  Clarification  Order,  16  FCC  Rcd  at  16512-  16517,  paras.  14-  22. 
11
 Federal  Communications  Commission  FCC  02-  214 
 12 
 Commission  noted  that  the  consent  mechanism  that  we  eventually  adopt  in  response  to  the  Tenth  Circuits  Order  could  impact  our  previous  findings  regarding  the  interplay  between 
 [sections  222  and  272],  and  we  therefore  find  it  necessary  to  raise  the  relevant  issues  here.  61 
 24.  In  the  CPNI  Clarification  Order,  the  Commission  sought  to  obtain  a  more  complete  record  on  ways  in  which  consumers  can  consent  to  a  carriers  use  of  their  CPNI.  62 

 Taking  into  account  the  Tenth  Circuits  opinion,  the  Commission  sought  comment  on  what  methods  of  approval  would  serve  the  governmental  interests  at  issue  and  afford  informed 
 consent,  while  also  satisfying  the  First  Amendments  requirement  that  any  restrictions  on  speech  be  narrowly  tailored.  63  Specifically,  the  Commission  sought  comment  on  the  interests  and 
 policies  underlying  section  222  that  are  relevant  to  formulating  an  approval  requirement,  including  an  analysis  of  the  privacy  interests  that  are  at  issue,  and  on  the  extent  to  which  we 
 should  take  competitive  concerns  into  account.  64  To  the  extent  that  promoting  competition  is  also  a  legitimate  government  interest  under  section  222,  the  Commission  sought  comment  on  the 
 likely  difference  in  competitive  harms  under  opt-  in  and  opt-  out  approvals. 
 25.  In  the  CPNI  Clarification  Order,  the  Commission  also  sought  comment  on  whether  adoption  of  an  opt-  out  mechanism  is  consistent  with  the  rationale  for  the  total  service 

 approach  set  forth  in  the  CPNI  Order.  65  Additionally,  in  the  CPNI  Reconsideration  Order,  the  Commission  determined  that  carriers  may  use  CPNI  derived  from  the  provision  of  a 
 telecommunications  service  to  market  CPE  necessary  to,  or  used  in,  the  provision  of  that  telecommunications  service  in  accordance  with  section  222(  c)(  1).  66  In  a  separate  proceeding,  the 
 Commission  modified  and  clarified  its  bundling  rules  promulgated  under  Computer  II  67  to  allow  carriers  to  bundle  CPE  and  enhanced  services  with  telecommunications  services.  68  The 
 Commission  sought  comment  on  whether  the  issues  raised  in  that  proceeding  should  affect  our  interpretation  of  section  222(  c)(  1)  and  the  total  service  approach.  69  The  Commission  received 

 61  CPNI  Clarification  Order,  16  FCC  Rcd  at  16518,  para.  24. 
 62  CPNI  Clarification  Order,  16  FCC  Rcd  at  16512,  para.  12. 
 63  Id. 
 64  Id. 
 65  CPNI  Clarification  Order,  16  FCC  Rcd  at  16516,  para.  21. 
 66  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14430,  para.  39. 
 67  Amendment  of  Section  64.  702  of  the  Commissions  Rules  and  Regulations,  CC  Docket  No.  20828,  Final 
 Decision,  77  FCC  2d  384  (1980). 
 68  Policy  and  Rules  Concerning  the  Interstate,  Interexchange  Marketplace,  Implementation  of  Section  254(  g)  of 
 the  Communications  Act  of  1934,  as  amended,  CC  Docket  No.  96-  16,  1998  Biennial  Regulatory  Review    Review  of  Customer  Premises  Equipment  and  Enhanced  Services  Unbundling  Rules  in  the  Interexchange,  Exchange  Access 

 and  Local  Exchange  Market,  CC  Docket  No.  98-  183,  Report  and  Order,  16  FCC  Rcd  7418  (2001). 
 69  CPNI  Clarification  Order,  16  FCC  Rcd  at  16516,  para.  21. 
12
 Federal  Communications  Commission  FCC  02-  214 
 13 
 extensive  comments  and  replies  from  commenters  representing  a  broad  cross  section  of  the  industry  and  consumer  interest  groups  in  this  proceeding.  70 
 III.  THIRD  REPORT  AND  ORDER 
 A.  Approval  Standard 
 26.  The  primary  issue  to  be  decided  here  is  how  to  implement  section  222(  c)(  1),  which  governs  the  use  and  disclosure  of  CPNI  upon  the  approval  of  the  customer.  71  In  the 

 CPNI  Order,  the  Commission  concluded  that  approval  for  all  such  uses  and  disclosure,  whether  sharing  among  affiliated  entities  or  unaffiliated  third  parties,  required  express  consent 
 from  the  customer.  72  The  Tenth  Circuit  invalidated  the  Commissions  original  opt-  in  regime  based  on  its  concerns  that  the  Commissions  CPNI  rules  impermissibly  burdened  carriers  and 
 consumers  73  commercial  speech.  74  The  court  noted  that  nonmisleading  commercial  speech  regarding  a  lawful  activity  is  a  form  of  protected  speech  under  the  First  Amendment,  although  it 
 is  generally  afforded  less  protection  than  noncommercial  speech.  75  The  court  found  that  the  CPNI  rules  implicated  commercial  speech  concerns  under  the  First  Amendment  [  b]  ecause  [U  S 
 WESTs]  targeted  speech  to  its  customers  is  for  the  purpose  of  soliciting  those  customers  to  purchase  more  or  different  telecommunications  services.  .  .  .  76  Notably,  the  courts  opinion 
 presupposes  that  the  speech  at  issue  involves  sharing  with  affiliates  for  telecommunications  marketing,  rather  than  unrestricted  disclosure  to  unrelated  third  parties.  77 

 27.  In  deciding  U  S  WEST  v.  FCC,  the  court  analyzed  the  CPNI  Order  using  the  constitutional  standards  applicable  to  governmental  regulations  of  commercial  speech  articulated 
 in  Central  Hudson  Gas  &  Elec.  Corp.  v.  Public  Service  Commission.  78  In  order  to  determine 
 70  A  list  of  parties  filing  comments  and  reply  comments  on  the  Clarification  Order  Further  NPRM  is  included  at 
 Appendix  A. 
 71  47  U.  S.  C.    222(  c)(  1). 

 72  CPNI  Order,  13  FCC  Rcd  at  8128-  50,  paras.  87-  114. 
 73  The  Tenth  Circuit  stated  that  the  First  Amendment  protects  both  the  right  to  engage  in  commercial  speech  and 
 necessarily  protects  the  right  to  receive  it.  U  S  WEST,  182  F.  3d  at  1232  (quoting  Martin  v.  City  of  Struthers,  319  U.  S.  141,  143  (1943),  which  involved  distribution  of  literature). 

 74  U  S  WEST,  182  F.  3d  at  1239. 
 75  U  S  WEST,  182  F.  3d  at  1233. 
 76  Id.  at  1232-  33  (finding  that  [U  S  WESTs]  targeted  speech  `does  no  more  than  propose  a  commercial 
 transaction  .  .  .  [c]  onsequently,  the  targeted  speech  in  this  case  fits  soundly  within  the  definition  of  commercial  speech.)  (quoting  Virginia  State  Bd.  Of  Pharmacy  v.  Virginia  Citizens  Consumer  Council,  Inc.,  425  U.  S.  748,  760 

 (1976)). 
 77  U  S  WEST,  182  F.  3d  at  1230,  1232-  33. 

 78  U  S  WEST  v.  FCC,  182  F.  3d  at  1233.  See  also  Central  Hudson  Gas  &  Elec.  Corp.  v.  Public  Service  Commn  of 
 N.  Y.,  447  U.  S.  557(  1980)  (Central  Hudson). 
13
 Federal  Communications  Commission  FCC  02-  214 
 14 
 whether  restrictions  on  commercial  speech  survive  intermediate  scrutiny,  Central  Hudson  sets  out  a  four-  part  test.  79  Central  Hudson  asks  first  whether  the  speech  in  question  concerns  illegal 
 activity  or  is  misleading,  in  which  case  the  government  may  freely  regulate  the  speech.  If  the  speech  is  not  misleading  and  does  not  involve  illegal  activity,  the  court  applies  the  rest  of  the 
 four-  part  test  to  the  governments  regulation.  80  The  second  prong  of  Central  Hudson  examines  whether  the  government  has  a  substantial  interest  in  regulating  the  speech.  Third,  the 
 government  must  show  that  the  restriction  on  commercial  speech  directly  and  materially  advances  that  interest.  Finally,  the  regulation  must  be  narrowly  drawn.  81 

 28.  The  court  assumed  that  the  Commission  had  demonstrated  a  substantial  state  interest  in  protecting  privacy  and  acknowledged  that  Congress  might  have  considered  promoting 
 competition  in  tandem  with  the  privacy  interest.  Notwithstanding  this  assumption,  the  court  later  found  that  [  t]  he  government  presents  no  [empirical]  evidence  showing  the  harm  to  either 
 privacy  or  competition  is  real.  82  Accordingly,  the  court  concluded  that  the  government  did  not  demonstrate  that  the  opt-  in  regulations  directly  and  materially  advanced  its  interests.  The  court 
 noted  that  the  Commission  also  must  show  the  dissemination  of  CPNI  would  inflict  specific  and  significant  harm  on  individuals,  such  as  misappropriation  of  sensitive  personal  information  for 
 the  purpose  of  assuming  anothers  identity.  83  The  court  concluded  that  the  opt-  in  requirement  was  not  narrowly  tailored  because  the  agency  had  not  demonstrated  a  sufficiently  good  fit 
 between  the  means  chosen  (opt-  in  or  express  approval)  and  the  desired  statutory  objectives  (protecting  privacy  and  competition).  In  addition,  the  court  recognized  that  while  the 
 government  is  obligated  to  consider  less  restrictive  means,  that  requirement  does  not  amount  to  a  least  restrictive  means  test.  84  However,  the  court  found  that  the  Commission  had  failed  to 
 adequately  consider  an  obvious  and  less  restrictive  alternative,  an  opt-  out  strategy.  85 
 29.  Importantly,  the  court  did  not  find  section  222  of  the  Act  unconstitutional.  86  As  noted,  U  S  WEST  did  not  even  challenge  the  constitutionality  of  section  222.  87  Therefore,  the 

 79  Central  Hudson,  447  U.  S.  at  564-  65. 
 80  As  the  court  noted  and  no  commenter  has  disputed,  the  commercial  speech  impacted  by  the  Commissions 
 CPNI  rules  is  neither  misleading  nor  does  it  involve  illegal  activity.  U  S  WEST,  182  F.  3d  at  1234. 
 81  Central  Hudson,  447  U.  S.  at  564-  65.  See  also  U  S  WEST,  182  F.  3d  at  1233. 

 82  U  S  WEST,  182  F.  3d  at  1237. 
 83  U  S  WEST,  182  F.  3d  at  1235. 
 84  Id.  at  1238,  n.  11. 
 85  U  S  WEST,  182  F.  3d  at  1238. 
 86  U  S  WEST,  182  F.  3d  at  1243  (Briscoe,  J.,  dissenting). 
 87  The  dissent  argued  that  U  S  WESTs  arguments  were  flawed  because  they  were  more  appropriately  aimed  at 
 the  restrictions  and  requirements  outlined  in  section  222  rather  than  the  approval  method  adopted  in  the  CPNI  Order.  She  observed  that  the  order,  not  the  statute,  was  the  subject  of  U  S  WESTs  petition  for  review.  U  S  WEST, 

 182  F.  3d  at  1243  (Briscoe,  J.,  dissenting). 
14
 Federal  Communications  Commission  FCC  02-  214 
 15 
 task  before  the  Commission  remains  the  same:  to  implement  regulations  that  satisfy  Congress  goal  of  protecting  consumer  privacy  by  requiring  carriers  to  obtain  customer  consent  for  certain 
 uses  of  CPNI.  As  required  by  the  Tenth  Circuit,  any  new  regulations  adopted  by  the  Commission  in  the  instant  proceeding  must  meet  the  standard  articulated  by  the  Supreme  Court 
 in  Central  Hudson. 
 30.  In  view  of  the  courts  guidance,  we  take  into  account  the  burden  on  carriers  commercial  speech  rights,  provide  an  empirical  justification  for  the  governments  interest  in 

 protecting  the  privacy  of  consumers  CPNI,  and  consider  whether  opt-  out  provides  sufficient  protection  of  consumer  privacy.  We  discuss  separately  the  appropriate  means  of  obtaining 
 customer  approval  for  intra-  company  use  of  CPNI  and  for  disclosure  of  CPNI  to  third  parties  because  our  application  of  Central  Hudson  in  light  of  the  record  in  this  proceeding  shows  that 
 the  balance  of  the  costs  and  benefits  associated  with  the  burden  on  speech  are  different  between  these  categories,  thus  requiring  different  outcomes.  Specifically,  we  find  that  opt-  out  is  a 
 narrowly  tailored  means  that  directly  and  materially  advances  Congress  interest  in  protecting  consumers  from  unapproved  use  of  CPNI  by  carriers  and  their  affiliates  that  provide 
 communications-  related  services.  88  However,  opt-  in  is  a  narrowly  tailored  means  that  directly  and  materially  advances  Congress  interest  in  protecting  consumers  from  unapproved  disclosure 
 of  CPNI  to  third  parties  that  have  no  business  relationship  with  the  customer  and  are  not  subject  to  enforcement  under  the  Communications  Act  or  the  Commissions  rules  such  as  those 
 governing  use  and  disclosure  of  CPNI. 
 1.  Intra-  Company  and  Joint  Venture  Use  of  CPNI  by  Telecommunications  Carriers 

 31.  Although  in  1999  the  Commission  concluded  that  the  more  stringent  opt-  in  rule  was  necessary,  in  light  of  U  S  WEST  we  now  conclude  that  an  opt-  in  rule  for  intra-  company  use 
 cannot  be  justified  based  on  the  record  we  have  before  us.  Thus,  we  adopt  a  less  restrictive  alternative    an  opt-  out  rule    which  is  less  burdensome  on  commercial  speech.  Applying  the 
 Central  Hudson  test  to  possible  schemes  for  carriers  to  obtain  customer  approval  for  use  and  disclosure  of  CPNI  under  section  222(  c)(  1),  we  conclude  that:  (1)  the  government  has  a 
 substantial  interest  in  ensuring  that  a  customer  be  given  an  opportunity  to  approve  (or  disapprove)  uses  of  her  CPNI  by  a  carrier  and  a  carriers  affiliates  that  provide  communications-related 
 services;  89  (2)  opt-  out  directly  and  materially  advances  this  interest  by  mandating  that  carriers  provide  prior  notice  to  customers  along  with  an  opportunity  to  decline  the  carriers 
 requested  use  or  disclosure;  and  (3)  opt-  out  is  no  more  extensive  than  necessary  to  serve  the  government  interest  in  protecting  privacy  because  it  is  less  burdensome  on  carriers  than  other 
 alternatives  such  as  opt-  in,  while  still  serving  the  governments  interest  in  ensuring  that 

 88  However,  we  allow  and  encourage  carriers  to  use  an  opt-  in  approval  method  if  they  prefer  in  order  to  provide 
 consumers  with  heightened  privacy  protections.  We  note,  for  example,  that  some  financial  institutions  market  the  fact  that  they  provide  privacy  protections  beyond  those  mandated  by  federal  law. 

 89  We  have  defined  communications-  related  services  supra  at  n.  4. 
15
 Federal  Communications  Commission  FCC  02-  214 
 16 
 consumers  have  an  opportunity  to  exercise  their  approval  rights  regarding  intra-  company  use  and  disclosure  of  CPNI.  90 
 32.  We  also  conclude  that  opt-  out  is  an  appropriate  approval  mechanism  for  the  sharing  of  CPNI  with,  and  use  by,  a  carriers  joint  venture  partners  and  independent  contractors 
 in  connection  with  communications-  related  services  that  are  provided  by  the  carrier  (or  its  affiliates)  individually,  or  together  with  the  joint  venture  partner.  91  That  is,  in  these  two  contexts, 
 this  form  of  consent  directly  and  materially  advances  the  governments  interest  in  ensuring  that  customers  have  an  opportunity  to  approve  such  uses  of  CPNI,  while  also  burdening  no  more 
 carrier  speech  than  necessary. 
 a.  Intra-  Company  Use 
 33.  Governments  Substantial  Interest.  The  customer  approval  requirement  in  section  222(  c)(  1)  is  designed  to  protect  the  interest  of  telecommunications  consumers  in  limiting 

 unexpected  and  unwanted  use  and  disclosure  of  their  personal  information  by  carriers  who  must  collect  such  information  in  order  to  render  bills  and  perform  other  services.  Section  222(  c)(  1) 
 thus  assumes  a  minimum  level  of  customer  concern  regarding  certain  uses  of  CPNI  by  a  carrier  and  its  affiliates.  This  assumption  has  been  borne  out  by  evidence  in  the  record,  including 
 surveys  indicating  consumers  desires  regarding  dissemination  of  CPNI  and  other  personal  information.  Notably,  in  one  study,  55.5  percent  of  Cincinnati  Bell  Telephone  (CBT)  customers 
 expressed  some  level  of  concern  with  use  of  CPNI  by  CBT  for  targeted  marketing,  including  17.2  percent  that  were  extremely  concerned.  92  Likewise,  the  Westin  Study  submitted  by 
 Pacific  Telesis  in  the  original  CPNI  proceeding  indicated  that  36  percent  of  customers  found  it  not  acceptable  for  their  local  telephone  company  to  use  CPNI  for  targeted  marketing.  93  These 
 concerns  show  a  sensitivity  to  use  of  CPNI,  consistent  with  the  very  private  nature  of  the  information  collected  by  a  telecommunications  carrier,  which  includes,  at  a  minimum,  the 
 telephone  numbers  a  subscriber  calls,  and  the  times,  dates,  destinations  and  duration  of  those  calls.  94  CPNI  also  includes  services  that  a  subscriber  purchases,  the  equipment  and  facilities 
 used,  and  it  may  also  include  personal/  household  usage  patterns,  among  other  things.  95  Based  on 
 90  However,  we  allow  carriers  to  use  an  opt-  in  approval  method  if  they  prefer  to  do  so.  See  section  III.  C.  1,  infra. 
 91  See  section  III.  A.  1.b  infra. 
 92  Cincinnati  Bell  Telephone  Comments  (filed  June  11,  1996),  App.  A  at  2  (Cincinnati  Bell  Study).  This  carrier-specific 
 evidence  is  consistent  with  the  results  of  more  recent  survey  data  put  on  the  record  by  Qwest  which  show  that  about  25  percent  of  all  consumers  are  privacy  fundamentalists  who  tend  to  oppose  any  sharing  or 

 dissemination  of  their  private  information.  Qwest  May  14,  2002  Ex  Parte  Letter,  App.  C  at  11  n.  6. 
 93  Letter  from  Gina  Harrison,  Pacific  Telesis  Group,  to  William  F.  Caton,  Acting  Secretary,  Federal 
 Communications  Commission,  CC  Docket  No.  96-  115  (filed  Dec.  12,  1996)  (Pacific  Telesis  Dec.  12,  1996  Ex  Parte  Letter),  Attach.  A  at  8  (Westin  Survey).  Sixty-  four  percent  said  that  such  uses  would  be  acceptable  to  them.  Id. 

 94  CPNI  Order,  13  FCC  Rcd  at  8064,  para.  2. 
 95  [  T]  his  data  can  be  processed  and  translated  into  subscriber  profiles  which  may  contain  information  about  the 
 identities  and  whereabouts  of  subscribers  friends  and  relatives,  which  businesses  subscribers  patronize,  when  subscribers  are  likely  to  be  home  and  awake,  product  and  service  preferences,  and  subscribers  medical,  business, 

 (continued.) 
16
 Federal  Communications  Commission  FCC  02-  214 
 17 
 the  record  before  us,  we  conclude  that  the  governments  interest  in  limiting  unexpected  disclosure  and  use  of  consumers  CPNI  is  a  substantial  one. 
 34.  Direct  and  Material  Advancement.  The  next  prong  of  Central  Hudson  examines  whether  a  regulation  impacting  commercial  speech  directly  and  materially  advances  the 
 governments  interest,  i.  e.,  the  restriction  is  effective  at  promoting  the  governments  interest.  96  We  conclude  that,  with  respect  to  intra-  company  uses,  opt-  out  directly  and  materially  advances 
 the  governments  interest  that  a  customer  be  given  an  opportunity  to  approve  (or  disapprove)  uses  of  her  CPNI  by  mandating  that  carriers  provide  prior  notice  to  customers  along  with  an 
 opportunity  to  decline  the  carriers  requested  use  or  disclosure. 
 35.  Although  the  record  evidence  demonstrates  that  a  substantial  portion  of  consumers  have  a  high  level  of  concern  about  protecting  the  privacy  of  their  CPNI  (a  concern 

 most  acute  for  disclosure  to  parties  other  than  their  own  carrier),  97  the  record  also  makes  evident  that  a  majority  of  customers  nevertheless  want  to  be  advised  of  the  services  that  their 
 telecommunications  providers  offer.  98  Furthermore,  the  record  establishes  that  customers  are  in  a  position  to  reap  significant  benefits  in  the  form  of  more  personalized  service  offerings  (and 
 possible  cost  savings)  from  their  carriers  and  carriers  affiliates  providing  communications-related  services  based  on  the  CPNI  that  the  carriers  collect.  Enabling  carriers  to  communicate 
 with  customers  in  this  way  is  conducive  to  the  free  flow  of  information,  99  which  can  result  in  more  efficient  and  better-  tailored  marketing  100  and  has  the  potential  to  reduce  junk  mail  and  other 
 forms  of  unwanted  advertising.  101  Thus,  consumers  may  profit  from  having  more  and  better  information  provided  to  them,  or  by  being  introduced  to  products  or  services  that  interest  them.  102 

 (Continued  from  previous  page)  client,  sales,  organizational,  and  political  telephone  contacts.  U.  S.  West,  Inc.  v.  FCC,  Julie  Tuan,  15  Berkeley  Tech. 
 L.  J.  353,  369  (2000). 
 96  U  S  WEST,  182  F.  3d  at  1237  (stating  that  the  government  must  demonstrate  that  the  harms  it  recites  are  real 
 and  that  its  restriction  will  in  fact  alleviate  them  to  a  material  degree)  (quoting  Edenfield  v.  Fane,  507  U.  S.  761,  771  (1993)). 

 97  See  infra  section  III.  A.  2. 
 98  Cincinnati  Bell  Study  at  2  (indicating  that  81.  5  percent  of  respondents  wanted  to  be  advised  of  the  services  that 
 Cincinnati  Bell  Telephone  offers). 
 99  CTSI  Reply  Comments  at  7  (  Customers,  as  well  as  the  market,  benefit  from  the  free  flow  of  information.). 
 See  also  BellSouth  Comments  at  7. 
 100  Letter  from  Michael  D.  Alarcon,  SBC,  to  William  Caton,  Acting  Secretary,  Federal  Communications 
 Commission,  CC  Docket  Nos.  96-  115  and  96-  149  (filed  Apr.  12,  2002)  (SBC  April  12,  2002  Ex  Parte  Letter)  (stating  that  interim  opt-  out  approval  has  resulted  in  [  c]  ustomized  offerings  of  SBCs  products  and  services  based 

 on  customers  CPNI.).  See  also  Progress  &  Freedom  Foundation  Comments  at  4. 
 101  AT&  T  Comments  at  5,  n.  3  (  Indeed,  limiting  the  use  of  CPNI  may  have  the  effect  of  increasing  the  number  of 
 solicitations  by  telecommunications  carriers.).  See  also  Verizon  Comments  at  6;  Progress  &  Freedom  Foundation  Reply  Comments  at  4. 

 102  Progress  &  Freedom  Foundation  Reply  Comments  at  4  (  In  other  words,  information  allows  communications  to 
 be  targeted  to  make  it  more  likely  that  consumers  are  made  aware  of  goods  and  services  they  want  to  reach  them,  while  reducing  consumer  exposure  to  unwanted  or  irrelevant  advertising.);  Qwest  Comments,  Attach.  A  at  3 

 (continued.) 
17
 Federal  Communications  Commission  FCC  02-  214 
 18 
 The  empirical  evidence  indicating  that  a  majority  of  customers  want  to  be  advised  of  service  offerings  from  their  carriers  is  consistent  with  the  expectation  that  targeted  carrier  marketing  will 
 benefit  them.  103 
 36.  Based  on  this  record  evidence,  we  think  it  is  reasonable  to  conclude  that  targeted  marketing  of  communications-  related  services  using  CPNI  by  the  carrier  that  collects  it  is  within 

 the  range  of  reasonable  customer  expectations.  We  find  that  telecommunications  consumers  expect  to  receive  targeted  notices  from  their  carriers  about  innovative  telecommunications 
 offerings  that  may  bundle  desired  telecommunications  services  and/  or  products,  save  the  consumer  money,  and  provide  other  consumer  benefits.  104  Similar  to  a  case  recently  before  the 
 D.  C.  Circuit,  the  record  here  indicates  that  the  identity  of  the  audience  and  the  use  to  which  the  information  may  be  put  105  bear  strongly  on  consumers  privacy  interests.  106  In  this  respect,  we 
 conclude  that  consumers  are  concerned  about  use  of  CPNI,  but  that  a  large  percentage  of  telecommunications  customers  also  expect  that  carriers  will  use  CPNI  to  market  their  own 
 telecommunications  services  and  products,  as  well  as  those  of  their  affiliates.  Thus,  we  conclude  that  an  opt-  out  scheme  giving  customers  an  opportunity  to  disapprove  intra-  company  uses  of 
 CPNI  directly  and  materially  advances  customers  interest  in  avoiding  unexpected  and  unwanted  use  and  disclosure  of  CPNI  and  is  sufficient  to  meet  the  approval  requirement  under  section 
 222. 
 37.  Although  many  commenters  have  argued  that  opt-  out  necessarily  is  a  less  effective  protection  against  unapproved  dissemination  of  private  information  than  opt-  in,  we  are 

 convinced,  based  on  the  record,  that  these  concerns  can  be  adequately  addressed  in  the  intra-company  context.  We  find  that  an  opt-  out  regime  would  adequately  protect  consumers  privacy 
 interests  with  respect  to  disclosure  to  carrier  affiliates  based  on  two  important  considerations  that  are  dependent  upon  the  underlying  carrier-  customer  relationship.  First,  likelihood  of  any 
 potential  privacy  harm  from  an  inadvertent  approval  under  opt-  out  is  significantly  reduced  in  the  intra-  company  context  by  the  carriers  need  for  a  continuing  relationship  with  the  customer.  107 
 (Continued  from  previous  page)  (  CPNI  allows  telecommunications  carriers  to  identify  customers,  on  the  basis  of  their  past  purchasing  habits,  who 
 are  most  likely  to  be  interested  in  particular  new  services,  or  to  offer  them  information  about  packages  of  services  through  communications  tailored  to  their  individual  needs.).  See  also  AT&  T  Comments  at  9-  10. 

 103  Westin  Survey  at  8. 
 104  AT&  T  Comments  at  9-  10;  BellSouth  Comments  at  4;  CenturyTel  Comments  at  5;  Cincinnati  Bell  Telephone 
 June  11,  1996  Comments  at  App.  A;  Nextel  Comments  at  5;  USTA  Comments  at  13;  AT&  T  Reply  Comments  at  2;  Verizon  Reply  Comments  at  8. 

 105  Trans  Union  Corp  v.  Federal  Trade  Commission,  245  F.  3d  809,  rehearing  denied,  267  F.  3d  1138,  1143  (D.  C. 
 Cir.  2001),  petition  for  cert.  pending. 
 106  CenturyTel  Comments  at  5  ([  C]  arriers  do  not  use  or  disseminate  sensitive  or  personal  information  that  would 
 inflict  specific  or  significant  harm  on  their  customers.);  Qwest  Comments  at  16  (  Arguments  may  be  made  to  the  Commission  that  might  support  a  finding  that,  in  some  circumstances,  some  carrier  disclosures  of  CPNI  to 

 unaffiliated  third  parties  might  be  privacy  invasive.). 
 107  USTA  Reply  Comments  at  1  (  In  competitive  telecommunications  markets,  the  failure  of  carriers  to  meet 
 customer  privacy  expectations  will  only  serve  to  alienate  those  customers  and  cause  them  to  obtain  service  from  carriers  that  meet  their  expectations.). 
18
 Federal  Communications  Commission  FCC  02-  214 
 19 
 As  AT&  T  argues,  [  i]  f  a  carrier  were  to  abuse  CPNI,  customers  would  likely  switch  carriers.  108  Because  of  commercial  constraints  required  to  ensure  customer  accountability,  therefore,  the 
 carrier  with  whom  the  customer  has  the  existing  business  relationship  has  a  strong  incentive  not  to  misuse  its  customers  CPNI  or  it  will  risk  losing  its  customers  business.  109 

 38.  Second,  we  find  the  potential  harm  to  privacy  to  be  much  less  significant  in  instances  where  the  entity  that  uses  and  shares  the  CPNI  is  subject  to  section  222  and  our 
 implementing  rules.  If  a  consumer  should  decide  to  restrict  disclosure  after  the  original  period  to  respond  to  an  opt-  out  notice  has  elapsed,  she  may  do  so  at  any  time  and  the  carrier  must  comply 
 with  that  request.  Significantly,  the  holder  of  CPNI,  the  customers  existing  telecommunications  provider  (including  its  telecommunications  affiliates),  is  subject  to  enforcement  action  by  the 
 Commission  110  for  any  failure  to  abide  by  the  notice  rules  regarding  planned  use,  disclosure,  or  permission  to  access  a  customers  CPNI.  111 

 39.  We  are  given  further  comfort  that  we  can  protect  privacy  interests  under  intra-company  opt-  out  by  fine-  tuning  our  notification  rules.  These  rules,  as  described  below,  are 
 crafted  to  ensure  that  any  opt-  out  mechanism  provides  effective  notification  to  consumers.  We  are  mindful  of  the  deficiencies  widely  reported  for  the  Gramm-  Leach-  Bliley  112  notifications  in 
 the  financial  services  sector,  113  and  have  fashioned  our  CPNI  notification  requirements  in  this  Order  with  an  eye  toward  learning  from  that  experience.  As  discussed  further  in  section  III.  C 
 infra,  we  bolster  the  CPNI  opt-  out  regime  by  requiring  a  30-  day  waiting  period  before  consent  is  inferred  and  by  refreshing  consumers  on  a  companys  opt-  out  policy  every  two  years.  Moreover, 
 we  note  that  under  the  opt-  out  rules  we  adopt  today,  the  customers  carrier  would  remain  subject  to  enforcement  action  from  the  Commission  for  any  deficiencies  in  its  opt-  out  notice. 

 108  AT&  T  Comments  at  7. 
 109  We  recognize  that  this  constraint  is  less  effective  where  competitive  choices  are  less  readily  available.  See 
 Arizona  Attorney  General  Jan.  25,  2002  Ex  Parte  Letter,  Ex.  B.  at  86).  However,  as  competition  continues  to  develop,  this  safeguard  will  only  increase  in  its  usefulness. 

 110  In  addition,  carriers  may  be  subject  to  enforcement  actions  by  state  utility  commissions. 
 111  By  contrast,  the  threat  of  enforcement  action  in  the  third-  party  sharing  context  does  not  serve  as  a  deterrent 
 against  the  misuse  of  customer  CPNI  because  non-  carriers  are  not  subject  to  section  222.  Thus,  such  third  parties  have  little  or  no  reason  to  use  customers  CPNI  in  any  way  but  that  which  generates  the  most  profits,  which  may 

 include  selling  or  providing  access  to  the  personal  information. 
 112  15  U.  S.  C.    6802.  The  Financial  Services  Modernization  Act  is  more  commonly  known  as  the  Gramm-  Leach-Bliley 
 Act  (Gramm-  Leach-  Bliley). 
 113  Russell  Gold,  Privacy  Notice  Offers  Little  Help,  WALL  STREET  JOURNAL,  May  30,  2002,  at  D1.  Implementation 
 of  Gramm-  Leach-  Bliley  has  been  particularly  problematic,  prompting  complaints  from  privacy  groups,  consumers,  and  state  and  federal  regulators.  Commenters  say  that  the  opt-  out  notices  to  consumers  have  not  been  clear  and 

 conspicuous  and  that  many  notices  have  been  unintelligible  and  couched  in  language  far  above  the  average  Americans  reading  level.  NAAG  Dec.  21,  2001  Ex  Parte  Letter  at  8;  see  Harris  Interactive  for  the  Privacy 
 Leadership  Initiative  survey,  available  at  http://  www.  ftc.  gov/  bcp/  workshops/  glb;  NAAG  Dec.  21,  2001  Ex  Parte  Letter  at  9.  Many  consumers  did  not  recall  receiving  the  notices  or  reading  them.  See  American  Bankers 
 Association  survey,  available  at  http://  www.  aba.  com/  Press+  Room/  bankfee060701.  htm. 
19
 Federal  Communications  Commission  FCC  02-  214 
 20 
 40.  Narrow  Tailoring.  We  now  consider  whether  opt  out  is  narrowly  tailored,  i.  e.,  whether  it  burdens  substantially  more  of  a  carriers  speech  than  necessary.  The  Tenth  Circuit 
 points  out  that  the  narrow  tailoring  requirement  under  Central  Hudson  means  that  the  governments  speech  restriction  must  signify  a  carefu[  l]  calculat[  ion  of]  the  costs  and  benefits 
 associated  with  the  burden  on  speech  imposed  by  its  prohibition.  114  We  have  described  the  primary  benefit  associated  with  opt-  out  above.  It  directly  and  materially  addresses  customers 
 interest  in  avoiding  unexpected  and  unwanted  use  and  disclosure  of  individually  identifiable  CPNI.  Turning  to  the  carriers  burdens,  i.  e.,  the  costs  of  the  regulation,  we  find  that,  in  this 
 case,  there  is  no  flat  prohibition  on  speech,  but  rather  a  requirement  that  a  telecommunications  carrier  use  a  specified  means  of  obtaining  a  customers  consent  before  using  that  customers 
 personal  information  in  CPNI  to  market  communications-  related  services  or  share  the  information  with  an  affiliate  that  provides  communications-  related  services.  We  also  find  that 
 carriers  have  provided  evidence  that  their  commercial  speech  interest  in  using  a  customers  CPNI  for  tailored  telecommunications  marketing  is  real  and  significant,  and  that  an  opt-  out 
 regime  is  a  less  burdensome  means  of  obtaining  a  customers  approval  under  section  222(  c)(  1)  than  is  an  opt-  in  regime. 

 41.  Carriers  uniformly  assert  a  significant  competitive  need  to  use  CPNI  for  marketing  purposes  and/  or  to  share  such  information  with  their  affiliates  that  provide 
 communications-  related  services.  115  The  carriers  seek  to  offer  competitive  packages  that  are  tailored  to  their  customers  usage  patterns  and  demonstrated  service  needs.  Carriers  have 
 demonstrated  on  the  record  that  use  of  CPNI  to  develop  such  targeted  offerings  can  lower  the  costs  and  improve  the  effectiveness  of  customer  solicitations.  116  Moreover,  carriers  assert  that 
 opt-  out  imposes  fewer  burdens  on  their  commercial  speech  interests  than  the  other  alternative  for  ascertaining  approval    opt-  in    and  is  thus  the  only  approval  mechanism  that  will  satisfy  First 
 Amendment  scrutiny  under  Central  Hudson.  117  This  assertion  rests  on  a  comparison  of  the  relative  costs  of  the  mechanisms:  under  opt-  out,  carriers  would  be  required  to  provide  customers 
 with  advance  notice  that  they  intend  to  use  a  customers  CPNI,  and  give  the  customer  an  opportunity  to  disapprove  of  the  use;  under  opt-  in,  carriers  are  prohibited  from  using  a 
 customers  CPNI  unless  the  customer  expressly  approves  the  use  that  the  carrier  requests  the  customer  to  approve  in  its  notice.  118  Given  that  approval  is  required  under  section  222(  c)(  1),  and 
 opt-  out  or  opt-  in  are  the  only  means  of  obtaining  an  expression  of  the  customers  preference, 

 114  U  S  WEST  v.  FCC,  182  F.  3d  at  1238  (quoting  Cincinnati  v.  Discovery  Network,  Inc.,  507  U.  S.  410,  417  (1993)). 
 115  AT&  T  Comments  at  9-  10;  BellSouth  Comments  at  7;  CenturyTel  Comments  at  7;  Nextel  Comments  at  6; 
 NTCA  at  3. 
 116  AT&  T  Comments  at  10;  BellSouth  Comments  at  14;  CenturyTel  Comments  at  11. 

 117  AT&  T  Comments  at  7;  BellSouth  Comments  at  5;  CenturyTel  Comments  at  11;  Nextel  Comments  at  6;  Qwest 
 Comments  at  7;  SBC  Comments  at  8;  WorldCom  Reply  Comments  at  3. 
 118  AT&  T  Comments  at  9;  Nextel  Comments  at  6. 
20
 Federal  Communications  Commission  FCC  02-  214 
 21 
 carriers  assert  that  opt-  out  is  obviously  less  burdensome  than  opt-  in  and  sufficient  to  ascertain  approval  for  a  carriers  marketing  of  communications-  related  services.  119 
 42.  We  note  that  the  particular  form  of  opt-  out  that  we  adopt  here  is  narrowly  tailored  to  ensuring  that  a  customer  be  given  an  opportunity  to  approve  (or  disapprove)  uses  of  CPNI  by 
 a  carrier  and  its  affiliates  that  provide  communications-  related  services.  Specifically,  as  noted  above,  opt-  out  has  been  criticized  in  other  contexts,  e.  g.,  the  financial  services  sector,  because  of 
 the  possibility  that  customers  may  not  actually  see,  read,  or  understand  opt-  out  notices,  and  therefore  the  customers  may  not  be  able  to  respond  to  a  carriers  request  for  approval  in  a  timely 
 and  appropriate  manner.  Furthermore,  circumstances  may  change  over  time  that  would  cause  a  customer  to  want  to  reexamine  any  privacy  election  he  or  she  has  made  with  respect  to  CPNI. 
 We  respond  to  these  specific  problems  with  requirements  that  are  designed  to  increase  the  effectiveness  of  opt-  out  without  burdening  more  carrier  speech  than  necessary. 

 43.  We  require  a  30-  day  waiting  period  following  notice  before  customer  consent  can  be  inferred  to  ensure  that  customers  have  adequate  time  to  respond  to  a  notice.  We  also  require 
 carriers  to  provide  refresher  notices  to  customers  of  their  opt-  out  rights  every  two  years  in  case  circumstances  have  changed  so  as  to  warrant  a  change  in  customers  privacy  elections.  These 
 requirements  are  narrowly  tailored  because  they  address  the  known  shortcomings  of  opt-  out  in  a  targeted  manner  in  lieu  of  adopting  a  more  restrictive  approach  such  as  opt-  in.  Furthermore, 
 there  is  no  indication  in  the  record  that  these  requirements  impose  any  undue  burden  on  carriers.  Carriers  have  been  following  the  30-  day  waiting  period  on  an  interim  basis  and  are  generally 
 supportive  of  it  in  their  comments.  120  Refresher  notices,  which  are  only  required  once  every  two  years,  give  carriers  an  opportunity  to  reconfigure  their  CPNI  policies. 

 44.  We  thus  conclude,  after  weighing  the  relevant  considerations,  that  a  more  stringent  opt-  in  mechanism  is  not  necessary  to  protect  the  substantial  governmental  interest 
 evinced  by  section  222.  Rather,  an  opt-  out  regime  for  intra-  company  use  of  CPNI  to  market  communications-  related  services  directly  and  materially  advances  Congress  interest  in  ensuring 
 that  customers  personal  information  is  not  used  in  unexpected  ways  without  their  permission,  while  at  the  same  time  avoiding  unnecessary  and  improper  burdens  on  commercial  speech,  thus 
 meeting  Central  Hudsons  narrow  tailoring  requirement. 
 b.  Joint  Venture/  Agent  Use 
 45.  We  find  that  the  same  factors  we  consider  above  weigh  in  favor  of  allowing  carriers  to  share  CPNI  based  on  opt-  out  approval  with  their  agents,  and  with  independent 

 contractors  (such  as  telemarketers)  and  joint  venture  partners  to  market  and  provide  communications-  related  services.  We  allow  carriers  to  disclose  CPNI  to  agents,  and  for  the 
 purpose  of  marketing  communications-  related  services,  to  independent  contractors  and  joint 
 119  See  U  S  WEST  v.  FCC,  182  F.  3d  at  1230  (noting  that  under  opt-  out,  a  customers  approval  is  inferred  from  the 
 customer-  carrier  relationship  unless  the  customer  specifically  requests  that  his  or  her  CPNI  be  restricted). 
 120  See  AT&  T  Wireless  Comments  at  3;  Nextel  Comments  at  8;  SBC  Comments  at  14;  Verizon  Comments  at  13; 
 Verizon  Wireless  Comments  at  6,  n.  9;  Verizon  Feb.  20,  2002  Ex  Parte  Letter  at  4. 
21
 Federal  Communications  Commission  FCC  02-  214 
 22 
 venture  partners,  because  under  those  circumstances,  consumers  are  protected  by  the  same  or  equivalent  safeguards  as  those  that  exist  when  carriers  use  CPNI  themselves.  We  also  realize 
 that  carrier  burdens  could  be  significant  for  these  types  of  uses  under  an  opt-  in  scenario  because  opt-  in  could  immediately  impact  the  way  carriers  conduct  business.  121  Thus,  the  rule  we  adopt 
 today  permits  a  carrier  to  share  CPNI  with  a  joint  venture  partner  to  provide  information  services  typically  provided  by  telecommunications  carriers,  such  as  Internet  access  or  voice  mail 
 services.  122  Further,  those  joint  venture  services  that  may  be  provided  using  CPNI  exclude  retail  consumer  services  provided  using  Internet  websites  (such  as  travel  reservation  services  or 
 mortgage  lending  services),  whether  or  not  such  services  may  otherwise  be  considered  to  be  information  services.  123 

 46.  In  defining  the  entities  that  may  use  or  receive  CPNI  based  on  opt-  out  approval,  we  extend  this  treatment  to  all  agency  relationships,  and,  where  certain  additional  safeguards  are 
 met,  to  joint  ventures  and  independent  contractors  as  well.  As  we  discuss  in  detail  below,  the  regulations  we  adopt  distinguish  between  CPNI  uses  that  are  governed  by  section  222  and  our 
 rules,  and  those  that  are  not.  We  allow  carriers  to  share  CPNI  with  their  agents  because  the  principles  of  agency  law  hold  carriers  responsible  for  the  acts  of  their  agents.  Carriers  thus 
 remain  responsible  for  improper  use  or  disclosure  of  consumers  CPNI  while  in  the  hands  of  their  agents.  Accordingly,  carriers  have  an  incentive  to  maintain  appropriate  control  of  CPNI 
 disclosed  to  agents.  As  described  below,  we  also  allow  carriers  to  share  CPNI  with  independent  contractors  and  in  joint  venture  arrangements  (collectively,  non-  agency  relationships)  for 
 communications-  related  services  based  on  opt-  out  approval  as  long  as  the  following  protections  are  employed. 

 47.  Joint  Venture/  Contractor  Safeguards.  We  require  that  carriers  that  allow  access  to  or  disclose  CPNI  to  independent  contractors  or  joint  venture  partners  under  an  opt-  out  regime 
 assure  that  certain  safeguards  are  in  place  to  protect  consumers  CPNI  from  further  dissemination  or  uses  beyond  those  consented  to  by  the  consumer.  In  particular,  we  require 
 carriers,  at  a  minimum,  to  enter  into  confidentiality  agreements  with  independent  contractors  or  joint  venture  partners  that:  (1)  allow  the  independent  contractor  or  joint  venture  partner  to  use  the 
 CPNI  only  for  the  purpose  of  marketing  the  communications-  related  services  for  which  that  CPNI  has  been  provided;  (2)  disallow  the  independent  contractor  or  joint  venture  partner  from 
 using,  allowing  access  to,  or  disclosing  the  CPNI  to  any  other  party,  unless  required  to  make  such  disclosure  under  force  of  law;  (3)  require  that  the  independent  contractor  or  joint  venture 

 121  Many  carriers  employ  independent  contractors  such  as  telemarketers  rather  than  their  own  employees.  We  are 
 taking  this  factor  into  account  in  order  to  avoid  undue  burdens  to  the  carriers  based  on  having  to  change  current  commercial  practices.  We  note  that  we  are  also  putting  sufficient  safeguards  in  place  to  avoid  any  abuses. 

 122  We  reach  this  conclusion  based  on  our  analysis  of  customer  surveys  that  indicate  that  customers  have  a 
 reasonable  expectation  that  their  telecommunications  providers  will  market  to  them  other  services  that  those  carriers  provide.  Moreover,  there  is  no  indication  in  the  record  that  carriers  have  an  interest  in  entering  into  joint  ventures  to 

 market  types  of  services  other  than  those  they  traditionally  provide.  To  the  extent,  in  the  future,  record  evidence  demonstrates  that  there  are  other  types  of  services  that  carriers  may  desire  to  market  and  provide  to  customers 
 through  joint  venture  partnerships,  we  will  address  those  situations  as  the  record  presents  itself. 
 123  See  Appendix  B,  47  C.  F.  R.    64.  2003(  f)  (defining  "information  services  typically  provided  by 
 telecommunications  carriers"). 
22
 Federal  Communications  Commission  FCC  02-  214 
 23 
 partner  have  appropriate  protections  in  place  to  ensure  the  ongoing  confidentiality  of  consumers  CPNI.  124  We  urge  carriers  to  limit  independent  contractors  and  joint  venture  partners  ability  to 
 maintain  CPNI  after  it  has  been  used  for  its  specific  purpose,  but  do  not  so  mandate  at  this  time.  In  addition,  we  note  that  carriers  are  required  to  maintain  a  record  of  all  such  disclosures  as  part 
 of  their  responsibilities  under  section  64.2009(  c)  of  our  rules.  Of  course,  to  the  degree  that  carriers  intend  to  make  such  use  of  CPNI,  they  must  provide  notice  of  that  fact  in  accordance 
 with  our  rules.  125 
 48.  Central  Hudson  Analysis.  Applying  Central  Hudson,  we  conclude  that  opt-  out  with  the  additional  safeguards  described  in  this  section  would  directly  and  materially  advance 

 consumers  substantial  privacy  interests  where  a  carrier  enters  into  a  joint  venture  with  an  unrelated  third  party  for  the  offering  and/  or  provision  of  a  communications-  related  service.  126 
 Central  Hudsons  narrow  tailoring  requires  that  we  balance  the  costs  and  benefits  of  the  burden  on  speech  imposed  by  our  privacy  rules.  Considering  the  benefits  of  the  regulation  we  adopt, 
 consumers  generally  anticipate  that  they  will  receive  marketing  of  telecommunications  services  and  products  from  their  own  carriers,  and  the  safeguards  we  require  will  ensure  that  the  limited 
 dissemination  under  the  joint  venture  (or  independent  contractor)  arrangement    under  the  auspices  of  the  carrier    will  avert  the  privacy  harms  from  unrestricted  third  party  dissemination 
 that  we  discuss  below.  Specifically,  without  confidentiality  agreements  with  carriers  collecting  CPNI,  independent  contractors  or  joint  venture  partners  would  not  have  any  incentive  to  restrict 
 their  use  of  CPNI,  to  refrain  from  further  disclosure  to  third  parties,  or  to  guard  against  their  own  employees  use  or  disclosure  of  a  customers  CPNI.  These  requirements  place  independent 
 contractors  and  joint  venture  partners  on  a  similar  footing  as  the  carriers  themselves  in  terms  of  incentives,  thus  obviating  the  need  for  more  stringent  approval  requirements  such  as  opt-  in. 

 49.  Considering  the  costs  to  carriers  of  adopting  opt-  out  with  these  safeguards,  we  note  that  the  burdens  to  carriers  speech  would  be  much  more  substantial  if  they  were  required  to 
 treat  disclosures  to  their  independent  contractors  as  a  "third-  party  disclosure."  Many  carriers  use  telemarketers  to  conduct  portions  of  their  marketing  business,  and  so  long  as  adequate  safeguards 
 are  in  place,  we  believe  that  a  narrowly  tailored  requirement  should  not  dictate  that  these  carriers  change  their  existing  business  practices.  Moreover,  carriers  urge  us  to  adopt  opt-  out  for  these 
 uses  because  of  the  lessened  carrier  burdens  associated  with  an  opt-  out  method  of  obtaining  customer  approval  under  section  222.  127  We  do  not  expect  that  carriers  will  have  to  enter  into 

 124  Regarding  enforcement  associated  with  these  confidentiality  agreements,  we  note  that  under  section  403  of  the 
 Communications  Act,  the  Commission  has  full  authority  and  power  at  any  time  to  institute  an  inquiry,  on  its  own  motion,  in  any  case  and  as  to  any  matter  or  thing  concerning  which  complaint  is  authorized  to  be  made,  to  or  before 

 the  Commission  by  any  provision  of  [the]  Act,  or  concerning  which  any  question  may  arise  under  any  of  the  provisions  of  [the]  Act,  or  relating  to  the  enforcement  of  any  of  the  provisions  of  [the]  Act.  47  U.  S.  C.    403. 

 125  The  notification  must  specify  .  .  .  the  specific  entities  that  will  receive  the  CPNI,  describe  the  purposes  for 
 which  CPNI  will  be  used.  .  .  .  47  C.  F.  R.    64.  2007(  2)(  ii). 
 126  Qwest  Comments  at  14-  16;  Qwest  May  14,  2002  Ex  Parte  Letter  at  4  ,  App.  C  at  10  &  n.  5  (noting  that  Qwest 
 uses  agents  to  conduct  marketing  when  it  makes  sound  business  sense  to  contract  the  function  out). 
 127  Id. 
23
 Federal  Communications  Commission  FCC  02-  214 
 24 
 any  contracts  that  they  otherwise  would  not  have  to  enter  because  joint  venture  agreements  and  contractor  relationships  routinely  provide  for  confidentiality  of  sensitive  business  information. 
 Carriers  would  simply  be  required  to  include  treatment  of  CPNI  when  negotiating  such  confidentiality  provisions.  In  conclusion,  balancing  of  the  interests  and  the  harms  in  this  context 
 weighs  in  favor  of  an  opt-  out  regime  with  suitable  consumer  safeguards. 
 2.  Third  Parties  and  Carriers  Affiliates  That  Do  Not  Provide  Communications-  Related  Services 

 50.  Applying  the  Central  Hudson  test  to  methods  for  carriers  to  obtain  customer  approval  under  section  222(  c)(  1)  to  disclose  or  allow  access  to  CPNI  to  third  parties,  we 
 conclude  that:  (1)  the  government  has  a  substantial  interest  in  ensuring  that  a  customer  give  her  knowing  approval  to  disclosures  of  CPNI  to  third  parties  because  such  disclosures  can  have 
 significant  privacy  consequences  and  be  irreversible;  (2)  opt-  in  directly  and  materially  advances  this  interest  by  mandating  that  carriers  provide  prior  notice  to  customers  and  refrain  from 
 disclosing  or  allowing  access  to  CPNI  unless  a  customer  gives  her  express  consent  by  written,  oral,  or  electronic  means;  and  (3)  opt-  in  is  narrowly  tailored  because  carriers  have  not  asserted 
 any  intention  of  sharing  CPNI  with  unaffiliated  third  parties,  and  thus  the  burden  of  requiring  opt-  in  in  this  context  is  negligible  and  certainly  warranted  in  light  of  consumers  substantial 
 privacy  interest  in  protecting  their  CPNI  from  unapproved  disclosure  to  third  parties. 
 51.  As  discussed  in  the  following  paragraphs,  the  record  unequivocally  demonstrates  that,  in  contrast  to  intra-  company  use  and  disclosure  of  CPNI,  there  is  a  more  substantial  privacy 

 interest  with  respect  to  third-  party  disclosures.  The  record  indicates  not  only  that  consumers  wishes  are  different  regarding  third-  party  disclosure,  but  that  the  privacy  consequences  are  more 
 significant  in  the  case  of  unintended  disclosure  to  third  parties.  Once  the  personal  information  in  CPNI  is  disclosed  to  such  companies  or  individuals,  the  use  of  that  information  is  no  longer 
 subject  to  the  constraints  of  section  222,  and  further,  these  third  parties  have  no  incentive  to  honor  the  privacy  expectations  of  customers  with  whom  they  have  no  relationship.  On  the  other 
 hand,  any  carrier  speech  burden  from  having  to  seek  express  consent  for  third-  party  disclosures  appears  to  be  negligible.  Carriers  say  that  they  need  to  share  with  third  parties  for  telemarketing 
 and  joint  ventures,  for  which  we  adopt  opt-  out  with  certain  protections.  Beyond  that,  carriers  say  they  do  not  share  with  third  parties,  making  any  burden  on  speech  nil,  or  speculative  at  best. 
 Therefore,  with  respect  to  customer  approval  of  third-  party  disclosures,  carriers  have  not  established  on  our  record  that  there  is,  or  would  be,  any  significant  burden  on  their  First 
 Amendment  commercial  speech  interest  from  opt-  in  to  weigh  against  consumers  substantial  privacy  interest  in  avoiding  unapproved  disclosures  to  third  parties.  There  is  also  no 
 demonstrated  consumer  benefit  to  be  derived  from  third-  party  sharing  that  would  impact  our  balancing  analysis.  Thus,  we  find  that  opt-  in  is  narrowly  tailored  under  Central  Hudson  because 
 it  burdens  no  more  carrier  speech  than  necessary  to  directly  and  materially  advance  the  governments  interest  in  ensuring  informed  consent  before  a  customers  personal  information  is 
 disclosed  to  third  parties  by  its  telecommunications  carrier. 
24
 Federal  Communications  Commission  FCC  02-  214 
 25 
 52.  We  also  conclude  that  opt-  in  is  necessary  with  respect  to  disclosures  of  CPNI  to  a  carriers  affiliates  that  provide  no  communications-  related  services.  128  In  this  context,  opt-  in 
 consent  directly  and  materially  advances  the  governments  interest  in  ensuring  that  customers  give  their  knowing  approval  to  such  uses  of  CPNI,  while  burdening  no  more  carrier  speech  than 
 necessary. 
 a.  Disclosure  to  Third  Parties 
 53.  Governments  Substantial  Interest.  The  record  in  this  proceeding  shows  that  the  governments  interest  in  protecting  consumers  from  unexpected  and  unwanted  disclosure  of  their 

 personal  information  in  CPNI  is  a  significant  one,  and  the  potential  privacy  harm  to  consumers  from  disclosure  to  third  parties  significantly  exceeds  that  presented  by  the  intra-  company  uses 
 described  above.  First,  carrier  surveys  and  comments  vividly  demonstrate  that  consumers  view  use  of  CPNI  by  a  consumers  carrier  differently  than  disclosure  to  or  use  by  a  third  party.  In  the 
 Cincinnati  Bell  study  described  above,  nearly  half  of  consumers  questioned  said  they  would  be  "extremely  concerned"  by  the  release  of  CPNI  for  marketing  purposes  to  companies  other  than 
 their  own  telephone  company.  129  The  most  recent  Harris  2002  Survey  shows  that  this  figure  is  now  even  higher,  and  today  73  percent  would  bar  disclosure  to  other  companies.  130 

 54.  Second,  the  record  shows  that  unexpected  and  unwanted  disclosure  of  private  information  to  third  parties  also  exposes  telecommunications  consumers  to  potentially  more 
 harm  from  subsequent  disclosures.  Specifically,  if  a  consumers  CPNI  is  disclosed  to  entities  unaffected  by  section  222  and  our  rules,  that  entity  can  resell  or  use  the  CPNI  in  any  lawful  way 
 without  limitation.  131  Once  CPNI  enters  the  stream  of  commerce,  consumers  are  without  meaningful  recourse  to  limit  further  access  to,  or  disclosure  of,  that  personal  information.  132 
 Thus,  the  threat  to  telecommunications  consumers  privacy  interest  from  having  their  personal  information  in  CPNI  disclosed  to  parties  who  are  not  subject  to  section  222  and  the 
 Commissions  rules    without  their  knowing  approval    is  a  substantial  one.  As  one  example  of  the  disposition  of  sensitive  personal  information  without  adequate  constraints,  the  state  Attorneys 

 128  See  infra  section  III.  A.  2.  b. 
 129  Cincinnati  Bell  Study  at  2;  Qwest  Reply  Comments  at  18,  n.  58. 
 130  Letter  from  Kathryn  Marie  Krause,  Qwest,  to  Marlene  H.  Dortch,  Secretary,  Federal  Communications 
 Commission,  CC  Docket  Nos.  96-  115  and  96-  149  (filed  July  2,  2002)  (Qwest  July  2,  2002  Ex  Parte  Letter)  (confidential  submission),  attaching  Privacy  On  &  Off  the  Internet:  What  Consumers  Want,  conducted  by  Harris 

 Interactive,  at  44  (Feb.  7,  2002)  (  Harris  2002  Survey);  Letter  from  Kathryn  Marie  Krause,  Qwest,  to  Marlene  H.  Dortch,  Secretary,  Federal  Communications  Commission,  CC  Docket  Nos.  96-  115  and  96-  149  (filed  May  14,  2002) 
 App.  D  at  14  n.  28  (Qwest  May  14,  2002  Ex  Parte  Letter). 
 131  Letter  from  Ken  Reif,  NASUCA,  to  William  F.  Caton,  Acting  Secretary,  Federal  Communications  Commission, 
 CC  Docket  Nos.  96-  115  and  96-  149  (filed  April  12,  2002)  at  8  (  NASUCA  April  12,  2002  Ex  Parte  Letter)  (  The  use  to  which  CPNI  can  be  put  and  the  resulting  harm  to  the  consumer  is  limited  only  by  the  imagination  of  those 

 with  an  interest  in  selling  it  to  the  highest  bidder.). 
 132  NASUCA  Apr.  12,  2002  Ex  Parte  Letter  at  7  (  Once  disclosed,  private  information  cannot  be  gathered  up  and 
 returned  to  the  customer.). 
25
 Federal  Communications  Commission  FCC  02-  214 
 26 
 General  recount  the  questionable  behavior  of  U.  S.  Bank  under  another  privacy  statute,  which  caused  40  states  and  the  District  of  Columbia  to  enter  into  a  settlement  resolving  allegations  that 
 the  bank  misrepresented  its  practice  of  selling  highly  personal  and  confidential  financial  information  regarding  its  customers  to  telemarketers.  133 

 55.  Harm  to  the  consumer  is  exacerbated  by  the  fact  that  third  party  entities  receiving  CPNI  have  no  existing  business  relationship  with  the  consumer  and,  hence,  no  accountability  to 
 the  consumer.  134  Thus,  companies  that  are  not  constrained  by  section  222,  and  with  which  the  customer  has  no  ongoing  business  relationship,  are  motivated  to  use  customers  CPNI  in  the  way 
 that  generates  the  most  profits    which  may  include  selling  or  providing  access  to  personal  information  to  the  highest  bidder.  135  Indeed,  as  data  mining  and  personalization  capabilities 
 mature,  the  value  of  personal  information  increases,  as  do  the  carriers  incentive  and  opportunity  to  sell  CPNI  and  third  parties  incentive  and  opportunity  to  purchase  it.  By  contrast,  a  carrier 
 with  whom  a  customer  has  an  existing  business  relationship  has  an  incentive  not  to  misuse  its  customers  CPNI  or  it  will  risk  losing  that  customers  business.  136  For  these  reasons,  we 
 conclude  that  the  governments  interest  in  ensuring  knowing  customer  approval  before  carriers  can  disclose  customers  CPNI  to  third  parties  is  a  substantial  one. 

 56.  Direct  and  Material  Advancement.  We  have  noted  the  substantial  government  interest  in  protecting  consumers  privacy  choices  in  the  preceding  paragraphs.  Specifically, 
 consumers  say  that  their  privacy  interest  is  substantially  greater  when  asked  about  releasing  information  to  third  parties  or  for  uses  beyond  their  expectations  based  on  the  existing 
 relationship  with  their  chosen  carrier.  137  Furthermore,  once  such  information  leaves  the  hands  of  the  customers  carrier,  the  customer  loses  her  ability  to  limit  further  dissemination,  and  section 
 222  and  the  Commissions  rules  concerning  use  of  CPNI  are  not  applicable  to  those  unknown  third  parties  that  receive  the  customers  personal  information.  138  For  these  reasons,  there  is  a 
 greater  need  to  ensure  express  consent  from  an  approval  mechanism  for  third  party  disclosure.  Opt-  in  directly  and  materially  advances  this  interest  by  mandating  that  carriers  provide  prior 

 133  NAAG  Dec.  21,  2001  Ex  Parte  Letter  at  5. 
 134  Cf.  CenturyTel  Comments  at  5  (  CenturyTel  notes  that,  in  using,  accessing  and  disseminating  CPNI,  carriers  do 
 not  use  or  disseminate  sensitive  or  personal  information  that  would  inflict  specific  or  significant  harm  on  their  customers.). 

 135  NAAG  Dec.  21,  2001  Ex  Parte  Letter  at  5  (  The  type  of  information  that  telemarketers  and  joint  marketing 
 partners  would  find  useful,  and  therefore,  be  willing  to  pay  for,  is  limitless.). 
 136  AT&  T  Comments  at  7. 

 137  Harris  2002  Survey  at  44;  Cincinnati  Bell  Study  at  2. 
 138  Compare  the  CPNI  statute  to  Gramm-  Leach-  Bliley,  which  specifically  limits  third  parties  ability  to  further  use 
 and  disseminate  consumers  personal  information:  Except  as  otherwise  provided  in  this  subtitle,  a  nonaffiliated  third  party  that  receives  from  a  financial  institution  nonpublic  personal  information  under  this  section  shall  not, 

 directly  or  through  an  affiliate  of  such  receiving  third  party,  disclose  such  information  to  any  other  person  that  is  a  nonaffiliated  third  party  of  both  the  financial  institution  and  such  receiving  third  party,  unless  such  disclosure  would 
 be  lawful  if  made  directly  to  such  other  person  by  the  financial  institution.  15  U.  S.  C.    6802(  c). 
26
 Federal  Communications  Commission  FCC  02-  214 
 27 
 notice  to  customers  and  refrain  from  disclosing  CPNI  unless  a  customer  gives  her  express  consent  by  written,  oral,  or  electronic  means.  Thus,  we  require  opt-  in  approval  because  it 
 directly  and  materially  advances  the  governments  interest  in  ensuring  that  customers  give  their  knowing  consent  to  use  or  sharing  of  CPNI  that  can  have  irreversible  consequences  for 
 consumers  privacy. 
 57.  Narrow  Tailoring.  Under  the  narrow  tailoring  prong  of  Central  Hudson,  as  noted  above,  we  consider  the  careful  calculation  of  costs  and  benefits  associated  with  the  burden  on 

 speech.  139  Considering  the  burden  on  carriers  speech,  i.  e.,  the  costs  of  an  opt-  in  customer  approval  regime  for  disclosures  of  CPNI  to  third  parties,  we  recognize  that  opt-  in  is  more 
 restrictive  on  carriers  speech  than  opt-  out  because  carriers  wishing  to  engage  in  third-  party  disclosures  other  than  to  telemarketers  and  joint  venture  partners  for  communications-  related 
 services  must  secure  express  customer  approval  by  written,  electronic,  or  oral  means.  However,  as  described  below,  carriers  themselves  recognize  the  qualitative  difference  between  third-  party 
 disclosure  and  disclosure  to  their  own  affiliates,  and  they  do  not  assert  any  meaningful  burden  from  having  to  seek  opt-  in  approval  for  intended  disclosures  to  third  parties.  In  fact,  carriers  say 
 they  do  not  share  CPNI  with  third  parties. 
 58.  In  contrast  to  intra-  company  and  joint  venture  uses,  carriers  generally  have  not  asserted  any  commercial  speech  interest  in  (or  consumer  benefit  from)  sharing  CPNI  with  third 

 parties.  We  also  know  of  no  carrier  that  currently  secures  opt-  out  approval  for  third-  party  disclosure.  Indeed,  most  carriers  suggest  that  it  would  not  be  appropriate  to  disclose  CPNI  to 
 unrelated  third  parties  for  independent  use  without  express  customer  approval.  140  Therefore,  most  carriers  that  have  spoken  to  this  question  affirmatively  support  an  opt-  in  regime  for  third-party 
 disclosures. 
 59.  Even  Qwest,  which  previously  indicated  it  would  challenge  an  opt-  in  requirement  for  third-  party  disclosure,  141  expressly  acknowledges  that  there  is  a  much  greater  customer 

 139  U  S  WEST  v.  FCC,  182  F.  3d  at  1238  (quoting  Cincinnati  v.  Discovery  Network,  Inc.,  507  U.  S.  410,  417  (1993)). 
 140  USTA  Comments  at  11  (  Carriers  have  not  disputed  that  a  customers  CPNI  may  not  be  shared  with  a  third 
 party  without  the  customers  consent.);  Letter  from  Richard  T.  Ellis,  Verizon,  to  William  F.  Caton,  Acting  Secretary,  Federal  Communications  Commission,  CC  Docket  Nos.  96-  115  and  96-  149  (filed  Feb.  20,  2002  (Verizon 

 Feb.  20,  2002  Ex  Parte  Letter)  (asserting  that  fears  of  carrier  joint  marketing  with  providers  of  medical  products  and  telemarketing  retailers  have  no  basis  in  fact  and  would  be  beyond  scope  of  opt-  out  rule  and  that  most  recent 
 publicity  has  centered  around  disclosure  to  non-  affiliates,  which  requires  prior  written  consent);  Letter  from  Michael  B.  Fingerhut,  Sprint,  to  William  F.  Caton,  Acting  Secretary,  Federal  Communications  Commission,  CC 
 Docket  No.  96-  115  (filed  Apr.  11,  2002)  (Sprint  Apr.  11,  2002  Ex  Parte  Letter)  (third  party  disclosure  requires  express  consent  and  opt-  in).  Some  carriers  speak  about  opt-  out  only  in  the  context  of  disclosures  within  the 
 carriers  corporate  family  or  to  provide  only  telecommunications  services.  BellSouth  Comments  at  4;  AT&  T  Wireless  Comments  at  2  (  AWS  supports  the  use  of  an  opt-  out  mechanism  for  obtaining  customer  approval  before 
 using  CPNI  to  provide  telecommunications  services  other  than  those  from  which  the  CPNI  is  derived.).  But  see  WorldCom  Comments  at  7-  8  (  There  is  no  statutory  basis  for  the  claim  that  the  sharing  of  CPNI  with  a  third  party 
 requires  a  higher  form  of  consent  .  .  .  .  [T]  here  is  no  evidence  that  such  disclosure  constitutes  an  invasion  of  privacy.  .  .  .). 

 141  Qwest  Comments  at  14-  16. 
27
 Federal  Communications  Commission  FCC  02-  214 
 28 
 privacy  interest  in  avoiding  third-  party  disclosures  than  in  limiting  carrier  uses  of  CPNI.  Qwest  now  only  asserts  a  right  to  use  telemarketers  or  to  engage  in  joint  marketing  with  appropriate 
 [but  undefined]  protections  for  the  confidentiality  of  the  information.  142  Qwest  indicates  that  it  has  imposed  voluntary  internal  constraints  on  CPNI  disclosure  for  years,  operating  in  a  fashion 
 that  protects  the  confidentiality  of  information  about  its  customers  and  refusing  to  provide  CPNI  to  unaffiliated  parties  for  their  own  marketing  uses.  143  Thus,  outside  the  carriers  interest  in 
 disclosing  CPNI  to  telemarketing  agents  and  joint  venture  partners  (for  which  we  allow  opt-  out),  carriers  have  not  demonstrated  that  opt-  in  imposes  any  burden  on  speech  that  carriers  need  or 
 even  wish  to  undertake. 
 60.  The  significant  benefits  of  opt-  in  approval  for  third  party  dissemination  are  discussed  above,  and  we  have  already  concluded  that  such  approval  directly  and  materially 

 advances  the  government  interest  in  protecting  consumer  privacy.  We  also  note  that  opt-  in,  as  we  define  the  requirement,  144  is  not  the  most  restrictive  approach  the  Commission  could  adopt. 
 Requiring  express  prior  written  approval,  such  as  a  letter  of  authorization,  would  be  the  most  restrictive  means  of  obtaining  customer  approval. 

 61.  We  reject  some  commenters  arguments  that  section  222(  c)(  2)  145  requires  express  written  authorization  by  a  customer  before  a  carrier  may  disclose  CPNI  to  a  third  party.  146  We 
 reiterate  our  prior  conclusion  that  section  222(  c)(  2)  applies  only  to  customer-  initiated  requests  and  does  not  circumscribe  the  form  of  approval  that  a  carrier  may  secure  from  its  customer 
 under  section  222(  c)(  1)  for  use  and  disclosure  of  CPNI.  147  But  we  do  find  these  commenters  positions  probative  of  (i)  the  absence  of  any  burden  on  actual  commercial  speech  from 
 constraints  on  third  party  disclosure,  and  (ii)  the  greater  consumer  privacy  interest  in  preventing  unwanted  third  party  disclosures. 

 142  See  Qwest  May  14,  2002  Ex  Parte  Letter,  App.  C  (filing  with  Arizona  Corporation  Commission  dated  March 
 29,  2002).  Notably,  Qwest  appears  to  have  changed  its  position  after  consumer  complaints  about  its  CPNI  disclosure  policies  (particularly  its  vague  notices),  resulting  in  investigations  by  various  state  Attorneys  General  and 

 state  commissions.  Although  initially  indicating  that  it  opposed  opt-  in  even  for  third  party  disclosures,  its  recent  ex  parte  submissions  indicate  its  acceptance  of  some  constraints  on  third-  party  disclosure. 

 143  Id.  (page  10,  answer  (i)). 
 144  See  Appendix  B,    64.  2003(  h). 
 145  Section  222(  c)(  2)  states  that  [  a]  telecommunications  carrier  shall  disclose  customer  proprietary  network 
 information,  upon  affirmative  written  request  by  the  customer,  to  any  person  designated  by  the  customer.  47  U.  S.  C.    222(  c)(  2). 

 146  Verizon  Reply  Comments  at  4;  Nextel  Comments  at  12  (  .  .  .  "section  222(  c)(  2)  [requires]  that  the  customer 
 submit  an  affirmative  written  request  to  the  BOC  or  its  affiliate  before  such  information  may  be  disclosed  to  their  competitors.);  see  also  Verizon  Feb.  20,  2002  Ex  Parte  Letter,  attached  presentation  at  1  (stating  that  carrier  joint 

 marketing  with  providers  of  medical  products  and  telemarketing  retailers  have  no  basis  in  fact  and  would  be  beyond  scope  of  opt-  out  rule  and  most  recent  publicity  has  centered  around  disclosure  to  non-  affiliates,  which 
 requires  prior  written  consent). 
 147  CPNI  Order,  13  FCC  Rcd  at  8125-  26,  para.  84. 
28
 Federal  Communications  Commission  FCC  02-  214 
 29 
 62.  We  have  also  examined  opt-  out  as  an  alternative,  and  find  that  it  would  not  be  an  effective  means  of  protecting  consumers  from  the  far  more  substantial  harms  that  are  attendant 
 upon  unknowing  and  unwanted  third-  party  disclosures.  Some  commenters  recognize  the  possibility  that  customers  may  not  see,  read  or  understand  notices  informing  them  of  third-  party 
 sharing.  But,  in  contrast  to  intra-  company  sharing,  there  is  no  ongoing  customer  relationship  or  Commission  enforcement  authority  over  third-  party  recipients  that  would  mitigate  the  harms 
 from  unwanted  or  inadvertent  third-  party  disclosures  that  are  possible  with  opt-  out.  This  is  a  particular  concern  given  empirical  evidence  that  the  method  of  approval  significantly  impacts  the 
 level  of  disclosure  of  personal  information.  Testimony  submitted  to  the  Federal  Trade  Commission  (FTC)  shows  that  opt-  out  results  in  disclosure  rates  of  95  percent,  148  but  when  the 
 default  is  opt-  in,  85  percent  of  consumers  would  choose  not  to  provide  their  data.  149  In  contrast,  an  opt-  in  approval  offers  greater  protection  for  consumers  privacy.  In  an  opt-  in  regime,  carriers 
 have  incentives  to  ensure  that  consumers  are  aware  of  CPNI  notices,  that  such  notices  are  comprehensible,  that  the  methods  for  consumers  to  opt-  in  are  not  burdensome,  and  that 
 consumers  are  given  incentives  to  opt-  in.  150  Opt-  out  regimes  tend  to  reverse  these  incentives. 
 63.  Accordingly,  we  conclude  that  opt-  in  for  third  party  disclosures  satisfies  the  narrow  tailoring  prong  of  Central  Hudson  because  it  does  not  impose  any  substantially  greater 

 burden  on  speech  than  is  necessary  to  achieve  the  governments  interest.  We  note  that  our  decision  to  establish  an  opt-  in  requirement  is  consistent  with  and  draws  support  from  the  recent 
 decision  of  the  United  States  Court  of  Appeals  for  the  District  of  Columbia  Circuit  in  Trans  Union  v.  FTC.  151  In  this  case,  the  court  upheld  the  FTCs  application  of  an  opt-  in  mechanism  to 
 obtain  consumers  approval  for  the  use  of  private  information  in  credit  reports  for  target  marketing.  In  so  doing,  the  court  held  that  an  individuals  privacy  interests  in  personal 
 information  are  defined  not  only  by  the  content  of  the  information,  but  also  by  the  identity  of  the  audience  and  the  use  to  which  the  information  may  be  put.  152  Our  analysis  recognizes  that  the 
 harms  to  customer  privacy  and  the  speech  interests  of  the  carriers  are  different  in  the  context  of  third-  party  disclosure.  Central  Hudson  requires  that  we  recognize  these  differences,  and  we  do 
 so.  While  the  means  employed  to  protect  the  greater  consumer  privacy  interest  with  respect  to  third-  party  disclosure  of  CPNI  is  more  stringent,  as  discussed  above,  it  reflects  a  narrowly 

 148  See  Progress  &  Freedom  Foundation  Reply  Comments  at  5;  Qwest  May  14,  2002  Ex  Parte  Letter,  App.  C 
 (filing  with  Arizona  Corporation  Commission  dated  March  29,  2002). 
 149  Progress  &  Freedom  Foundation  Reply  Comments  at  5. 

 150  EPIC  et  al.  Reply  Comments  at  5  (  Opt-  out  regimes  create  an  economic  incentive  for  businesses  to  make  it 
 difficult  for  consumers  to  exercise  their  preference  not  to  disclose  personal  information  to  others.). 
 151  Trans  Union  Corp.  v.  Federal  Trade  Commn.,  267  F.  3d  1138,  1143  (D.  C.  Cir.  2000),  petition  for  cert.  pending 
 (finding  that  requirement  of  customer  opt-  in  approval  before  a  credit  reporting  agency  could  use  collected  credit  information  for  target  marketing  satisfied  intermediate  First  Amendment  scrutiny  because  selection  of  only 

 marginally  less  restrictive  alternative    opt-  out    was  not  required  under  Central  Hudson  test). 
 152  Id. 
29
 Federal  Communications  Commission  FCC  02-  214 
 30 
 tailored  fit  and  "proper  balancing  of  the  benefits  and  harms  of  privacy,  153  which  Central  Hudson  requires  of  any  privacy  regulations  that  impact  a  carriers  commercial  speech  interests. 
 b.  Disclosure  to  Affiliates  that  Provide  no  Communications-Related  Services 
 64.  We  find  that  the  same  factors  we  consider  above  weigh  in  favor  of  requiring  opt-in  before  a  carrier  may  share  CPNI  with  its  affiliates  that  do  not  provide  communications-  related 
 services.  We  find  that  CPNI  dissemination  to  such  affiliates  is  far  more  similar  to  third  party  dissemination  than  to  the  sharing  of  CPNI  with  affiliates  that  provide  communications-  related 
 services,  and  thus  warrants  a  similar  level  of  protection  as  that  required  for  third  party  disclosure. 
 65.  Central  Hudson  Analysis.  Applying  Central  Hudson,  we  find  that  opt-  in  in  this  context  directly  and  materially  advances  the  governments  interest,  which  is  to  ensure  that 

 customers  give  their  knowing  approval  to  disclosure  of  CPNI  for  purposes  unrelated  to  obtaining  communications-  related  services  from  their  carrier  (or  its  affiliates  and  partners).  As  noted, 
 disclosure  to  affiliates  that  offer  no  communications-  related  services  is  strikingly  similar  to  disclosures  to  unrelated  parties,  and  the  record  has  shown  that  the  privacy  interests  in  such  types 
 of  disclosures    which  are  far  more  substantial  than  for  disclosures  to  carriers  for  communications-  related  purposes  154    will  be  protected  to  a  greater  extent  by  the  express  consent 
 under  opt-  in  approval,  which  best  prevents  against  inadvertent  disclosures.  155 
 66.  Balancing  the  costs  and  benefits  of  opt-  in  for  this  type  of  disclosure  under  Central  Hudson,  we  conclude  that  requiring  opt-  in  approval  before  sharing  CPNI  with  affiliates  that  do 

 not  provide  communications-  related  services  is  narrowly  tailored  to  protect  consumers  privacy  interests.  Considering  consumers  privacy  interests,  the  empirical  evidence  cited  above  for 
 customer  expectations  holds  equally  true  for  entities  that,  while  technically  affiliated  with  a  telephone  company,  do  not  provide  communications-  related  services.  In  various  studies, 
 consumers  have  stated  that  they  do  not  want  their  CPNI  released  to  anyone  outside  their  telephone  company.  156  There  is  no  evidence  in  the  record  to  suggest  that  customers  expect  or 
 want  marketing  from  an  affiliate  that  does  not  offer  communications-  related  services  and  may  not  even  have  a  similar  name  as  their  telephone  company.  As  we  noted  above,  carriers  have  an 
 incentive  not  to  misuse  CPNI,  as  otherwise  they  risk  losing  the  customer.  This  incentive  diminishes  or  disappears  entirely,  however,  if  the  solicitation  is  not  identifiable  as  coming  from 
 the  carrier  or  within  its  corporate  family. 
 67.  Application  of  opt-  in  in  this  context  significantly  advances  the  consumer  interest  at  the  heart  of  section  222.  If,  despite  the  advocacy  in  this  proceeding,  a  carrier  were  to  share 

 CPNI  with  an  affiliate  that  did  not  provide  communications-  related  services,  such  use  would  fall 
 153  U  S  WEST  v.  FCC,  182  F.  3d  at  1235. 
 154  See  paras.  53-  55. 
 155  See  paras.  57-  63. 
 156  Harris  2002  Survey  at  44;  Cincinnati  Bell  Study  at  2;  Qwest  Reply  Comments  at  18,  n.  58. 
30
 Federal  Communications  Commission  FCC  02-  214 
 31 
 outside  the  consumers  reasonable  expectation  that  CPNI  would  only  be  used  by  the  telephone  company  for  solicitation  of  communications-  related  services.  157  Moreover,  misuse  by  such 
 affiliates  is  less  likely  to  result  in  the  loss  of  the  customer,  so  the  affiliate  would  not  have  the  same  mitigating  incentive  to  guard  against  misuse  of  CPNI  as  the  carrier  would  when  conducting 
 its  own  solicitation.  Thus,  the  analysis  for  affiliates  that  do  not  provide  communications-  related  services  parallels  our  reasoning  regarding  disclosure  to  third  parties,  who  have  no  immediate 
 carrier-  customer  relationship  to  maintain  and  consequently  no  incentive  to  use  CPNI  in  accordance  with  a  customers  expectations. 

 68.  Considering  the  burdens  on  carriers  speech  from  having  to  obtain  a  customers  express  consent,  we  observe  that  while  some  commenters  discuss  intra-  company  sharing  in 
 general  terms,  others  acknowledge  that  they  are  advocating  opt-  out  approval  only  for  affiliates  that  provide  communications  services.  158  Therefore,  the  record  demonstrates  that  the  actual 
 burden  on  carriers  speech  is  low,  as  the  only  burden  demonstrated  on  the  record  would  be  a  carriers  inability  to  market  communications-  related  services  in  conjunction  with  an  affiliate. 
 Thus,  on  this  record,  our  balance  of  privacy  interests  and  carrier  speech  burdens  persuades  us  that  opt-  in  is  a  proportionate  and  narrowly  tailored  means  to  protect  the  governmental  interest. 

 3.  State  Choice 
 69.  In  this  Order,  we  reconfirm  our  decision  to  exercise  preemption  authority  on  a  case-  by-  case  basis.  159  As  the  Commission  found  in  the  CPNI  Order,  the  Commission  may 

 preempt  state  regulation  of  intrastate  telecommunications  matters  where  such  regulation  would  negate  the  Commissions  exercise  of  its  lawful  authority  because  regulation  of  the  interstate 
 aspects  of  the  matter  cannot  be  severed  from  regulation  of  the  intrastate  aspects.  160  Because  no  specific  state  regulations  are  before  us,  we  do  not  at  this  time  exercise  our  preemption  authority. 
 We  will  examine  any  potentially  conflicting  state  rules  brought  before  us  on  a  case-  by-  case  basis.  161 

 70.  We  differ  from  our  earlier  approach  in  one  respect.  Should  states  adopt  CPNI  requirements  that  are  more  restrictive  than  those  adopted  by  the  Commission,  we  decline  to 
 apply  any  presumption  that  such  requirements  would  be  vulnerable  to  preemption.  We  recognize 
 157  Id. 
 158  See,  e.  g.,  AT&  T  Wireless  Comments  at  2  (  AWS  supports  the  use  of  an  opt-  out  mechanism  for  obtaining 
 customer  approval  before  using  CPNI  to  provide  telecommunications  services  other  than  those  from  which  the  CPNI  is  derived.);  Sprint  Comments  at  5  ([  T]  he  fact  that  carriers  have  .  .  .  flexibility  [to  devise  methods  to  meet  section 

 222  obligations]  does  not  mean  that  they  are  violating  Section  222  and  using  their  customers  CPNI  to  market  the  products  and  services  offered  by  their  affiliates  or  sharing  their  customers  CPNI  with  such  affiliates  without  first 
 informing  their  customers  of  their  CPNI  rights  and  gaining  their  customers  approval  for  such  use.) 
 159  CPNI  Order  at  8077-  78,  para.  18;  CPNI  Reconsideration  Order  at  14466-  67,  para.  113. 

 160  CPNI  Order  at  8075-  76,  para.  16. 
 161  We  disagree  with  those  commenters  who  urge  us  to  preempt  state  regulations.  Qwest  May  30,  2002  Ex  Parte 
 Letter;  Verizon  Feb.  20,  2002  Ex  Parte  Letter,  Attach.  at  4. 
31
 Federal  Communications  Commission  FCC  02-  214 
 32 
 this  approach  differs  from  our  approach  in  earlier  CPNI  orders,  162  but  the  change  is  necessary  as  a  result  of  the  change  in  approach  we  adopt  in  this  Order.  Prior  to  the  Tenth  Circuits  opinion,  our 
 analysis  did  not  incorporate  First  Amendment  concerns,  and,  by  requiring  opt-  in  for  all  customer  approval  under  section  222(  c)(  1),  established  a  relatively  more  burdensome  means  of 
 ascertaining  customer  approval  for  the  use  of  CPNI.  As  a  practical  matter,  the  only  more  restrictive  approach  that  could  be  adopted,  as  noted  above,  would  be  express  written  approval. 
 In  this  Order,  as  required  by  the  Tenth  Circuit,  we  have  conducted  a  Central  Hudson  analysis  of  the  burden  of  different  approval  mechanisms  on  protected  speech,  balancing  carrier  and 
 customer  rights  to  commercial  speech  with  consumers  rights  to  privacy  in  their  CPNI. 
 71.  We  conclude  that  carriers  can  use  opt-  out  for  their  own  marketing  of  communications-  related  services,  as  described  above,  which  is  less  burdensome  than  opt-  in.  We 

 reach  this  conclusion  based  on  the  record  before  us,  but  must  acknowledge  that  states  may  develop  different  records  should  they  choose  to  examine  the  use  of  CPNI  for  intrastate 
 services.  163  They  may  find  further  evidence  of  harm,  or  less  evidence  of  burden  on  protected  speech  interests.  Accordingly,  applying  the  same  standard,  they  may  nevertheless  find  that  more 
 stringent  approval  requirements  survive  constitutional  scrutiny,  and  thus  adopt  requirements  that  go  beyond  those  adopted  by  the  Commission.  164  While  the  Commission  might  still  decide  that 
 such  requirements  could  be  preempted,  it  would  not  be  appropriate  for  us  to  apply  an  automatic  presumption  that  they  will  be  preempted.  We  do  not  take  lightly  the  potential  impact  that 
 varying  state  regulations  could  have  on  carriers  ability  to  operate  on  a  multi-  state  or  nationwide  basis.  Nevertheless,  our  state  counterparts  do  bring  particular  expertise  to  the  table  regarding 
 competitive  conditions  and  consumer  protection  issues  in  their  jurisdictions,  and  privacy  regulation,  as  part  of  general  consumer  protection,  is  not  a  uniquely  federal  matter.  165  We 

 162  Previously,  the  Commission  has  noted  that  state  rules  vulnerable  to  preemption  are  those  that  (1)  permit 
 greater  carrier  use  of  CPNI  than  section  222  and  the  Commissions  rules  allow,  or  (2)  seek  to  impose  additional  limitations  on  carriers  use  of  CPNI.  CPNI  Reconsideration  Order  at  14465-  66,  para.  112.  See  also  CPNI  Order  at 

 8077-  78,  para.  18. 
 163  For  example,  we  note  that  Arizona  is  currently  examining  whether  to  require  carriers  to  provide  verification  to 
 customers  regarding  customers  CPNI  elections.  See  Arizona  Corporation  Commission  Docket  No.  RT-  00000J-  02-0066,  Order,  Decision  No.  64375  (Jan.  28,  2002);  Arizona  Corporation  Commission  Staff  Memorandum,  Docket 

 No.  RT-  00000J-  02-  0066  (Feb.  15,  2002).  We  note  that  states  may  conduct  their  own  examination  of  such  alternatives  and  determine,  based  on  the  record  developed  in  those  proceedings,  whether  such  additional  safeguards 
 are  warranted. 
 164  NASUCA  Apr.  12,  2002  Ex  Parte  Letter  at  8.  See  also  Arizona  Corporation  Commission  Jan.  28,  2002  Ex 
 Parte  Letter  at  2.;  Letter  from  Jay  Stovall,  to  William  Caton,  Acting  Secretary,  Federal  Communications  Commission,  CC  Docket  Nos.  96-  115  and  96-  149  (filed  Feb.  21,  2002)  (Montana  PSC  Feb.  12,  2002  Ex  Parte 

 Letter)  at  2;  Texas  Office  of  Public  Utility  Counsel  April  16,  2002  Ex  Parte  Letter  at  4.  We  also  note  in  this  respect  that  state  commissions  are  charged  with  implementing  differing  state  laws,  regulations  and  constitutions.  See,  e.  g., 
 Arizona  Corporation  Commission  Jan.  28,  2002  Ex  Parte  Letter  discussing  Arizonas  state  constitutional  right  to  privacy.  See  also  California  Public  Utilities  Commission  Comments  at  6  (noting  that  California  amended  its 
 Constitution  to  make  privacy  an  inalienable  right). 
 165  In  dealing  with  issues  that  have  serious  implications  for  consumers  day-  to-  day  use  of  their  telecommunications 
 services,  such  as  the  protection  of  their  personal  information,  we  look  upon  the  states  as  partners  whose  experience  and  unique  perspective  informs  our  own.  See,  e.  g.,  In  the  Matter  of  Truth-  in-  Billing  and  Billing  Format,  First 

 Report  and  Order  and  Further  Notice  of  Proposed  Rulemaking  14  FCC  Rcd  7492,  7507-  08,  para.  26  (1999)  (  We  (continued.) 
32
 Federal  Communications  Commission  FCC  02-  214 
 33 
 decline,  therefore,  to  apply  any  presumption  that  we  will  necessarily  preempt  more  restrictive  requirements. 
 72.  Indeed,  this  approach  is  consistent  with  that  taken  in  other  Commission  proceedings  issued  subsequent  to  the  previous  CPNI  orders.  In  the  UNE  Remand  Order,  the 
 Commission  found  that  state  commissions  had  the  authority  to  impose  additional  unbundling  obligations  upon  incumbent  LECs,  beyond  those  established  by  the  Commission,  as  long  as  the 
 states  additional  obligations  meet  the  requirements  of  section  251  and  the  Commissions  analytical  framework.  166  Section  251(  d)(  3)  specifically  allows  state  commission  to  establish 
 access  and  interconnection  obligations  that  are  consistent  with  the  requirements  of  section  251.  167  The  Commission  found  that  additional  obligations  imposed  by  the  states  are  not 
 necessarily  inconsistent  with  the  statute  and  the  Commissions  rules.  Like  our  determination  today  that  our  CPNI  rules  establish  the  minimum  requirements  for  carriers,  the  Commission  in 
 the  UNE  Remand  Order  also  found  that  states  could  not  remove  unbundled  network  elements  from  the  Commissions  list.  168 

 73.  In  addition,  in  the  slamming  context,  the  Commission  acknowledged  that  while  it  may  be  simpler  for  carriers  to  comply  with  one  set  of  verification  rules,  [the  Commission 
 would  not]  interfere  with  the  states'  ability  to  adopt  more  stringent  regulations.  169  As  the  Commission  stated  in  the  Slamming  Order,  the  Commission  must  work  hand-  in-  hand  with  the 
 states  towards  the  common  goal  of  eliminating  slamming.  States  have  valuable  insight  into  the  slamming  problems  experienced  by  consumers  in  their  respective  locales  and  can  share  their 
 expertise  with  this  Commission.  170  Furthermore,  our  rules  implementing  truth-  in-  billing  requirements  for  all  common  carriers  state  that  the  requirements  [.  .  .]  are  not  intended  to 
 preempt  the  adoption  or  enforcement  of  consistent  truth-  in-  billing  requirements  by  the  states.  171 
 (Continued  from  previous  page)  look  upon  this  [.  .  .]  as  another  phase  of  our  partnership  with  the  states  to  promote  competition  and  to  combat 
 telecommunications-  related  fraud.  Through  information  sharing  and  dialogue,  we  intend  to  work  together  with  the  states  towards  the  common  objective  of  truth-  in-  billing.). 

 166  UNE  Remand  Order,  15  FCC  Rcd  3696,  3767,  para.  154  (1999),  USTA  v.  FCC,  290  F.  3d  415  (D.  C.  Cir.  2002). 
 167  47  U.  S.  C.    251(  d)(  3). 
 168  UNE  Remand  Order,  15  FCC  Rcd  at  3767,  para.  154. 
 169  Implementation  of  the  Subscriber  Carrier  Selection  Changes  Provisions  of  the  Telecommunications  Act  of  1996 
 and  Policies  and  Rules  Concerning  Unauthorized  Changes  of  Consumers  Long  Distance  Carriers,  CC  Docket  No.  94-  129,  Third  Report  and  Order  and  Second  Order  on  Reconsideration,  15  FCC  Rcd  15996,  16036,  para.  87  (rel. 

 Aug.  15,  2000)  (Slamming  Third  Report  and  Order);  Implementation  of  the  Subscriber  Carrier  Selection  Changes  Provisions  of  the  Telecommunications  Act  of  1996  and  Policies  and  Rules  Concerning  Unauthorized  Changes  of 
 Consumers  Long  Distance  Carriers,  CC  Docket  No.  94-  129,  Erratum,  DA  00-  2192  (rel.  Oct.  4,  2000);  Implementation  of  the  Subscriber  Carrier  Selection  Changes  Provisions  of  the  Telecommunications  Act  of  1996  and 
 Policies  and  Rules  Concerning  Unauthorized  Changes  of  Consumers  Long  Distance  Carriers,  CC  Docket  No.  94-  129,  Errata,  DA  00-  2163  (rel.  Sept.  25,  2000). 

 170  Slamming  Third  Report  and  Order,  15  FCC  Rcd  at  16036,  para.  87. 
 171  47  C.  F.  R.    64.  2400(  c).  See  also  Truth-  in  Billing  Order. 
33
 Federal  Communications  Commission  FCC  02-  214 
 34 
 74.  We  note  that  we  would  be  willing  to  preempt  state  requirements  in  the  event  that  numerous  different  approval  schemes  make  it  impracticable  for  carriers  to  obtain  customer 
 approval  for  the  use  of  CPNI.  Carriers  can  always  establish  that  burdens  from  state  and  federal  CPNI  regulation  are  unworkable.  By  reviewing  requests  for  preemption  on  a  case-  by-  case  basis, 
 we  will  be  able  to  make  preemption  decisions  based  on  the  factual  circumstances  as  they  exist  at  the  time  and  on  a  full  and  a  complete  record. 

 B.  Other  Approval  Issues 
 75.  In  the  foregoing  section  of  the  Order  we  adopt  today,  we  address  the  core  of  the  Tenth  Circuits  order  by  establishing  narrowly  tailored  means  of  advancing  the  privacy  interests 

 Congress  sought  to  protect  under  section  222  and,  in  doing  so,  recognize  that  harms  to  both  privacy  and  commercial  speech  interests  may  differ  depending  on  how  a  carrier  might  choose  to 
 use  CPNI.  Commenters  have  also  raised  a  variety  of  other  issues  by  petition  and  in  response  to  the  CPNI  Clarification  Order,  some  related  to  and  some  independent  from  consideration  of 
 whatever  mechanism  we  might  adopt  to  determine  whether  customers  have  granted  approval  under  section  222(  c)(  1).  Thus,  while  the  above  approval  mechanism  is  directly  responsive  to  the 
 Tenth  Circuit,  we  resolve  these  other  issues  as  set  forth  below  to  provide  the  greatest  degree  of  certainty  in  the  industry  regarding  handling  of  CPNI. 

 76.  As  an  initial  matter,  we  confirm  our  previous  determinations  that  the  Tenth  Circuit  only  vacated  the  portion  of  our  original  CPNI  Order  relating  to  the  opt-  in  mechanism  for 
 determining  customer  approval  under  section  222(  c)(  1).  Unless  otherwise  specifically  changed  by  this  Order,  the  rules  and  mechanisms  we  have  otherwise  adopted  to  implement  section  222 
 remain  in  place.  Accordingly,  we  reaffirm  our  total  service  approach,  172  which  was  originally  designed  to  define  the  limits  of  what  a  carrier  could  do  with  CPNI  without  first  obtaining  the 
 customers  approval.  We  also  clarify  the  extent  to  which  we  elect  to  grandfather  approvals  already  obtained  under  our  interim  rules.  Additionally,  we  decline  to  establish  rules  that  would 
 allow  customers  to  restrict  carriers  from  using  CPNI  regardless  of  whether  such  use  might  otherwise  be  allowed  under  the  statute,  although  we  certainly  encourage  carriers  to  continue  to 
 honor  customers  requests  in  this  respect. 
 77.  While  we  also  reaffirm  many  of  our  existing  rules  with  regard  to  the  form  and  content  of  opt-  in  or  opt-  out  notices,  we  provide  further  clarification  in  Section  III.  C  with  regard 

 to  the  form,  content,  and  frequency  of  such  notices.  As  part  of  this  clarification,  we  explain  that  carriers  using  opt-  out  notices  will  be  subject  to  specific  requirements  designed  to  ensure  that 
 such  notice  allows  a  customer  to  comprehend  and  effectively  exercise  his  or  her  approval  rights,  while  carriers  using  opt-  in  notices  will  be  subject  to  relatively  fewer  specific  requirements.  In 
 particular,  we  adopt  as  permanent  the  interim  requirement  that  carriers  using  opt-  out  must  allow  a  minimum  period  of  thirty  days  from  receipt  of  notice  to  assume  a  customers  implicit  approval 
 to  use  CPNI. 

 172  See  Section  III.  B.  2,  infra. 
34
 Federal  Communications  Commission  FCC  02-  214 
 35 
 78.  After  addressing  issues  related  to  how  customers  receive  notice  of  their  ability  to  elect  approval,  we  address  several  final  issues  relating  to  the  application  of  section  222  in 
 Section  III.  D  of  this  Order.  First,  we  forbear  from  applying  CPNI  affirmative  approval  requirements  to  the  use  of  preferred  carrier  freeze  information,  even  though  such  information  is 
 appropriately  considered  CPNI,  as  we  find  such  forbearance  to  be  required  under  section  10  of  the  Act.  Second,  we  decline  to  modify  our  CPNI  rules  to  address  several  issues  raised  by  MCI 
 WorldCom  that  are  related  to  the  use  of  CPNI  by  competitive  local  exchange  carriers.  Third,  we  reaffirm  our  conclusion  that  the  term  information  in  section  272(  c)(  1)  does  not  include  CPNI 
 as  defined  under  section  222,  and  we  explicitly  hold  that  this  conclusion  is  not  impacted  by  the  opt-  in/  opt-  out  mechanism  we  adopt  today. 

 1.  The  Tenth  Circuits  Order  Vacated  Only  Those  CPNI  Rules  Related  to  Opt-  In 
 79.  We  affirm  our  previous  determinations  that  the  Tenth  Circuit  vacated  only  the  specific  portion  of  our  CPNI  rules  relating  to  the  opt-  in  mechanism.  173  As  the  Commission 
 noted  in  seeking  comment  in  the  Clarification  Order  Further  NRPM,  the  Tenth  Circuits  order  was  subject  to  interpretation  as  to  whether  it  vacated  the  entirety  of  the  CPNI  rules  or  just  those 
 related  to  the  opt-  in  requirement.  174  However,  as  we  have  twice  previously  held,  substantial  portions  of  the  Commissions  CPNI  rules  were  not  relevant  to  the  issue  before  the  court  and  were 
 beyond  the  scope  of  the  courts  constitutional  analysis.  175 
 80.  In  AT&  T  v.  New  York  Telephone,  d/  b/  a  Bell  Atlantic    New  York  176  and  in  the  CPNI  Clarification  Order,  the  Commission  determined  that  the  courts  opinion  in  U  S  WEST  v. 

 173  CPNI  Clarification  Order,  16  FCC  Rcd  at  16512,  para.  13. 
 174  CPNI  Clarification  Order,  16  FCC  Rcd  at  16512,  para.  13.  See  also  USTA  Comments  at  16  ([  t]  he  fact  that 
 the  Tenth  Circuit  vacated  the  CPNI  Order  raises  a  question  as  to  which  of  the  Commissions  rules,  if  any,  survived  the  Tenth  Circuits  ruling);  ALLTEL  Comments  at  3  (  ALLTEL  believes  that  there  remain  serious  questions  as  to 

 the  extent  of  the  Courts  order  and  its  effect  ultimately  on  the  vitality  of  the  Commissions  CPNI  rules  in  their  entirety.);  NTCA  Comments  at  2  ([  i]  n  reaching  a  conclusion,  the  Commission  must  consider  the  Tenth  Circuits 
 opinion  that  vacated  at  least  a  portion  of  the  Commissions  CPNI  rules). 
 175  To  the  degree  that  such  action  is  necessary,  we  grant  USTAs  request  that  we  remove  any  uncertainty  as  to  all 
 matters  previously  addressed  in  [the]  CPNI  Order  and  Order  on  Reconsideration  (USTA  Comments  at  16)  and  formally  readopt  all  previously  adopted  CPNI  rules  not  related  to  opt-  in  or  otherwise  amended  in  this  Order.  See 

 also  Verizon  Wireless  Reply  Comments  at  7  (  If  the  Commission  determines  that  it  must  take  further  action  to  maintain  these  other  aspects  of  its  CPNI  policy,  it  should  re-  adopt  the  rules  and  policies  contained  in  the  [CPNI 
 Reconsideration  Order]  in  the  instant  rulemaking  proceeding.).  To  allay  any  concerns  regarding  the  status  of  our  rules  unrelated  to  opt-  in  after  U  S  WEST  v.  FCC,  we  herein  formally  readopt  the  relevant  reasoning  and  rules 
 adopted  in  the  CPNI  Order  and  CPNI  Reconsideration  Order.  To  the  degree  that  rules  or  reasoning  related  directly  to  the  opt-  in  provisions  of  our  previous  orders,  this  Order  will  supplement  any  such  reasoning. 

 176  AT&  T  Corp.,  v.  New  York  Telephone  Company,  d/  b/  a  Bell  Atlantic    New  York,  15  FCC  Rcd  19997,  20004, 
 para.  17  (2000)  (AT&  T  v.  Bell  Atlantic  Order)  (concluding  in  the  context  of  a  formal  complaint  regarding  certain  CPNI  issues,  that  when  read  in  context,  the  [Tenth  Circuits]  vacatur  order  related  only  to  the  discrete  portions  of 

 the  order  and  rules  that  were  before  the  court  in  light  of  the  parties  petitions  for  review  and  were  addressed  by  the  court.). 
35
 Federal  Communications  Commission  FCC  02-  214 
 36 
 FCC  analyzed  only  the  constitutionality  of  the  Commissions  establishment  of  the  opt-  in  regime  as  its  interpretation  of  the  customer  approval  requirement  of  section  222(  c)(  1).  The  Commission 
 determined  that  the  courts  vacatur  order  applied  only  to  the  discrete  portions  of  the  CPNI  Order  and  rules  requiring  opt-  in  customer  approval,  which  were  the  specific  issues  before  the  court.  177 
 The  Commission  concluded  that  the  remainder  of  the  CPNI  rules  remain  in  effect. 
 81.  As  we  found  in  our  previous  orders,  we  find  no  compelling  evidence  to  convince  us  that  the  court  intended  to  take  the  unusual  step  of  vacating  portions  of  the  order  and  rules  not 

 before  it  178  without  so  stating  explicitly,  despite  the  fact  that  the  courts  mandate  is  worded  quite  broadly.  179  A  number  of  commenters  in  the  instant  proceeding  support  the  Commissions 
 determination,  agreeing  that  the  [Tenth]  Circuit  vacated  the  portion  of  the  CPNI  order  and  regulations  relating  to  customer  opt-  in  as  a  violation  of  the  First  Amendment.  180  A  few 
 commenters  argue  that  our  previous  determinations  were  erroneous  and  that  U  S  WEST  v.  FCC  did,  in  fact,  vacate  all  of  the  Commissions  CPNI  rules.  181  However,  beyond  pointing  to  the 
 broad  language  of  the  courts  mandate,  which  exceeds  the  scope  of  the  question  presented  to  the  court,  these  commenters  present  no  new  compelling  argument  that  we  have  not  already 
 considered,  and  thus  fail  to  convince  us  that  the  court  intended  to  take  the  unusual  step  of  vacating  rules  not  before  it. 

 82.  We  also  reject  arguments  that  simply  by  seeking  comment  on  our  notice  rules,  we  have  somehow  undermined  our  holding.  182  We  sought  further  comment  in  the  CPNI 
 Clarification  Order  without  assuming  any  specific  outcome,  and  effective  administration  requires  us  to  periodically  review  regulatory  requirements  to  ensure  that  they  remain  valid  in 

 177  CPNI  Clarification  Order,  16  FCC  Rcd  at  16510,  para.  7. 
 178  Id. 
 179  Accordingly,  we  VACATE  the  FCCs  CPNI  Order  and  the  regulations  adopted  therein.  U  S  WEST,  182  F.  3d 
 at  1240. 
 180  EPIC  et  al.  Comments  at  2.  See  also,  NAAG  Dec.  21,  2001  Ex  Parte  Letter  at  3  (The  Tenth  Circuit  vacated 
 the  portion  of  the  Commissions  CPNI  order  and  regulations  that  required  customer  opt-  in  before  carriers  could  use  the  information  outside  of  one  of  the  statutory  exceptions.);  OPASTCO  Comments  at  3  (  Specifically,  the  Court 

 vacated  the  Commissions  notice  and  opt-  in  requirement  before  a  carrier  may  use  CPNI  to  market  services  outside  the  customers  existing  service  relationship  with  that  carrier.)  (citation  omitted);  Direct  Marketing  Association 
 Comments  at  2,  n.  1  (  The  courts  decision,  however,  makes  plain  that  any  of  the  subparts  of  the  rule  that  entail  opt-in  are  invalid.).  See  also  AT&  T  Wireless  Comments  at  3,  n.  5;  California  Public  Utilities  Commission  Comments 
 at  3;  National  Association  of  Regulatory  Utility  Commissioners  Comments  at  1;  Letter  from  Pam  Whittington,  Public  Utility  Commission  of  Texas,  to  William  Caton,  Acting  Secretary,  Federal  Communications  Commission, 
 CC  Docket  Nos.  96-  115  and  96-  149  (filed  March  1,  2002)  (Texas  PUC  March  1,  2002  Ex  Parte  Letter)  at  1. 
 181  See  CTIA  Comments  at  2-  6  (  However,  the  court  did  not  simply  vacate  the  specific  opt-  in  method  of  customer 
 approval,  it  vacated  the  entire  section  64.  2007  rulemaking  as  constitutionally  inadequate,  failing  all  three  prongs  of  Central  Hudson.);  AT&  T  Reply  Comments  at  11  (  The  Tenth  Circuit  expressly  vacated  the  entire  order,  including 

 the  discussion  of  section  272.).  See  also  ASCENT  Comments  at  8. 
 182  CTIA  Comments  at  4. 
36
 Federal  Communications  Commission  FCC  02-  214 
 37 
 light  of  experience  and  changed  circumstances  over  time.  183  In  any  event,  the  CPNI  Clarification  Order  posed  questions  that  were  broader  than  the  courts  vacatur,  and  thus  interested  parties 
 were  provided  notice  of  our  intention  to  consider  aspects  of  our  rules  beyond  those  impacted  by  U  S  WEST.  The  rules  we  adopt  in  this  Order  are  consistent  with  the  scope  of  the  issues  presented 
 in  the  CPNI  Clarification  Order. 
 2.  Total  Service  Approach 
 83.  We  affirm  the  continued  use  of  the  total  service  approach  to  define  what  carriers  may  do  under  section  222(  c)(  1)  without  notice  to  customers.  184  Based  on  the  language  of  section 

 222(  c)(  1),  Congress  intended  that  a  carrier  could  use  CPNI  without  customer  approval,  but  could  only  do  so  depending  on  the  service(  s)  to  which  the  customer  subscribes.  185  The  total  service 
 approach  defines  the  parameters  of  those  services  and  thus  defines  what  carriers  may  do  without  the  approval  of  the  customer. 

 84.  In  reaching  our  conclusion,  we  note  that  every  commenter  that  addressed  this  issue  save  one  186  supports  retaining  the  total  service  approach,  187  largely  because  the  original 
 justification  for  its  adoption  remains  valid  even  if  an  opt-  out  system  is  applied  to  some  uses  of  CPNI.  Accordingly,  today,  as  when  we  originally  adopted  it,  the  total  service  approach  is  a 
 reasonable  implementation  of  section  222(  c)(  1)  and  remains  reasonable  regardless  of  the  mechanism  we  adopt  in  this  Order  to  provide  for  customer  approval  of  other  uses  of  CPNI.  We 
 also  note  that  no  better  alternative  has  been  proposed.  The  sole  commenter  to  question  the 
 183  See,  e.  g.,  Review  of  Section  251  Unbundling  Obligations  of  Incumbent  Local  Exchange  Carriers; 
 Implementation  of  the  Local  Competition  Provisions  of  the  Telecommunications  Act  of  1996;  Deployment  of  Wireline  Services  Offering  Advanced  Telecommunications  Capability,  Notice  of  Proposed  Rulemaking,  16  FCC  Rcd 

 22781,  22782  (2001)  (Triennial  Review)  at  para.  1  (  We  seek  to  ensure  that  our  regulatory  framework  remains  current  and  faithful  to  the  pro-  competitive,  market-  opening  provisions  of  the  1996  Act  in  light  of  our  experience 
 over  the  last  two  years,  advances  in  technology,  and  other  developments  in  the  markets  for  telecommunications  services.). 

 184  Section  222(  c)(  1)  provides  that,  except  with  the  approval  of  the  customer,  a  telecommunications  carrier  that 
 receives  or  obtains  CPNI  by  virtue  of  its  provision  of  a  telecommunications  service  shall  only  use,  disclose,  or  permit  access  to  individually  identifiable  [CPNI]  in  the  provision  of  (A)  the  telecommunications  service  from  which 

 such  information  is  derived,  or  (B)  services  necessary  to,  or  used  in,  the  provision  of  such  telecommunications  service,  including  the  publication  of  directories. 

 185  CPNI  Order,  13  FCC  Rcd  at  8080,  8083-  84,  8087-  88,  paras.  23-  24,  30,  35.  See  also  CPNI  Reconsideration 
 Order,  14  FCC  Rcd  at  14421,  para.  17. 
 186  See  CenturyTel  Comments  at  11-  12. 

 187  Nextel  Comments  at  7,  n.  18  (  Adoption  of  a  notice  and  opt-  out  approach  does  not  require  any  modification  to 
 the  Commissions  total  service  approach,  because  the  notice  and  opt-  out  framework  in  no  way  should  affect  the  efficiency  benefits  to  customers  from  the  total  service  approach.);  Verizon  Wireless  Comments  at  15  ([  t]  he 

 Commissions  [total  service  approach]  policy  should  be  unaffected  by  adoption  of  a  notice  and  opt-  out  mechanism    the  [total  service  approach]  was  premised  on  the  finding  that  customers  fully  expect  a  carrier  to  use  CPNI  to 
 market  services  to  them  that  are  within  the  bounds  of  the  existing  carrier-  customer  relationship.).  See  also  AT&  T  Comments  at  11;  AT&  T  Wireless  Comments  at  9-  11;  Cingular  Wireless  Comments  at  7-  8;  Verizon  Comments  at 
 12. 
37
 Federal  Communications  Commission  FCC  02-  214 
 38 
 approach,  CenturyTel,  basically  requests  that  we  abandon  the  total  service  approach  and  instead  adopt  the  single  category  approach.  188  The  single  category  approach  was  considered  and 
 rejected  in  the  CPNI  Order  and  again  rejected  in  the  CPNI  Reconsideration  Order.  189  We  again  decline  to  adopt  such  an  approach  because  that  would  vitiate  the  total  service  approach  and 
 attendant  protection  of  customers  personal  information.  As  the  Commission  has  stated,  [  t]  he  hallmark  of  the  total  service  approach  is  that  the  customer,  whose  privacy  is  at  issue,  establishes 
 the  bounds  of  his  or  her  relationship  with  the  carrier.  190  CenturyTel  has  provided  no  new  evidence  to  convince  us  to  reconsider  the  total  service  approach  and  the  benefits  and  protections 
 it  affords  to  consumers  and  carriers  alike.  Finally,  in  the  absence  of  comments  indicating  that  the  total  service  approach  is  undermined  by  our  CPE  bundling  rules,  we  find  no  reason  to  modify 
 our  interpretation  of  section  222(  c)(  1)  or  the  total  service  approach  at  this  time.  191 
 3.  Grandfathering  of  Previously  Obtained  CPNI  Approvals 
 85.  We  allow  carriers  to  continue  to  use  CPNI  approvals  previously  received  from  customers  based  on  our  interim  rules  with  the  following  limitations.  Carriers  cannot  use  or 

 disclose  CPNI  in  ways  that  require  opt-  in  under  the  rules  we  adopt  herein  (e.  g.,  third  party  disclosure)  without  first  obtaining  opt-  in  approval.  192  Accordingly,  carriers  that  obtained  opt-  in 
 approval  prior  to  U  S  WEST,  or  carriers  that  voluntarily  obtained  opt-  in  approval  during  the  period  since  U  S  WEST,  where  the  other  requirements  of  our  rules  were  met,  can  continue  to  use 
 those  approvals.  However,  carriers  that  provided  opt-  out  notices  can  only  use  customers  opt-  out  approval  for  marketing  of  communications-  related  services  by  carriers,  their  affiliates  that 
 provide  communications-  related  services,  and  carriers  agents,  joint  venture  partners  and  independent  contractors. 

 4.  Customer  Right  to  Restrict  Carrier  Use  of  CPNI  for  Marketing  Purposes 
 86.  In  the  CPNI  Order  Further  NPRM,  the  Commission  sought  comment  on  whether  customers  should  be  able  to  restrict  a  telecommunications  carrier  from  using,  disclosing  or 
 permitting  access  to  CPNI,  regardless  of  whether  the  use  might  otherwise  be  allowed  under 
 188  The  single  category  approach  would  have  permitted  carriers  to  use  CPNI  obtained  from  the  provision  of  any 
 telecommunications  service,  including  local  or  long  distance  or  CMRS,  to  market  any  other  service  offered  by  the  carrier,  regardless  of  whether  the  customer  subscribes  to  such  service  from  that  carrier.  CPNI  Reconsideration 

 Order,  14  FCC  Rcd  at  14421,  para.  18. 
 189  CPNI  Order,  13  FCC  Rcd  at  8083,  8085-  8091,  paras.  29,  33,  39.  CPNI  Reconsideration  Order,  14  FCC  Rcd  at 
 14421-  14422,  paras.  19-  20. 
 190  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14422,  para.  19. 

 191  In  the  CPNI  Clarification  Order  the  Commission  sought  comment  as  to  whether  the  issues  raised  in  the 
 Computer  II  proceeding  should  affect  the  interpretation  of  section  222(  c)(  1).  16  FCC  Rcd  at  16516,  para.  21. 
 192  Carriers  were  on  notice  that  such  a  determination  was  a  real  possibility.  See  CPNI  Clarification  Order,  16  FCC 
 Rcd  at  16510,  para.  8  (  Specifically,  pending  resolution  of  this  docket,  carriers  may  proceed  to  obtain  consent  consistent  with  the  notification  requirements  in  Section  64.  2007(  f),  using  an  opt-  out  mechanism  or,  should  they 

 choose  to  do  so,  an  opt-  in  mechanism)  (emphasis  added). 
38
 Federal  Communications  Commission  FCC  02-  214 
 39 
 sections  222(  c)(  1)(  A)  and  (B).  193  We  find  that  such  a  restriction  is  not  warranted  under  section  222,  consistent  with  the  Tenth  Circuits  decision,  or  currently  necessary  to  protect  customer 
 privacy. 
 87.  Section  222  does  not  specifically  address  whether  customers  can  restrict  a  telecommunications  carrier  from  using,  disclosing  or  permitting  access  to  CPNI  within  the 

 circumstances  defined  in  sections  222(  c)(  1)(  A)  and  (B).  194  If  section  222  allowed  customers  to  do  so,  customers  could  prevent  carriers  from  using  CPNI  for  all  marketing  purposes,  even  if  the 
 marketing  was  within  the  carriers  total  service  offering.  However,  as  we  have  noted  previously,  section  222  balances  principles  of  privacy  and  competition  in  connection  with  the  use  and 
 disclosure  of  CPNI  and  other  customer  information.  195  Therefore,  where  the  statute  is  silent,  we  weigh  both  of  these  interests.  Most  commenters  urged  the  Commission  not  to  adopt  additional 
 restrictions,  arguing  that  such  restrictions  would  be  broader  than  that  required  by  section  222  and  would  disallow  carriers  from  engaging  in  the  behavior  necessary  and  appropriate  in  the  provision 
 of  telecommunications  services.  196  While  we  do  not  explicitly  endorse  this  view,  we  must  take  notice  of  the  fact  that  the  Tenth  Circuits  recognition  of  a  carriers  right  to  use  CPNI  to  engage  in 
 protected  commercial  speech  strongly  counsels  against  imposing  additional  restrictions.  While  section  222  imposes  requirements  to  obtain  approval  for  the  use  of  CPNI  under  certain 
 circumstances,  and  thus  explicitly  recognizes  the  interest  of  consumers  in  keeping  this  information  private,  the  Tenth  Circuit  has  also  made  clear  that  restrictions  on  the  use  of  CPNI 
 must  be  narrowly  tailored.  197  A  broad  customer  right  to  prevent  any  use  of  CPNI  regardless  of  the  uses  allowed  under  section  222  would  appear,  on  its  face,  to  fail  the  Tenth  Circuits 
 requirement. 
 88.  At  any  rate,  as  several  commenters  noted,  adding  a  new  rule  allowing  customers  to  restrict  a  carriers  use  of  CPNI  for  all  marketing  purposes  would  do  little  to  further  the  goal  of 

 protecting  consumers  privacy.  198  Commenters  argue  that  mechanisms  allowing  customers  to  limit  unwanted  marketing  solicitations  already  exist  in  the  form  of  do-  not-  call  or  do-  not-  contact 

 193  CPNI  Order,  13  FCC  Rcd  at  8200-  8201,  paras.  204-  205. 
 194  Id. 
 195  CPNI  Order,  13  FCC  Rcd  at  8073,  para.  14. 
 196  Omnipoint  March  30,  1998  Comments  at  2  ([  t]  o  add  to  this  regime  an  opt-  out  requirement  for  CPNI  within  the 
 total  service  offering  would  be  contrary  to  the  structure  of  the  statute).  See  also  AT&  T  March  30,  1998  Comments  at  1-  8;  Bell  Atlantic  March  30,  1998  Comments  at  1-  3;  BellSouth  March  30,  1998  Comments  at  1-  4;  GTE  March 

 30,  1998  Comments  at  2-  4;  Intermedia  March  30,  1998  Comments  at  3-  7;  MCI  March  30,  1998  Comments  at  2-  6;  SBC  March  30,  1998  Comments  at  1-  8;  Sprint  March  30,  1998  Comments  at  1-  5;  USTA  March  30,  1998  Comments 
 at  2-  4;  U  S  WEST  March  30,  1998  Comments  at  2-  5;  Vanguard  March  30,  1998  Comments  at  3-  6.  Although  the  comments  we  received  applied  to  our  previously  adopted  approval  regime  (opt-  in),  the  arguments  made  by 
 commenters  continue  to  have  force  under  the  rules  we  adopt  in  this  Order. 
 197  U  S  WEST,  183  F.  3d  at  1238. 

 198  Bell  Atlantic  March  30,  1998,  Comments  at  2. 
39
 Federal  Communications  Commission  FCC  02-  214 
 40 
 lists  kept  by  the  carrier.  199  The  Telephone  Consumer  Protection  Act  and  subsequent  regulations  require  carriers  to  maintain  and  honor  lists  of  consumers  who  have  requested  that  they  not 
 receive  telephone  solicitations.  200  Coupled  with  section  222  and  our  CPNI  rules,  these  mechanisms  appear  to  provide  safeguards  that  consumers  who  do  not  want  to  receive 
 telemarketing  or  other  unwanted  marketing  contacts  can  affirmatively  remove  themselves  from  carriers  marketing  lists.  201  We  also  recognize  that  additional  regulations  often  require  a  financial 
 and  time  commitment  from  carriers  to  implement  new  rules.  Here,  any  such  costs  would  not  be  justified  by  the  incidental  additional  privacy  protection  further  CPNI  restrictions  would  afford 
 consumers.  202  We  decline  to  read  section  222s  ambiguity  in  this  respect  to  allow  such  a  broad  restriction.  Nevertheless,  we  approve  of  voluntary  mechanisms  that  keep  consumers 
 information  confidential,  and  encourage  carriers  to  continue  to  respect  the  privacy  interests  of  their  customers  by  using  them.  203 

 C.  Customer  Notification  Requirements 
 89.  In  this  Order  we  largely  affirm  our  previous  notice  rules,  204  which  specify,  inter  alia,  that  a  carriers  notification  must  be  comprehensible  and  must  not  be  misleading,  and  that 

 written  notices  must  be  clearly  legible,  use  sufficiently  large  type,  and  be  placed  in  an  area  so  as  to  be  readily  apparent  to  a  customer.  205  A  telecommunications  carriers  solicitation  for  approval 
 must  also  be  proximate  to  the  notification  of  a  customers  CPNI  rights.  206  Failure  to  comply  with  these  rules  will  subject  carriers  to  appropriate  enforcement  action  by  the  Commission.  This 
 Order  also  makes  changes  to  the  notice  rules  based  on  industry  experience  since  their  adoption,  as  well  as  some  changes  that  are  necessary  to  synchronize  the  notice  requirements  with  the 
 approval  methods  we  adopt  herein.  Specifically,  with  respect  to  opt-  in  notices,  we  allow  carriers 

 199  Among  those  carriers  noting  that  they  had  such  lists  were  GTE  and  Bell  Atlantic.  Bell  Atlantic  March  30,  1998 
 Comments  at  3;  GTE  March  30,  1998  Comments  at  3. 
 200  47  U.  S.  C.    227(  c)(  1)(  A);  47  U.  S.  C.    64.  1200(  e)(  2). 

 201  The  record  does  not  indicate  that  these  mechanisms  are  ineffective. 
 202  Intermedia  March  30,  1998  Comments  at  5-  6. 
 203  We  note  that  some  financial  institutions  have  marketed  the  fact  that  they  have  voluntarily  adopted  privacy 
 protections  that  exceed  that  which  is  required  under  Gramm-  Leach-  Bliley.  We  welcome  such  efforts  to  further  educate  consumers  of  their  privacy  choices  regarding  CPNI  and  encourage  carriers  to  undertake  such  actions. 

 204  Many  commenters  support  our  continued  use  of  the  existing  notice  rules.  Verizon  Wireless  Reply  Comments  at 
 4  (  With  the  addition  of  a  thirty-  day  opt-  out  period  following  notice,  the  Commissions  existing  notice  rules  will  sufficient  [sic]  to  ensure  knowing,  informed  approval.);  Worldcom  Reply  Comments  at  3  (  The  Commissions 

 current  rules  already  outline  specific  requirements  on  customer  notification,  including  the  provision  of  sufficient  information  that  is  comprehensible  and  not  misleading.).  See  also  Verizon  Comments  at  13;  Verizon  Reply 
 Comments  at  8.  A  few,  however,  urge  the  Commission  to  adopt  general  principles  or  guidelines  and  allow  carriers  to  determine  how  to  implement  those  guidelines.  See  SBC  Comments  at  15. 

 205  See  Appendix  B,  47  C.  F.  R.    64.  2008(  c)(  4)-(  c)(  5). 
 206  See  Appendix  B,  47  C.  F.  R.    64.  2008(  c)(  10). 
40
 Federal  Communications  Commission  FCC  02-  214 
 41 
 more  flexibility  to  determine  what  type  of  notices  best  suit  their  customers  needs,  and  with  respect  to  opt-  out,  we  adopt  more  stringent  notice  requirements  to  ensure  that  customers  are  in  a 
 position  to  comprehend  their  choices  and  express  their  preferences  regarding  the  use  of  their  CPNI.  In  addition,  we  allow  carriers  to  choose  whether  to  use  an  opt-  in  or  opt-  out  method  for 
 obtaining  customer  approval  for  carriers  and  their  affiliates  to  use  CPNI  to  market  communications-  related  services.  207  We  recognize,  as  SBC  points  out,  that  different  types  of 
 customer  relationships  may  be  better  suited  to  different  types  of  notice  and  approval  methods.  208 
 1.  Form  of  Notice 
 90.  We  continue  to  allow  carriers  to  use  written,  electronic,  and  oral  notice  to  customers  when  soliciting  opt-  in  approval.  However,  except  as  described  below,  we  require 

 carriers  to  provide  some  type  of  individual  209  tangible  notice  (written  or  electronic)  to  customers  when  soliciting  opt-  out  approval.  We  continue  to  allow  carriers  to  use  oral  notice  to  obtain 
 limited,  one-  time  use  of  CPNI,  whether  opt-  in  or  opt-  out.  210 
 91.  In  addition,  we  allow  carriers  the  flexibility  to  provide  combined  opt-  out  and  opt-in  notices  or  to  provide  such  notices  separately,  at  individual  carriers  discretion.  Accordingly,  a 

 carrier  seeking  approval  to  use  CPNI  internally  and  to  share  with  third  parties  could  combine  notice  for  opt-  out  and  opt-  in  CPNI  uses  on  one  notification,  so  long  as  it  complies  with  our 
 notice  rules.  Alternatively,  we  allow  carriers  that  prefer  to  do  so  to  provide  separate  notices  to  customers  seeking  different  types  (opt-  in  or  opt-  out)  of  CPNI  approval.  Of  course,  carriers  may 
 choose  to  use  opt-  in  for  all  CPNI  uses,  in  which  case  a  carrier  making  such  an  election  can  provide  a  single  notice  to  its  customers.  Finally,  we  allow  carriers  to  provide  notice  based  on  the 
 CPNI  usage  approvals  they  seek  to  obtain.  Accordingly,  a  carrier  that  does  not  intend  to  disclose  CPNI  to  third  parties  or  affiliates  that  do  not  provide  communications-  related  services  does  not 
 need  to  provide  to  its  customers  notice  regarding  opt-  in.  Carriers  that  do  not  intend  to  use  CPNI  outside  of  the  total  service  approach  do  not  need  to  provide  notice  to  their  customers  at  all. 

 207  For  this  purpose,  we  also  allow  carriers  to  choose  whether  to  use  opt-  in  or  opt-  out  on  an  individual  customer 
 basis.  However,  we  caution  carriers  that  the  Acts  prohibition  against  unjust  or  unreasonable  discrimination  in  charges,  practices,  classifications,  regulations,  facilities  or  services  applies  to  CPNI  practices.  47  U.  S.  C.    202(  a). 

 We  note  that,  as  a  general  matter,  a  carrier  can  certainly  elect  to  use  opt-  in  to  obtain  customer  approval  of  the  use  of  CPNI  by  a  carrier  and  its  affiliates  for  marketing  communications-  related  services,  even  though  we  have  explicitly 
 permitted  carriers  to  use  the  relatively  less  burdensome  alternative  of  opt-  out.  Thus,  we  leave  to  carriers  the  decision  as  to  which  approval  method  to  use,  and  do  not  prohibit  them  from  using  opt-  in  even  if  they  are  not 
 required  to  do  so. 
 208  SBC  Comments  at  15.  See  also  AT&  T  Comments  at  3,  n.  1;  NTCA  Comments  at  2. 

 209  By  individual,  we  mean  that  carriers  must  provide  notice  to  each  customer  from  which  it  seeks  consent  to  use 
 CPNI.  Broadcast  notice  methods  such  as  newspaper  publication  will  not  satisfy  our  requirements. 
 210  The  method  of  one-  time  approval  will  depend  on  whether  the  use  qualifies  for  the  opt-  out  method  under  our 
 rules    as  in  the  case  of  an  inbound  customer  inquiry  to  a  carrier.  Uses  that  would  not  qualify  for  the  opt-  out    for  example,  a  cold  call  by  a  competitor  seeking  access  to  the  customers  CPNI    will  require  that  the  carrier  obtain  opt-in 

 approval  for  the  duration  of  the  call.  However,  as  we  discuss  in  section  III.  C.  2.  a,  we  allow  carriers  to  provide  abbreviated  notice  to  obtain  CPNI  approval  for  limited  duration,  one-  time  CPNI  approval. 
41
 Federal  Communications  Commission  FCC  02-  214 
 42 
 a.  Electronic  Notice 
 92.  We  allow  carriers  to  provide  CPNI  notices  to  customers  through  the  use  of  e-  mail  or  other  electronic  formats,  211  such  as  a  website,  as  urged  by  some  commenters.  212  However,  we 

 recognize  that  consumers  are  deluged  with  unrequested  or  unwanted  commercial  e-  mail  (  spam)  and  could  easily  overlook  a  notice  provided  via  e-  mail.  Accordingly,  we  require 
 carriers  to  follow  certain  precautions  to  ensure  that  such  notices  will  not  be  mistaken  as  spam.  Such  requirements  directly  and  materially  advance  our  goal  of  ensuring  that  consumers  have  the 
 information  necessary  to  make  informed  decisions  regarding  the  use  of  their  personal  information. 

 93.  We  require  carriers  that  use  e-  mail  to  provide  opt-  out  notices  to  obtain  express,  verifiable,  prior  approval  from  consumers  to  send  notices  via  e-  mail  regarding  their  service  in 
 general,  or  CPNI  in  particular.  213  In  addition,  we  require  carriers  to  allow  consumers  to  reply  directly  to  e-  mails  containing  CPNI  notices  in  order  to  opt-  out.  We  also  encourage  carriers  who 
 elect  to  use  e-  mail  for  opt-  in  notices  to  accept  replies,  but,  because  we  do  not  think  it  is  necessary  to  ensure  consumers  privacy  choices  are  honored,  we  do  not  so  mandate.  Further,  we  require 
 that  opt-  out  e-  mail  notices  which  are  returned  to  the  carrier  as  undeliverable  be  sent  to  the  customer  in  another  form  before  carriers  may  consider  the  consumer  to  have  opted-  out.  Finally, 
 we  require  carriers  that  use  e-  mail  to  send  CPNI  notices  to  ensure  that  the  subject  line  of  the  message  clearly  and  accurately  identifies  the  subject  matter  of  the  e-  mail. 

 94.  Carriers  that  elect  to  use  other  forms  of  electronic  notice,  such  as  notice  provided  on  a  website  during  the  carrier  selection  process,  are  cautioned  that,  similar  to  our  warning  on  the 
 shrinkwrap/  break-  the-  seal  approach  in  the  next  section,  such  notice  must  comply  with  our  form  requirements  (e.  g.,  placement  so  as  to  be  readily  apparent  to  the  customer).  In  particular,  we 
 likely  would  not  consider  a  CPNI  notice  that  was  combined  with  other  legal  terms  and  conditions,  or  other  privacy  information,  to  comply  with  our  rules  if  the  customer  were  deemed 
 to  have  opted-  in  or  opted-  out  simply  by  signing  up  for  service. 
 b.  Shrinkwrap  or  Break-  the-  Seal  Notice 
 95.  Commenters  raise  the  issue  of  shrinkwrap  or  break-  the-  seal  agreements,  214  and 

 211  We  note  that  carriers  who  use  electronic  notice  methods  must  abide  by  our  generally  applicable  notice  rules  and 
 safeguards  (i.  e.,  record  retention  for  at  least  one  year,  47  C.  F.  R.    64.  2008(  a)(  2)),  as  well  as  the  rules  specifically  applicable  to  electronic  notice. 

 212  CTIA  Comments  at  11;  Verizon  Reply  Comments  at  8. 
 213  In  addition,  carriers  must  have  procedures  in  place  to  allow  consumers  to:  (1)  discontinue  receiving 
 information  via  e-  mail,  and  (2)  update  their  e-  mail  addresses. 
 214  The  shrinkwrap  license  gets  its  name  from  the  fact  that  .  .  .  packages  are  covered  in  plastic  or  cellophane 
 shrinkwrap  and  some  vendors  .  .  .  have  written  licenses  that  become  effective  as  soon  as  the  customer  tears  the  wrapping  from  the  package.  ProCD,  Inc.  v.  Zeidenberg,  86  F.  3d  1447,  1449  (7  th  Cir.  1996). 
42
 Federal  Communications  Commission  FCC  02-  214 
 43 
 whether  such  agreements  constitute  effective  solicitation  of  approval  under  section  222(  c)(  1).  215  While  we  decline  to  adopt  more  stringent  notice  requirements  at  this  time,  we  confirm  that  all  of 
 the  existing  notice  requirements  generally  applicable  under  section  222  apply  equally  when  a  carrier  solicits  customer  approval  through  shrinkwrap  or  break-  the-  seal  methods.  As  a  threshold 
 matter,  we  note  that  the  distinctions  between  notice  of  a  customers  rights,  solicitation  for  approval  to  use  CPNI,  and  the  approval  process  sometimes  become  blurred.  216  In  fact, 
 shrinkwrap  or  break-  the-  seal  approval  notice  implicates  all  three  areas  of  our  rules.  Using  a  shrinkwrap  or  break-  the-  seal  approach,  a  carrier  217  purports  to  provide  notice  of  customers 
 CPNI  rights  to  the  customer    usually  in  connection  with  other  terms  and  conditions  of  service    and  claims  to  solicit  consumers  approval  for  CPNI  use  and  disclosure  by  asserting  that  by 
 using  the  service  or  breaking-  the-  seal  (as  in  the  case  of  a  cellular  phone),  the  consumer  has  approved  use  and  disclosure  of  his  CPNI.  Some  shrinkwrap/  break-  the-  seal  approaches  offer  the 
 consumer  an  opportunity  to  take  some  action  regarding  his  CPNI,  218  while  some  do  not. 
 96.  We  are  concerned  that  the  shrinkwrap/  break-  the-  seal  notices  as  they  have  been  described  to  us  are  ineffective  and  may  not  comply  with  either  the  letter  or  spirit  of  our  notice 

 rules.  However,  in  the  absence  of  specific  concerns  on  this  record  of  abuse  of  these  types  of  agreements,  we  do  not  find  that  additional  restrictions  beyond  generally  applicable  notice 
 requirements  are  warranted  at  this  time.  Nevertheless,  we  caution  carriers  that  abuse  of  shrinkwrap  or  break-  the-  seal  approaches  will  cause  us  to  reexamine  this  question  or  initiate 
 enforcement  action. 
 2.  Content  of  Notice 
 97.  We  largely  affirm  our  previously  adopted  content  rules  with  a  few  changes.  219  First,  we  allow  carriers  to  obtain  one-  time  limited  use  CPNI  approval  using  a  streamlined  notice. 

 Second,  as  discussed  in  more  detail  below,  we  require  carriers  to  provide  opt-  out  notices  to  their  customers  every  two  years.  Accordingly,  we  require  carriers  to  advise  customers  that  if  they 
 have  opted  out  previously,  no  action  is  needed  to  maintain  the  opt-  out  election.  However,  consumers  who  wish  to  reverse  their  previous  decision  to  opt-  out,  or  consumers  who  have  not 

 215  The  commenters  who  raise  the  issue  generally  assume  or  argue  that  shrinkwrap  or  break-  the-  seal  approval  is  an 
 acceptable  notice  method.  See  CTIA  Comments  at  14;  Verizon  Wireless  Reply  Comments  at  4,  n.  7. 
 216  Prior  to  seeking  customer  approval  .  .  .  carriers  must  provide  a  one-  time  notification  to  the  customer  of  her  or 
 his  rights  to  restrict  the  use  or  disclosure  of,  and  access  to,  her  or  his  CPNI  .  .  .  .  Once  a  customer  is  notified  of  her  or  his  rights,  the  carrier  may  undertake  a  solicitation  of  the  customers  approval.  CPNI  Reconsideration  Order,  14 

 FCC  Rcd  at  14462,  para.  103. 
 217  We  note  that  this  type  of  notice  has  generally  been  discussed  in  connection  with  wireless  carriers.  However, 
 this  section  applies  to  all  telecommunications  carriers  and  to  any  type  of  notice  that  operates  like  shrinkwrap  or  break-  the-  seal  notice. 

 218  We  note  that  an  agreement  that  amounted  to  a  customer  providing  opt-  in  approval  by  his  or  her  action  of 
 accepting  or  using  service  may  be  titled  opt-  in  by  the  carrier,  but  would  likely  operate  as  negative  approval  or  opt-out  approval    and  might  not  satisfy  our  other  notice  requirements. 

 219  See  Appendix  B. 
43
 Federal  Communications  Commission  FCC  02-  214 
 46 
 while  Verizon,  BellSouth,  GTE,  and  SBC  filed  comments  in  opposition  to  MCI  WorldComs  request.  228 
 101.  The  Commission  previously  has  considered  and  rejected  this  same  argument  twice.  229  The  Commissions  rules  permit  disclosure  of  a  customers  records  only  upon  adequate 
 notice  to  and  approval  from  the  customer.  230  These  rules  are  designed  to  allow  customers  to  make  reasoned,  informed  decisions  about  their  CPNI  in  which  they  have  a  privacy  interest.  231  As 
 several  commenting  parties  note,  the  short  notice  statement  proposed  by  MCI  WorldCom  is  too  vague  to  enable  the  customer  to  make  an  informed  decision.  232  Although  MCI  WorldCom 
 presents  information  about  its  experience  competing  for  local  exchange  customers,  MCI  WorldCom  and  the  other  commenters  supporting  this  request  do  not  present  compelling  new 
 facts  or  arguments  that  justify  altering  the  existing  rules,  especially  in  light  of  the  fact  that,  in  the  instant  proceeding,  we  streamline  the  notice  requirements.  Specifically,  MCI  WorldCom  does 
 not  establish  how  its  need  for  this  information  233  during  an  initial  cold  call  to  a  potential  customer  overcomes  that  customers  privacy  interests    especially  since  there  is  no  existing  business 
 relationship,  making  MCI  WorldCom  or  another  similarly  situated  carrier  a  third  party  to  the  consumer.  234  Accordingly,  for  the  same  reasons  that  we  have  differentiated  the  approval  required 

 (Continued  from  previous  page)  Dec.  2,  1999)  (U  S  West  Comments  on  Pet.  for  Further  Recon.)  at  3-  9  (supporting  MCI  WorldComs  petition  in 
 part).  See  also  WorldCom  Reply  on  MCI  WorldComs  Petition  for  Further  Recon.,  CC  Docket  Nos.  96-  115  and  96-149  (filed  Dec.  15,  1999)  (MCI  WorldCom  Reply  on  Pet.  for  Further  Recon.)  at  2-  5;  WorldCom  Comments  at  7-  8. 

 228  Bell  Atlantic  Comments  on  MCI  WorldComs  Petition  for  Further  Reconsideration,  CC  Docket  Nos.  96-  115 
 and  96-  149  (filed  Dec.  2,  1999)  (Bell  Atlantic  Comments  on  Pet.  for  Further  Recon.)  at  1-  2,  4-  5;  BellSouth  Comments  on  MCI  WorldComs  Petition  for  Further  Reconsideration,  CC  Docket  Nos.  96-  115  and  96-  149  (filed 

 Dec.  2,  1999)  (BellSouth  Comments  on  Pet.  for  Further  Recon.)  at  1-  5;  GTE  Reply  Comments  on  MCI  WorldComs  Petition  for  Further  Reconsideration,  CC  Docket  Nos.  96-  115  and  96-  149  (filed  Dec.  2,  1999)  (GTE  Reply  to  Pet. 
 for  Further  Recon.)  at  2-  3;  SBC  Communications  Comments  on  MCI  WorldComs  Petition  for  Further  Reconsideration,  CC  Docket  Nos.  96-  115  and  96-  149  (filed  Dec.  2,  1999)  (SBC  Comments  on  Pet.  for  Further 
 Recon.)  at  1-  3;  BellSouth  Reply  at  5-  7;  Letter  from  Richard  T.  Ellis,  Verizon,  to  William  Caton,  Acting  Secretary,  Federal  Communications  Commission,  CC  Docket  Nos.  96-  115  and  96-  149  (filed  Mar.  6,  2002)  (Verizon  Mar.  6, 
 2002  Ex  Parte  Letter). 
 229  See  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14453-  14454,  paras.  86-  90  (determining  that  the  language  of 
 222(  c)(  1)(  A)  reflects  Congress  judgment  that  customer  approval  for  carriers  to  use,  disclose,  and  permit  access  to  CPNI  can  be  inferred  in  the  context  of  an  existing  customer  relationship.)  (emphasis  in  original);  CPNI  Order,  13 

 FCC  Rcd  at  8080,  para.  23. 
 230  See  Section  III.  C.  1.  In  addition,  we  note  that  this  Order  allows  for  streamlined  notice  for  one-  time,  limited  use 
 of  CPNI  in  Section  III.  C.  2.  a. 
 231  The  Commissions  rules  requiring  proper  notice  before  a  customer  gives  a  carrier  consent  to  access  CPNI 
 ensure  that  customers  are  given  an  opportunity  to  make  a  reasoned  decision.  See  CPNI  Order,  13  FCC  Rcd  at  8128,  para.  87. 

 232  See  BellSouth  Comments  on  Pet.  for  Further  Recon.  at  1-  4;  SBC  Comments  on  Pet.  for  Further  Recon.  at  2. 
 233  As  noted,  this  is  information  that  Congress  has  determined  to  be  private  and  worthy  of  special  protection  against 
 disclosure  without  customer  approval. 
 234  Moreover,  MCI  WorldCom  and  supporting  commenters  argue  that  making  a  customers  feature  information 
 available  will  improve  the  process  of  converting  customers  from  one  carrier  to  another.  MCI  WorldCom  Petition  at  (continued.) 
46
 Federal  Communications  Commission  FCC  02-  214 
 47 
 depending  on  intended  use  as  described  above,  we  reject  MCI  WorldComs  arguments  here  and  again  find  no  reason  to  disturb  our  earlier  decisions. 
 c.  Notice  Requirements  Regarding  Disclosure  of  Carriers  Affiliates 
 102.  We  deny  MCI  WorldComs  request  that  we  allow  carriers  to  use  broad,  general  terms  when  providing  notice,  rather  than  informing  customers  of  the  types  of  CPNI  that  may 
 be  viewed  and  the  entities  that  may  view  it.  235  MCI  WorldCom  provides  no  new  facts  and  makes  no  arguments  that  we  have  not  previously  considered  in  our  analysis  and  determination  in 
 the  CPNI  Reconsideration  Order.  236 
 d.  Ability  to  Warn  Customer  that  Provisioning  Delays  are  Possible  Without  Access  to  CPNI 

 103.  We  grant,  with  certain  safeguards,  MCI  WorldComs  request  that  we  remove  the  prohibition  against  warning  customers  that  failure  to  approve  the  disclosure  of  CPNI  to  a  new 
 carrier  may  disrupt  the  installation  of  service.  237  In  the  CPNI  Second  Report  and  Order,  the  Commission  explained  that  customer  notification  must  provide  sufficient  information  to  enable 
 the  customer  to  make  an  informed  decision  as  to  whether  to  permit  a  carrier  to  disclose,  or  permit  access  to  CPNI.  238  In  that  same  discussion,  the  Commission  prohibited  the  inclusion  of  any 
 implication  that  approval  is  necessary  to  ensure  the  continuation  of  services  to  which  the  customer  subscribes,  or  the  proper  servicing  of  the  customers  account.  239  In  the  CPNI 
 Reconsideration  Order,  based  on  a  lack  of  evidence,  the  Commission  denied  an  MCI  petition  to  allow  carriers  to  warn  customers  of  problems  that  could  result  from  failure  to  give  permission  to 
 access  the  customers  CPNI.  240  Because  we  want  customers  to  be  able  to  make  informed  decisions,  241  and  because  we  do  not  want  to  place  an  undue  burden  on  truthful  speech,  242  we 
 consider  this  topic  below. 
 (Continued  from  previous  page)  5-  9.  This  argument,  as  well  as  AT&  Ts  argument  that  failure  to  allow  access  to  such  information  could  compromise 
 a  customers  privacy  and  personal  safety  (AT&  T  Comments  at  3),  is  misplaced  in  this  discussion  of  access  during  the  initial  sales  contact  because  it  fails  to  consider  that,  before  WorldCom  or  AT&  T  places  an  order  for  that 
 customer,  the  customer  can  choose  whether  or  not  to  permit  access  to  his  CPNI  to  facilitate  the  provisioning  process. 
 235  MCI  WorldCom  Petition  at  13-  14. 

 236  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14467-  68,  paras.  115-  116. 
 237  MCI  WorldCom  Petition  at  12-  13. 
 238  CPNI  Order,  13  FCC  Rcd  at  8162,  para.  138. 
 239  Id. 
 240  CPNI  Reconsideration  Order  at  para.  91  &  n.  511. 
 241  See,  e.  g.,  RCN  Comments  on  Pet.  for  Further  Recon.  at  6. 
 242  See,  e.  g.,  U  S  West  Comments  on  Pet.  for  Further  Recon.  at  10. 
47
 Federal  Communications  Commission  FCC  02-  214 
 48 
 104.  Several  parties  commented  on  this  issue.  243  For  example,  RCN  and  Qwest  support  MCIs  contention  that  without  access  to  CPNI,  delays  or  problems  with  proper  provisioning  are 
 likely  when  a  customer  chooses  to  change  carriers.  244  Verizon,  however,  disagrees  with  the  argument  that  a  competing  carriers  lack  of  access  to  a  customers  CPNI  necessarily  causes 
 delays  or  provisioning  problems,  arguing  instead  that  if  such  problems  occur,  they  are  the  fault  of  MCI  WorldCom.  245  Parties  raise  sufficient  cause  for  us  to  believe  that  our  current  rules  may 
 restrict  truthful  speech  that  could  beneficially  inform  consumers  decisions  on  CPNI  disclosure.  246 

 105.  We  recognize  an  important  balance  of  interests  in  warning  customers  that  failure  to  grant  access  to  CPNI  may  impede  the  provisioning  process.  On  one  hand,  we  believe  that 
 customers  should  be  given  useful  and  truthful  information  that  will  better  inform  their  decisions  regarding  CPNI.  On  the  other  hand,  we  are  wary  that  carriers  might  use  such  a  warning  in  such  a 
 way  as  to  coerce  customers  into  granting  consent  to  access  CPNI.  Therefore,  in  order  to  maximize  the  ability  of  customers  to  make  fully  informed  decisions  about  their  CPNI,  we  permit 
 carriers  to  provide  an  informative  statement  to  customers  about  problems  that  often  occur  in  provisioning  service  without  access  to  CPNI. 

 106.  Specifically,  we  decide  that  carriers  soliciting  consent  to  access  a  customers  CPNI  may,  in  addition  to  the  statements  required  to  obtain  consent,  provide  a  brief  statement,  in 
 clear  and  neutral  language,  describing  consequences  directly  resulting  from  the  lack  of  access  to  CPNI.  However,  any  consequences  must  affect  customers  and  must  be  provable  and  material.  247 
 By  requiring  carriers  to  limit  their  representations  in  this  way,  we  can  best  ensure  that  customers  are  protected  from  coercive  or  trivial  assertions,  while  nevertheless  ensuring  that  customers  have 
 information  that  is  relevant  to  their  decisions  to  allow  use  of  their  CPNI.  We  decline,  at  this  time,  to  mandate  specific  language  for  such  warnings  because  we  believe  that  our  rules  will 
 provide  carriers  with  sufficient  guidance  to  formulate  scripts  that  inform  customers  in  a  neutral  manner  of  significant  consequences,  without  unduly  restricting  carrier  flexibility  in  delivering 
 the  message. 

 243  Bell  Atlantic  Comments  on  Pet.  For  Further  Recon.  at  5-  6;  RCN  Comments  on  Pet.  for  Further  Recon  at  6;  U  S 
 WEST  Comments  on  Pet.  for  Further  Recon.  at  9-  10. 
 244  RCN  Comments  on  Pet.  for  Further  Recon.  at  6;  U  S  WEST  Comments  on  Pet.  for  Further  Recon.  at  10. 

 245  Bell  Atlantic  Comments  on  Pet.  for  Further  Recon.  at  5-  6. 
 246  We  expressly  do  not  find  that  the  specific  claims  of  the  various  commenters  are  truthful,  provable,  significantly 
 probable  customer-  impacting  consequences  of  a  lack  of  access  to  CPNI. 
 247  Consequences  must  be  provable  in  the  sense  that  they  cannot  be  mere  speculation  as  to  possible  harm.  Rather, 
 they  must  constitute  an  actual  consequence  of  a  failure  to  use  CPNI  in  providing  service  to  a  customer,  based  on  the  carriers  experience.  Consequences  must  be  material  in  the  sense  that  they  must  constitute  a  problem  that  would 

 prevent  or  significantly  delay  the  initiation  of  service.  Consequences  must  be  customer-  impacting,  as  otherwise  there  would  be  no  reasonable  purpose  in  communicating  them,  aside  from  attempting  to  coerce  or  confuse  the 
 customer. 
48
 Federal  Communications  Commission  FCC  02-  214 
 49 
 3.  Frequency  of  Notice 
 107.  We  hold  that  carriers  using  the  opt-  in  customer  approval  mechanism  must  provide  customers  with  a  one-  time  notice  before  soliciting  approval  to  use  CPNI.  Carriers  electing  the 

 opt-  out  mechanism  must  provide  notices  to  their  customers  every  two  years.  We  note  that  few  commenters  addressed  the  issue  of  frequency  of  notice  and  none  suggested  a  specific  time 
 period.  248 
 108.  We  adopt  a  more  stringent  notice  requirement  for  the  opt-  out  regime  for  several  reasons.  First,  under  the  opt-  out  mechanism,  the  possibility  exists  that  customers  have  not  made 

 a  conscious  decision  to  allow  the  additional  use  of  their  CPNI.  For  example,  the  lack  of  response  could  be  due  to  a  customers  failure  to  receive  the  notice,  a  failure  to  read  the  notice,  or  a  failure 
 to  understand  the  notice.  249  As  Qwest  itself  recognized  in  its  comments,  [  t]  he  failure  to  act,  then,  provides  little  evidence  of  an  individuals  true  intentions,  and  no  dispositive  or  compelling 
 demonstration  of  a  decision.    250  As  already  discussed,  the  opt-  out  mechanism  requires  more  stringent  safeguards  because  of  the  possibility  that  consumers  are  unaware  of  their  rights  and 
 because  opt-  out  provides  incentives  for  carriers  to  not  be  as  forthright  as  possible.  251  By  contrast,  in  an  opt-  in  environment,  customers  have  taken  affirmative  action  regarding  the  use  of  their 
 CPNI  that  demonstrates  they  are  informed  of  the  scope  and  duration  of  a  carriers  use  of  CPNI.  252 
 109.  Second,  a  number  of  relevant  customer  and  carrier  circumstances  can  change  over  time.  A  customers  marital  or  parental  status,  job  status,  or  health  status  can  change.  Carriers 

 may  change  their  affiliates,  the  methods  available  to  opt-  out,  and  the  uses  the  carrier  makes  of  the  information.  For  example,  a  customer  might  be  willing  to  share  his  CPNI  with  a  local 
 telephone  company,  but  decide  that  he  wants  to  restrict  the  use  of  his  CPNI  after  that  company  merges  with  a  larger  entity.  Periodic  renotification  is  thus  a  reasonable  way  of  ensuring  that 
 customers  have  an  adequate  opportunity  to  indicate  approval. 
 110.  Therefore,  in  accordance  with  the  general  policy  we  have  adopted  regarding  the  need  for  consumer  safeguards  in  an  opt-  out  regime,  and  because  failing  to  provide  for  periodic 

 confirmation  would  fail  to  account  for  material  changes  in  circumstances  over  time,  we  hold  that 
 248  Verizon  Wireless  urged  the  Commission  not  to  adopt  costly  or  burdensome  notice  and  consent  requirements  in 
 conjunction  with  opt-  out  (in  terms  of  frequency  of  notice,  volume  of  notice  materials,  etc.).  Verizon  Wireless  Comments  at  6. 

 249  NAAG  Dec.  21,  2001  Ex  Parte  Letter  at  7-  9. 
 250  Qwest  Comments  at  13.  See  also  AT&  T  Wireless  Comments  at  4  regarding  supposed  limitations  of  opt-  in,  but 
 equally  applicable  to  opt-  out  (  A  carrier  would  not  know  whether  the  absence  of  such  affirmative  action  reflects  a  conscious  decision  by  the  customer  not  to  permit  the  carrier  to  use  his  or  her  CPNI,  or  simply  a  lack  of  interest). 

 251  See  supra  description  of  problems  reported  with  the  Gramm-  Leach-  Bliley  notifications,  as  well  as  survey 
 information  indicating  that  even  those  consumers  with  particularly  strong  privacy  concerns  are  not  responding  as  anticipated  to  opt-  out  notifications. 

 252  CPNI  Order,  13  FCC  Rcd  at  8165,  para.  142  (finding  that  a  periodic  notice  requirement  was  no  longer  necessary 
 under  an  opt-  in  customer  approval  mechanism). 
49
 Federal  Communications  Commission  FCC  02-  214 
 50 
 carriers  must  provide  opt-  out  notices  at  least  once  every  two  years.  A  two-  year  period  is  a  reasonable  period  over  which  one  might  reasonably  expect  changed  circumstances  to  warrant 
 confirmation  of  an  opt-  out  election.  Biennial  notice  is  also  unlikely  to  impose  an  onerous  burden  on  carriers,  particularly  when  compared  to  their  likely  benefit  in  making  use  of  the  opt-  out 
 mechanism.  253 
 111.  In  addition,  we  require  carriers  to  honor  their  customers'  CPNI  elections  unless  and  until  a  customer  affirmatively  changes  his  election.  Following  a  customer's  election  to 

 withhold  approval  of  CPNI  usage,  the  carrier  may  subsequently  attempt  to  secure  the  customer's  approval  to  use,  disclose,  or  permit  access  to  his  CPNI  as  frequently  as  the  carrier  deems 
 appropriate,  but  carriers  may  not  force  customers  to  opt-  out  repeatedly  in  an  attempt  to  wear  the  customer  down  or  obtain  an  inadvertent  "approval."  Accordingly,  although  carriers  must  provide 
 biennial  opt-  out  notice  to  their  customers,  carriers  must  respect  previously  expressed  opt-  outs.  Nor  can  carriers  provide  opt-  in  notices  to  their  customers  and  immediately  provide  additional 
 notices  to  those  customers  who  choose  not  to  opt-  in,  because  such  use  of  repeated  notices  is  burdensome  to  customers  and  fails  to  respect  their  privacy  choices  regarding  CPNI. 

 4.  Waiting  Period  for  Opt-  Out  Notification 
 112.  We  adopt  a  30-  day  minimum  period  of  time  that  carriers  must  wait  after  giving  customers  notice  before  assuming  customer  approval.  In  the  CPNI  Clarification  Order,  the 

 Commission  noted  that  the  then-  current  rules  did  not  provide  for  any  time  period  after  which  a  customers  implicit  approval  of  the  use  or  sharing  of  CPNI  could  be  reasonably  assumed  to  have 
 been  given  to  the  carrier.  254  As  an  interim  measure,  the  Commission  adopted  a  30-  day  period  from  customer  receipt  of  notice  as  a  safe  harbor,  but  permitted  some  shorter  period  if 
 supported  by  an  adequate  explanation  from  the  carrier.  255  Commenters  addressing  this  topic  uniformly  supported  a  30-  day  waiting  period,  256  although  one  commenter  found  troubling  that 
 [  a  carriers]  notice  gave  customers  only  thirty  days  to  object.  257  In  light  of  the  comments  we  received  supporting  the  30-  day  time  frame  and  the  lack  of  any  other  suggested  time  frames  or 

 253  We  note  that  the  Commissions  earlier  CPNI  rules  required  carriers  to  send  annual  notices  to  some  customers 
 regarding  their  use  of  CPNI  to  market  customer  premises  equipment  and  enhanced  services.  Computer  III  Phase  II  Order,  2  FCC  Rcd  3072,  3093-  97,  paras.  141-  174  (1987);  GTE  Safeguards  Order,  9  FCC  Rcd  4922,  4944-  45,  para. 

 45  (1994).  In  addition,  the  Commission  considered  annual  or  semi-  annual  approval  requirements  in  the  CPNI  Order,  but  found  such  a  condition  unwarranted  in  an  opt-  in  environment.  CPNI  Order,  13  FCC  Rcd  8061,  8151, 
 para.  116.  The  requirement  we  adopt  here  is  less  burdensome  than  an  annual  or  semi-  annual  requirement  but  still  serves  the  purpose  of  ensuring  consumers  wishes  with  respect  to  the  privacy  of  their  CPNI  are  honored. 

 254  CPNI  Clarification  Order,  16  FCC  Rcd  16506,  16511,  para.  11. 
 255  Id. 
 256  AT&  T  Wireless  Comments  at  3  (  AWS  agrees  that  there  should  be  a  reasonable  waiting  period  between  the 
 time  notice  is  provided  and  consent  is  assumed,  and  supports  the  30-  day  waiting  period  proposed  by  the  Commission.);  Verizon  Comments  at  13  (  a  thirty-  day  period  is  sufficient  for  a  response.);  see  also  Nextel 

 Comments  at  8;  SBC  Comments  at  14;  Verizon  Wireless  Comments  at  6,  n.  9;  Verizon  Feb.  20,  2002  Ex  Parte  Letter  at  4. 

 257  Attorney  General  of  Arizona  Jan.  25,  2002  Ex  Parte  Letter  at  5  (emphasis  added). 
50
 Federal  Communications  Commission  FCC  02-  214 
 51 
 evidence  of  harm  to  consumers  or  carriers,  we  adopt  as  permanent  the  interim  30-  day  time  frame.  We  clarify  that  this  30-  day  period  is  merely  the  minimum  time  a  carrier  must  wait  to 
 infer  a  customers  approval  of  its  requested  use  of  CPNI;  it  is  no  way  a  deadline  for  customer  action.  Carriers  are  required  to  honor  customer  decisions  to  opt-  out  of  requested  uses  whenever 
 those  decisions  are  communicated  by  customers,  which  may  occur  during  or  after  the  30-  day  waiting  period. 

 113.  We  also  sought  comment  on  how  carriers  should  manage  later  requests  for  privacy  from  the  customer.  258  For  example,  if  a  customer  chooses  to  opt-  out  after  the  date  on 
 which  approval  has  already  been  inferred,  or,  in  the  case  of  an  opt-  in  mechanism,  after  the  customer  revokes  an  express  consent  previously  granted,  what  would  be  a  reasonable  time  period 
 within  which  the  carrier  and  its  affiliates  should  be  required  to  implement  that  opt-  out  request  or  revocation?  We  received  limited  comments  on  this  topic,  and  note  that  we  are  unaware  of  any 
 complaints  regarding  carriers  failure  to  implement  and  honor  later  requests  for  privacy.  Accordingly,  we  require  carriers  to  implement  customers  privacy  requests  as  expeditiously  as 
 possible  within  the  regular  course  of  business.  However,  we  caution  carriers  that  if  we  receive  complaints  that  later  privacy  choices  are  not  being  effectuated  in  a  timely  manner,  we  will  not 
 hesitate  to  readdress  this  issue,  and  adopt  prescriptive  rules.  In  addition,  we  caution  carriers  that  failure  to  implement  customers  privacy  elections  in  a  timely  manner  would  likely  be  actionable 
 violations  of  sections  222  and  201  of  the  Act. 
 114.  We  also  require  carriers  to  notify  the  Commission  if  their  opt-  out  mechanisms  break  down.  During  the  period  preceding  this  Order,  a  number  of  carriers  implemented  opt-  out 

 policies.  We  are  aware  that  many  consumers  experienced  problems  in  effectuating  their  choice  to  opt-  out.  259  For  example,  it  was  reported  that  Qwests  call  center  was  understaffed  for  the  level 
 of  response  and  consumers  were  unable  to  get  through  or  put  on  hold  for  unacceptably  long  periods;  SBC  generated  similar  complaints.  260  In  light  of  recent  problems  customers  have  had 
 opting-  out,  as  well  as  the  vital  role  that  proper  implementation  of  the  opt-  out  mechanism  plays  in  protecting  consumers  privacy,  we  require  that  carriers  provide  written  notice  within  five 
 business  days  to  the  Commission  in  any  instances  where  opt-  out  mechanisms  do  not  work  properly,  to  such  a  degree  that  consumers  inability  to  opt-  out  is  more  than  an  anomaly.  261 

 258  CPNI  Clarification  Order,  16  FCC  Rcd  at  16518,  para.  23. 
 259  NASUCA  April  12,  2002  Ex  Parte  Letter  at  4;  Texas  Office  of  Public  Utility  Counsel  April  16,  2002  Ex  Parte 
 Letter. 
 260  See  Brett  Glass  Comments;  Attorney  General  of  Arizona  Jan.  25,  2002  Ex  Parte  Letter  at  5;  Arizona 
 Corporation  Commission  Jan.  28,  2002  Ex  Parte  Letter  at  2;  Texas  Office  of  Public  Utility  Counsel  Apr.  16,  2002  Ex  Parte  Letter  at  2.  See  also  Paul  Wenske,  Consumers  Have  Difficulty  Opting-  Out,,  KANSAS  CITY  STAR  (Feb. 

 17,  2002). 
 261  Such  notices  must  be  filed  in  WC  Docket  96-  115  with  the  Secretarys  Office  and  sent  to  the  Chief,  Competition 
 Policy  Division,  Wireline  Competition  Bureau  and  to  the  Chief,  Policy  Division,  Consumer  and  Governmental  Affairs  Bureau. 
51
 Federal  Communications  Commission  FCC  02-  214 
 52 
 115.  In  such  instances,  the  Commission  will  consider  whether  to  require  carriers  to  extend  the  date  by  which  opt-  outs  must  be  received,  or  if  other  corrective  action  is  required.  We 
 encourage  carriers  to  take  such  action  voluntarily,  and  to  advise  the  Commission  of  such  action  in  the  notice.  The  notice  should  take  the  form  of  a  letter,  and  include  the  carriers  name,  a 
 description  of  the  opt-  out  mechanism(  s)  used,  the  problem(  s)  experienced,  the  remedy  proposed  and  when  it  will  be/  was  implemented,  whether  the  relevant  state  commission(  s)  has  been  notified 
 and  whether  it  has  taken  any  action,  a  copy  of  the  notice  provided  to  customers,  and  contact  information.  Such  notice  must  be  submitted  even  if  the  carrier  offers  other  methods  by  which 
 consumers  may  opt-  out. 
 116.  In  addition,  we  no  longer  allow  carriers  to  use  a  time  frame  shorter  than  30  days  even  if  supported  by  an  explanation.  262  To  the  degree  that  carriers  previously  provided  notices 

 that  otherwise  comply  with  our  rules,  but  used  a  shorter  time  frame,  we  allow  carriers  to  continue  to  use  approval  generated  from  those  notices  consistent  with  our  holding  regarding 
 grandfathering  of  previously  obtained  approvals.  263 
 117.  Moreover,  we  agree  with  Nextels  request  to  allow  a  carrier  to  provide  the  requisite  notification  at  the  time  of  an  individual  transaction  and  request  that  the  consumer 

 decide  whether  to  opt-  out  as  a  requisite  to  completing  that  transaction.  264  In  particular,  subject  to  our  discussion  of  shrinkwrap  consent,  carriers  may  request  that  consumers  affirmatively  make 
 a  CPNI  election  when  the  consumer  signs  up  for  service.  However,  if  the  carrier  provides  an  opt-  out  notice  but  does  not  require  the  customer  to  specifically  demonstrate  his  decision  whether 
 or  not  to  opt-  out,  then  the  carrier  must  abide  by  the  thirty-  day  waiting  period.  Specifically,  a  carrier  must  obtain  a  demonstrable  customer  election  to  opt-  in  or  opt-  out  that  is  separate  and 
 distinct  from  the  customers  decision  to  purchase  the  carriers  service.  For  example,  a  carrier  that  uses  an  Internet  sign-  up  page  may  provide  the  required  notice  and  then  require  a  customer  to 
 click  on  a  button  agreeing  to  opt-  out  or  opt-  in.  265  However,  carriers  may  not  require  customers  to  assent  to  CPNI  usage  as  a  condition  of  service.  266 

 262  Should  extraordinary  circumstances  occur,  we  will  consider  individual  carriers  waiver  requests. 
 263  See  section  III.  B.  3,  infra. 
 264  Nextel  Comments  at  8. 
 265  See  section  III.  C.  1.  a,  supra. 
 266  Accordingly,  we  disagree  with  CTIAs  assertion  that  a  carrier  could  notify  a  customer  of  its  information 
 practices  at  the  time  a  customer  subscribes.  If  the  customer  initiates  service  after  such  notice,  there  should  be  no  dispute  that  consent  has  been  given  and  is  adequate  to  satisfy  Section  222.  Because  not  all  consumers  have 

 meaningful  choice  regarding  all  of  their  telecommunications  providers,  we  do  not  allow  carriers  to  require  CPNI  access  as  a  term  of  service.  CTIAs  proposed  solution    the  customer  may  terminate  the  service  if  such  practices 
 are  no  longer  acceptable    is  inappropriate  where  a  customer  depends  on  such  service  as  a  basic  utility  and  has  no  other  meaningful  choice  (e.  g.,  local  dial  tone). 
52
 Federal  Communications  Commission  FCC  02-  214 
 53 
 5.  Methods  by  Which  Customers  Can  Exercise  CPNI  Rights  Under  Opt-Out  or  Opt-  In 
 118.  We  require  that  carriers  make  available  to  every  customer  (including,  but  not  limited  to,  those  without  Internet  access,  and  disabled  customers)  a  method  to  opt-  out  that  is  of 
 no  additional  cost  267  to  the  customer  and  available  24  hours  a  day,  seven  days  a  week.  We  allow  carriers  to  satisfy  this  requirement  through  a  combination  of  methods,  268  so  long  as  all  customers 
 have  the  ability  to  opt-  out  at  no  cost  and  are  able  to  effectuate  that  choice  whenever  they  choose.  269  We  note  that  in  an  opt-  in  paradigm,  carriers  have  an  incentive  to  make  it  as  easy  as 
 possible  for  customers  to  opt-  in  because  they  need  to  receive  the  customers  express  approval  to  use  CPNI.  However,  in  the  case  of  opt-  out,  it  makes  economic  sense  for  carriers  to  make  it 
 difficult  and  expensive  for  customers  to  opt-  out,  because  opting-  out  deprives  the  carrier  of  approval  for  its  intended  use  of  CPNI.  270  Many  commenters  suggest  that  the  Commission  allow 
 carriers  to  determine  what  methods  to  offer  customers  to  opt-  in  or  out.  271  Based  on  comments  as  well  as  recent  experiences  with  opt-  in  and  opt-  out  in  this  and  other  industries,  we  allow  carriers 
 the  freedom  to  choose  the  method(  s)  by  which  consumers  may  express  their  opt-  out  or  opt-  in  choices,  so  long  as  all  customers  are  able  to  access  and  use  those  mechanisms,  24  hours  a  day, 
 seven  days  a  week.  We  believe  that  these  requirements  will  ensure  that  all  consumers  are  afforded  a  reasonable  opportunity  to  effectuate  their  privacy  choices,  while  allowing  carriers 
 flexibility  in  determining  how  to  meet  their  obligations.  272 
 119.  We  deny  the  request  by  a  few  commenters  to  require  carriers  to  obtain  written  evidence  of  customers  approval.  273  We  have  previously  considered  whether  to  require  written 

 evidence  and  were  not  convinced  that  such  an  approach  was  necessary,  especially  in  light  of  the  burden  it  would  place  on  carriers.  274  We  decline  to  do  so  here  because  we  have  not  been 
 presented  any  evidence  that  carriers  are  failing  to  obtain  customers  approval  and  then  claiming 

 267  While  we  recognize  that  carriers  may,  and  in  fact  probably  will,  pass  the  cost  of  providing  a  cost-  free  method  of 
 opting-  out  on  to  their  customer  base,  we  believe  that  this  approach  is  more  equitable  than  allowing  carriers  to  impose  costs  only  on  consumers  who  elect  not  to  share  their  CPNI.  We  are  concerned  that  carriers  could  impose 

 enough  cost  on  consumers  so  as  to  disproportionately  impact  low-  income  consumers. 
 268  The  avenues  for  opt-  in  and  opt-  out  elections  are  written,  oral,  and  electronic. 

 269  However,  as  discussed  in  section  III.  C.  1.b,  supra,  we  have  concerns  regarding  carriers  use  of  break  the  seal 
 or  shrinkwrap  methods  for  customers  to  opt-  in  or  out. 
 270  See  para.  62  supra,  describing  carriers  incentives  in  an  opt-  in  versus  opt-  out  paradigm. 

 271  SBC  Comments  at  15;  Sprint  Comments  at  6;  Verizon  Wireless  Comments  at  5. 
 272  Such  mechanisms  could  include  a  wide  variety  of  methods,  including  a  postage-  paid  return  postcard,  a  toll  free 
 number,  a  secure  Internet  page,  and/  or  an  e-  mail  address  to  receive  opt-  outs.  In  addition,  a  form  or  other  mechanism  that  could  be  returned  with  a  customers  bill  payment  would  satisfy  this  requirement,  as  the  customer  would  not 

 incur  any  additional  cost. 
 273  Cal.  PUC  Comments  at  22;  Texas  PUC  Mar.  1,  2002  Ex  Parte  Letter  at  3. 

 274  CPNI  Order,  13  FCC  Rcd  at  8146-  8149,  paras.  110-  114. 
53
 Federal  Communications  Commission  FCC  02-  214 
 54 
 to  have  such  approval.  To  the  degree  that  we  receive  complaints  that  abuses  of  this  nature  are  occurring,  we  will  revisit  this  issue  and  will  not  hesitate  to  initiate  enforcement  actions  against 
 offending  carriers.  In  addition,  we  note  that  carriers  bear  the  burden  to  provide  proof  that  approval  was  obtained  should  a  complaint  arise.  275 

 D.  Competition  Issues 
 1.  Forbearance  for  Preferred  Carrier  Freeze  Information 
 120.  While  we  confirm  our  previous  determination  that  preferred  carrier  (  PC)  freeze  information  falls  squarely  within  the  definition  of  CPNI,  276  in  this  Order  we  forbear  from 

 imposing  section  222s  affirmative  approval  requirements  on  PC-  freeze  information  so  that  it  can  be  made  more  readily  available  to  requesting  carriers. 

 121.  MCI  WorldCom  petitioned  the  Commission  to  reconsider  its  conclusion  that  PC-freeze  status  falls  within  the  definition  of  CPNI.  277  In  its  petition,  WorldCom  states  that  it  is  not 
 apparent  that  customers  have  any  privacy  interest  in  restricting  access  to  knowledge  of  the  fact  that  their  carrier  selections  have  been  frozen.  278  WorldComs  argument,  however,  only  partially 
 addresses  the  legal  question.  We  have  classified  PC-  freeze  information  as  CPNI  and  have  not  differentiated  among  different  types  of  CPNI  for  the  purpose  of  applying  the  opt-  in/  opt-  out 
 methodology  or  other  requirements  of  section  222.  279  We  remain  convinced  that  this  interpretation  is  a  valid  one,  and  deny  MCI  WorldComs  request  as  it  has  not  presented  any 
 arguments  not  already  considered  and  rejected. 
 122.  However,  the  Commission  has  nevertheless  noted  in  the  past  that  PC-  freeze  information  is  less  sensitive  than  other  CPNI.  280  Indeed,  before  clarifying  that  PC-  freeze 

 information  is  CPNI,  the  Commission  had  encouraged  carriers  to  disclose  such  information  to  other  carriers  without  customer  consent,  281  although  such  sharing  was  not  required  by  the 

 275  47  C.  F.  R.    64.  2007(  c). 
 276  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14488,  para.  148  &  n.  462. 
 277  MCI  WorldCom  Petition  at  16. 
 278  MCI  WorldCom  Petition  at  16. 
 279  For  this  reason,  we  decline  to  adopt  Mpowers  proposal  that  the  Commission  adopt  different  approval 
 requirements  for  CPNI  based  on  the  level  of  sensitivity.  See  Mpower  Comments  at  2-  6.  While  we  appreciate  Mpowers  initiative  in  proposing  alternatives  to  the  black  and  white  approach  to  opt-  in  or  opt-  out,  we  find  that 

 Mpowers  proposal  runs  contrary  to  Congress  unambiguous  intent  in  defining  all  types  of  customer  proprietary  network  information  under  one  definition  of  CPNI  in  section  222.  In  addition,  we  are  not  convinced  that  carriers 
 would  be  able  to  implement  such  a  distinction  in  their  existing  customer  service,  operations  support,  and  billing  systems,  where  facilities  information  and  call  detail  all  may  reside  without  distinction. 

 280  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14488,  para.  148  &  n.  462. 
 281  Slamming  Order,  14  FCC  Rcd  1508,  1587-  88,  para.  133.  See  also  U  S  West  Opp.  at  11-  13.  As  noted  above, 
 the  statute  does  not  clearly  state  whether  or  not  PC-  freeze  information  is  CPNI. 
54
 Federal  Communications  Commission  FCC  02-  214 
 55 
 Commissions  rules.  Notwithstanding  such  encouragement,  carriers  in  possession  of  PC-  freeze  status  information  may  have  feared  that  sharing  this  type  of  information  without  consent  violated 
 the  Act.  282  In  light  of  the  past  uncertainty  regarding  the  sharing  of  PC-  freeze  information,  and  the  fact  that,  absent  forbearance,  our  rules  would  preclude  the  sharing  of  such  CPNI  without 
 customer  approval,  we  now  undertake  a  forbearance  analysis  to  ensure  clear  and  consistent  rules  for  carriers.  We  must  conduct  an  analysis  under  Section  10  of  the  Act  283  in  order  to  forbear  from 
 applying  our  affirmative  approval  requirements  to  PC-  freeze  information.  284  Section  10  of  the  Act  requires  forbearance  where: 

 (1)  enforcement  of  such  regulation  or  provision  is  not  necessary  to  ensure  that  the  charges,  practices,  classifications,  or  regulations  by,  for,  or  in  connection  with  that 
 telecommunications  carrier  or  telecommunications  service  are  just  and  reasonable  and  are  not  unjustly  or  unreasonably  discriminatory; 

 (2)  enforcement  of  such  regulation  or  provision  is  not  necessary  for  the  protection  of  consumers;  and 
 (3)  forbearance  from  applying  such  provision  or  regulation  is  consistent  with  the  public  interest. 
 123.  Section  10(  b)  of  the  Act  provides  that,  in  determining  whether  forbearance  is  consistent  with  the  public  interest,  the  Commission  must  consider  whether  forbearance  will 
 promote  competitive  market  conditions,  including  the  extent  to  which  forbearance  will  enhance  competition  among  providers  of  telecommunications  services. 

 a.  Section  10(  a)(  1) 
 124.  The  Commission  must  first  ascertain  that  enforcement  of  the  regulation  is  not  necessary  to  ensure  that  services  are  provided  in  a  just,  reasonable  and  nondiscriminatory 

 manner.  Access  to  PC-  freeze  information  does  not  implicate  whether  a  given  carriers  charges,  practices,  classifications  or  regulations  by,  for,  or  in  connection  with  PC-  freeze  information  are 
 just  or  reasonable,  or  unjustly  or  unreasonably  discriminatory.  Further,  it  is  not  unjust,  unreasonable,  or  discriminatory  for  other  carriers  to  have  access  to  PC-  freeze  information, 
 particularly  if  doing  so  prevents  manifestly  unjust  and  unreasonable  carrier  behavior,  such  as  slamming.  We  thus  find  that  forbearance  from  enforcing  the  CPNI  notice  and  approval 
 requirements  as  they  related  to  PC-  freeze  information  meets  the  first  prong  of  section  10(  a). 

 282  See  47  U.  S.  C.    222(  c)(  1). 
 283  47  U.  S.  C.    160. 
 284  Although  MCI  WorldCom  does  not  propose  regulatory  forbearance  as  an  option,  we  note  that  U  S  WEST 
 proposes  forbearance  as  one  interpretive  option,  among  others.  U  S  West  Comments  on  Pet.  for  Further  Recon.  at  14. 
55
 Federal  Communications  Commission  FCC  02-  214 
 56 
 b.  Section  10(  a)(  2) 
 125.  Our  review  of  whether  the  rule  is  necessary  to  ensure  consumer  protection  focuses  on  two  aspects  of  consumer  protection    our  slamming  rules  and  consumers  expectations  of 

 privacy.  First,  as  we  stated  above,  by  this  action  the  Commission  does  not  remove  the  important  consumer  protection  tools  developed  to  prevent  the  practice  of  slamming,  but  rather,  intends  to 
 make  these  rules  more  effective.  As  U  S  WEST  notes,  consumers  will  not  be  harmed  because  the  PC-  freeze  cannot  be  eliminated  without  the  personal  intervention  of  the  subscriber,  even  if 
 the  [preferred  carrier]  freeze  information  is  known  to  a  soliciting  carrier.  285  Additionally,  PC-freeze  information,  while  CPNI,  is  not  the  type  of  information  regarding  which  consumers  would 
 have  a  strong  expectation  of  privacy.  286  Therefore,  the  necessity  of  enforcing  the  approval  requirements  in  this  instance  is  substantially  reduced.  Indeed,  the  only  information  conveyed  by 
 a  PC-  freeze  status  is  that  the  customer  prefers  to  verify  affirmatively  whether  any  changes  are  permissible  in  that  customers  choice  of  carrier. 

 c.  Sections  10(  a)(  3)  and  10(  b) 
 126.  Finally,  we  must  consider  whether  forbearance  is  in  the  public  interest  and  whether  forbearance  will  promote  competitive  market  conditions.  Commenting  parties  assert 

 that  the  unavailability  of  PC-  freeze  information  can  delay  the  conversion  of  customers  to  their  services.  287  Such  delays  often  result  in  unmet  customer  expectations,  and  customers  may  become 
 confused  or  harmed  when  the  new  service  or  price  options  they  have  chosen  are  not  implemented.  Indeed,  in  the  Slamming  Order,  the  Commission  found  that  PC-  freezes  could 
 present  an  additional  hurdle  to  switching  carriers  that  could  frustrate  consumer  choice.  288  The  Commission  also  noted  in  the  Slamming  Order  that  broad  availability  of  PC-  freeze  status 
 information  reduces  the  likelihood  a  customer  will  have  a  negative  experience  when  switching  service  from  one  carrier  to  another.  289  With  prior  knowledge  of  a  customers  PC-  freeze  status, 
 carriers  can  prevent  such  delays  and  customer  confusion. 
 127.  Forbearing  from  the  CPNI  approval  requirements  may  increase  carriers  willingness  and  ability  to  share  PC-  freeze  status  information.  Carriers  may  be  able  to  more 

 285  U  S  West  Comments  on  Pet.  for  Further  Recon.  at  13. 
 286  MCI  WorldCom  Petition  at  16;  AT&  T  Comments  on  Pet.  for  Further  Recon.  at  5;  U  S  West  Comments  on  Pet. 
 for  Further  Recon.  at  13.  But  see  SBC  Comments  on  Pet.  for  Further  Recon.  at  4;  CPNI  Recon  Order  at  n.  462  (noting  GTEs  argument  to  the  contrary). 

 287  See  Sprint  Comments  on  Pet.  for  Further  Recon.  at  2-  3. 
 288  Slamming  Order,  14  FCC  Rcd  at  1577-  78,  para.  115. 
 289  The  Commission  stated,  we  see  benefit  to  the  consumer    in  terms  of  decreased  confusion  and  inconvenience   
 where  carriers  would  be  able  to  determine  whether  a  freeze  is  in  place  before  or  during  an  initial  contact  with  the  consumer.  Slamming  Order,  14  FCC  Rcd  at  1587-  88,  para.  133. 
56
 Federal  Communications  Commission  FCC  02-  214 
 57 
 smoothly  transfer  customers  who  are  unaware  that  a  PC-  freeze  exists  on  their  accounts,  as  the  customers  PC-  freeze  choices  can  be  discovered  earlier  in  the  provisioning  process.  290 
 128.  We  also  believe  all  carriers  operating  in  the  competitive  marketplace  will  benefit  if  our  rules  and  regulations  are  consistent  and  clear.  For  example,  if  PC-  freezes  are  CPNI  that 
 cannot  be  disclosed  to  a  requesting  carrier  without  express  written  consent,  Sprint  claims  291  another  carrier  could  refuse  to  conduct  a  three-  way  conference  call  to  lift  a  PC-  freeze,  which  is 
 allowed  by  the  Commissions  rules.  292  Also,  as  discussed  above,  it  is  important  to  clarify  carriers  responsibilities  in  order  to  advance  the  Commissions  goal  of  protecting  consumers 
 from  slamming.  Therefore,  we  find  that  regulatory  forbearance  is  in  the  public  interest  because  it  enhances  the  consumers  choice  and  clarifies  the  rules  that  apply  to  carriers  in  the  competitive 
 market. 
 2.  Denial  of  CPNI  to  Another  Carrier  With  Customer  Authorization 
 129.  MCI  WorldCom  petitioned  the  Commission  to  strengthen  the  presumption  that  a  violation  of  the  Act  has  occurred  when  an  incumbent  LEC  fails  to  provide  access  to  CPNI  to  a 

 competing  carrier  that  has  customer  authorization  to  access  that  information.  293  We  continue  to  hold  that  sections  201  and  222  of  the  Act  apply  to  all  carriers,  and  we  find  that  a  distinction 
 between  incumbent  LECs  and  competitive  LECs  in  this  context  would  be  imprudent.  294  The  Commission  has  not  previously  required  stricter  CPNI  rules  for  certain  types  of  carriers,  and 
 MCI  WorldCom  has  not  provided  us  with  new  arguments  that  section  222  allows  such  a  distinction. 

 130.  The  Commission  has  stated  that  a  carriers  failure  to  disclose  CPNI  to  a  competing  carrier  that  seeks  to  initiate  service  to  that  customer  who  wishes  to  subscribe  to  a 
 competing  carriers  service,  may  well  constitute  an  unreasonable  practice  in  violation  of  section 

 290  While  a  carrier  often  can  either  rely  on  subscribers  knowledge  of  whether  they  have  a  PC-  freeze  on  their 
 account,  or  use  a  three-  way  calling  mechanism  to  determine  such  information,  we  see  a  benefit  to  consumers  in  making  their  PC-  freeze  choice  available  to  other  carriers.  See  Slamming  Order,  14  FCC  Rcd  at  1587-  88,  para.  133. 

 However,  we  affirm  our  presumption  that  carriers  do  not  need  to  rely  on  LEC-  prepared  lists  identifying  subscribers  with  freezes  in  place,  given  the  other  ways  in  which  this  information  is  available.  See  Slamming  Third  Report  and 
 Order,  15  FCC  Rcd  at  16031-  32,  para.  76. 
 291  While  Sprint  makes  no  allegation  that  this  problem  actually  exists,  we  believe  that  any  uncertainty  will  be 
 addressed  by  this  regulatory  forbearance.  See  Sprint  Comments  on  Pet.  for  Further  Recon.  at  3. 
 292  Slamming  Order,  14  FCC  Rcd  at  1585-  86,  para.  129. 

 293  MCI  WorldCom  Petition  at  10-  12.  AT&  T  filed  comments  in  support  of  this  petition  while  Bell  Atlantic  and 
 SBC  filed  comments  in  opposition.  AT&  T  Comment  on  Pet.  for  Further  Recon.  at  1-  2;  Bell  Atlantic  Comments  on  Pet.  for  Further  Recon.  at  3;  SBC  Comments  on  Pet.  for  Further  Recon.  at  3-  4;  Letter  from  Michael  D.  Alarcon, 

 SBC,  to  William  Caton,  Acting  Secretary,  Federal  Communications  Commission,  CC  Docket  Nos.  96-  115  and  96-  149  (filed  Mar.  22,  2002)  (SBC  Mar.  22,  2002  Ex  Parte  Letter)  at  5. 

 294  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14418,  para.  11. 
57
 Federal  Communications  Commission  FCC  02-  214 
 58 
 201(  b),  depending  on  the  circumstances.  295  For  conduct  to  be  unlawful  under  section  201,  the  Commission  must  find  that  the  conduct  is  unjust  or  unreasonable.  296  We  believe  that  this 
 standard  requires  a  review  of  case-  specific  facts,  297  and  therefore  we  decline  to  impose  the  additional  presumption  of  illegality  requested  by  MCI  WorldCom.  MCI  WorldCom  also  asks 
 the  Commission  to  reconsider  this  request  under  the  local  competition  provisions  of  section  251.  298  The  Commission  has  addressed  the  ability  of  competitors  to  access  customer  service 
 records  pursuant  to  section  251  in  other  proceedings,  including  Local  Competition  dockets  and  applications  under  section  271  of  the  Act.  299  MCI  WorldCom  has  not  provided  any  reason  for  us 
 to  require  further  assurance  of  access  in  this  proceeding,  and  thus  we  decline  to  expand  the  scope  of  section  251  access  in  this  proceeding. 

 3.  Winback  and  Retention  Marketing 
 131.  We  reaffirm  our  existing  rule  that  a  carrier  executing  a  change  for  another  carrier  is  prohibited  from  using  such  information  to  attempt  to  change  the  subscribers  decision  to 

 switch  to  another  carrier.  300  However,  because  we  recognize  that  a  carriers  retail  operations  may,  without  using  information  obtained  in  violation  of  section  222(  b),  301  legitimately  obtain 
 notice  that  a  customer  plans  to  switch  to  another  carrier  or  contact  a  defecting  customer  in  the  ordinary  course  of  business,  302  we  decline  to  impose  a  presumption  that  all  retention  efforts  are 
 illegal,  as  requested  by  MCI  WorldCom. 

 295  CPNI  Order,  13  FCC  Rcd  at  8125-  8126,  paras.  84-  85;  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14453- 
 14456,  paras.  86-  92. 
 296  47  U.  S.  C    201(  b). 

 297  BellSouth  Opposition  and  Comments  at  5,  n.  5  (  Because  individual  circumstances  will  differ,  the  Commission 
 cannot  make  the  declaration  MCI  WorldCom  asks  of  it.). 
 298  MCI  WorldCom  Petition  at  10-  12. 

 299  Local  Competition  First  Report  and  Order,  11  FCC  Rcd  15499,  15763-  64,  15766-  67  at  paras.  518,  521-  23; 
 Ameritech  Michigan  Order,  para.  139  &  n.  341. 
 300  Slamming  Order,  14  FCC  Rcd  at  1572-  73,  para.  106.  The  Commissions  rules  are  designed  to  prevent 
 information  obtained  by  a  carriers  wholesale  operations  with  other  carriers  from  being  used  to  benefit  its  retail  operations.  See  CPNI  Reconsideration  Order,  14  FCC  Rcd.  at  14450,  paras.  78-  79  (stating,  where  a  carrier 

 exploits  advance  notice  of  a  customer  change  by  virtue  of  its  status  as  the  underlying  network-  facilities  or  service  provider  to  market  to  that  customer,  it  does  so  in  violation  of  section  222(  b).) 

 301  Section  222(  b),  entitled  Confidentiality  of  Carrier  Information,  states  that  a  telecommunications  carrier  that 
 receives  or  obtains  proprietary  information  from  another  carrier  for  purposes  of  providing  any  telecommunications  service  shall  use  such  information  only  for  such  purpose,  and  shall  not  use  such  information  for  its  own  marketing 

 efforts.  47  U.  S.  C.    222(  b). 
 302  However,  we  note  that  in  our  experience,  such  instances  are  the  exception,  not  the  rule.  As  explained  in  the 
 CPNI  Reconsideration  Order,  competition  is  harmed  if  any  carrier  uses  carrier-  to-  carrier  information,  such  as  switch  or  PIC  orders,  to  trigger  marketing  campaigns,  and  consequently  prohibit  such  actions  accordingly  .  .  .  Thus, 

 where  a  carrier  exploits  advance  notice  of  a  customer  change  by  virtue  of  its  status  as  the  underlying  network-(  continued.) 
58
 Federal  Communications  Commission  FCC  02-  214 
 59 
 132.  Specifically,  MCI  WorldCom  requests  the  Commission  to  establish  a  presumption  that  any  winback  303  efforts  be  deemed  unlawful  if  undertaken  before  the  new  carrier  has  started 
 providing  service.  304  Essentially,  MCI  WorldCom  asks  the  Commission  to  change  its  rules  in  two  ways:  first,  to  re-  draw  the  line  between  regulation  of  retention  and  winback  activities; 
 and  second,  to  alter  the  legal  presumption  for  retention  efforts.  305 
 133.  MCI  WorldCom  does  not  present  any  evidence  or  justification  that  we  have  not  previously  considered  for  changing  this  definitional  boundary  and  legal  presumption.  306 

 Further,  we  agree  with  BellSouths  argument  that  deeming  any  winback  or  retention  effort[  s],  including  those  based  on  information  learned  through  the  carriers  retail  operations,  .  . 
 presumptively  unlawful  would  deprive  customers  of  .  .  .  pro-  consumer,  pro-  competitive  benefits.  307  We  note  that,  to  the  degree  that  individual  abuses  are  alleged,  the  enforcement 
 process  provides  the  proper  avenue  for  resolving  such  complaints. 
 134.  Finally,  we  are  aware  that  a  number  of  states  are  examining  the  issue  of  improper  winback  and  retention  activities  and  a  number  of  states  have  adopted  rules  governing  incumbent 

 LECs  winback  activities.  308  We  continue  to  believe  that  the  states  are  uniquely  qualified  to  assess  the  local  competitive  landscape  and  determine  whether  additional  safeguards  are 
 necessary.  Accordingly,  we  affirm  that  our  rules  properly  balance  concerns  regarding  the  proper 

 (Continued  from  previous  page)  facilities  or  service  provider  to  market  to  that  customer,  it  does  so  in  violation  of  section  222(  b).  14  FCC  Rcd  at 
 14449-  14450,  paras.  77-  78. 
 303  The  Commission  defines  winback  to  cover  the  situation  where  the  customer  has  already  switched  its  service 
 to  another  carrier.  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14444,  para.  65. 
 304  MCI  WorldCom  Petition  at  17. 

 305  The  Commissions  rules  regarding  retention  deal  with  marketing  efforts  aimed  at  soon-  to-  be-  former 
 customers  who  have  chosen  to  switch  carriers,  but  have  not  yet  been  switched  over.  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14444,  14448-  49  at  paras.  65,  75.  Conversely,  winback  refers  to  marketing  efforts  to  regain  a 

 customer  that  has  already  switched  to  and  is  receiving  service  from  another  provider.  Id.  at  14444,  para.  65.  The  Commissions  rules  permit  carriers  to  use  CPNI  for  winback  marketing,  which  serves  to  provide  customers  more 
 competitive  choices.  Id.  at  14445,  para.  67. 
 306  MCI  WorldCom  argues  that  retention  regulations  should  apply  until  the  later  of  the  date  on  which  the  old  carrier 
 receives  a  loss  migration  notice  or  the  date  that  service  with  the  old  carrier  actually  ends.  MCI  WorldCom  Petition  at  17. 

 307  BellSouth  Opposition  and  Comments  at  6. 
 308  See,  e.  g.,  Petition  of  the  Southwest  Competitive  Telephone  Association,  IP  Communications  Corp.,  XO  Texas, 
 Inc.,  ASCENT,  CompTel,  Sage  Telecom,  Inc.,  Z-  Tel  Communications,  and  Birch  Telecom  of  Texas,  LLP  to  Amend  PUC  Substantive  Rule  26.  226,  Order  Denying  Petition  for  Rulemaking  and  Initiating  Investigation,  Project  No. 

 24597,  Public  Utility  Commission  of  Texas  (Nov.,  8,  2001);  Investigation  of  Winback/  Retention  Offers  by  Chapter  58  Electing  Companies,  Project  No.  24948,  Public  Utility  Commission  of  Texas;  In  the  Matter  of  the  Commissions 
 Discussion  of  Qwest  Corporations  WinBack  Promotional  Filing,  Docket  No.  N2002.4.44  (May  8,  2002  vote  to  file  a  complaint  in  district  court).  A  variety  of  other  states  are  considering  or  have  adopted  rules  governing 
 winback/  retention  activities  including  Florida,  Illinois,  Indiana,  Missouri,  North  Carolina,  and  South  Carolina. 
59
 Federal  Communications  Commission  FCC  02-  214 
 60 
 use  of  CPNI  with  the  goals  of  promoting  competition  in  the  marketplace  and  decline  to  adopt  the  presumption  that  MCI  WorldCom  suggests.  309 
 4.  Interplay  Between  Sections  222  and  272 
 135.  We  find  that  our  adoption  today  of  an  opt-  out  customer  approval  mechanism  for  the  use  of  CPNI  by  carriers  and  their  affiliates  that  provide  communications-  related  services  does 

 not  affect  our  prior  statutory  interpretation  regarding  the  interplay  between  sections  222  and  272,  nor  does  it  alter  our  ultimate  conclusion  that  the  term  information  in  section  272(  c)(  1)  310  does 
 not  include  CPNI.  311 
 136.  In  the  CPNI  Clarification  Order,  the  Commission  sought  comment  312  on  the  interplay  between  sections  222  and  272  if  the  customer  approval  mechanism  was  revised  in  light 

 of  the  Tenth  Circuits  opinion.  313  The  Commission  noted  it  might  need  to  revisit  its  conclusion  if  it  adopted  an  opt-  out  approach  as  a  final  rule  in  this  proceeding.  314  However,  we  decline  to 
 revisit  our  interpretation  of  the  interplay  between  sections  222  and  272  simply  because  we  have  amended  our  customer  approval  mechanisms.  315  While  the  Commission  addressed  the  interplay 
 of  sections  222  and  272  in  the  context  of  an  opt-  in  mechanism,  the  Commission  did  not  rely  on  its  adoption  of  the  opt-  in  method  in  reaching  its  conclusion.  316  Instead,  its  decision  was  based 

 309  See  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14447,  para.  72.  See  also  SBC  Opposition  at  4  (  MCIs 
 suggestion  should  be  denied  because  it  does  nothing  to  protect  carrier-  to-  carrier  information  and  does  much  to  harm  competition.). 

 310  Section  272(  c)(  1)  states  that  a  Bell  operating  company  (BOC),  in  dealing  with  its  section  272  affiliate,  may  not 
 discriminate  between  the  company  or  affiliate  and  any  other  entity  in  the  provision  or  procurement  of  goods,  services,  facilities,  and  information,  or  in  the  establishment  of  standards.  47  U.  S.  C.    272(  c)(  1)  (emphasis  added). 

 311  In  the  CPNI  Order,  we  found  that  the  term  information  in  section  272(  c)(  1)  does  not  include  CPNI.  CPNI 
 Order,  13  FCC  Rcd  at  8172,  para.  154.  Our  finding  in  that  order  overruled  our  earlier  decision  in  the  Non-Accounting  Safeguards  Order  that  the  term  information  in  section  272(  c)(  1)  includes  CPNI.  Non-  Accounting 

 Safeguards  Order,  11  FCC  Rcd  at  22010,  para.  222.  We  affirmed  the  CPNI  Order  finding  in  the  CPNI  Reconsideration  Order.  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14481,  para.  137. 

 312  CPNI  Clarification  Order,  16  FCC  Rcd  at  16518-  19,  paras.  24-  26. 
 313  CPNI  Clarification  Order,  16  FCC  Rcd  at  16518-  19,  paras.  24-  26.  We  note  that  AT&  T  argues  that  the  Tenth 
 Circuits  opinion  vacated  all  of  the  Commissions  CPNI  Order.  According  to  AT&  T,  we  need  to  reconsider  the  interplay  between  sections  222  and  272.  AT&  T  Comments  at  11.  As  we  tentatively  concluded  in  the  Clarification 

 Order  and  affirm  in  this  order,  we  disagree  with  AT&  Ts  interpretation.  See  section  III.  B.  1,  supra;  CPNI  Clarification  Order,  16  FCC  Rcd  at  16510,  para.  7. 
 314  CPNI  Clarification  Order,  16  FCC  Rcd  at  16519,  para.  26. 
 315  Because  we  do  not  revise  our  earlier  decisions  for  the  reasons  discussed  herein,  we  do  not  address  the  other 
 arguments  raised  by  the  BOCs,  including  their  definitions  of  provision  and  service  under  section  272  and  their  argument  that  treating  BOC  affiliates  as  unaffiliated  entities  would  violate  the  BOCs  First  Amendment  rights  to 

 communicate  with  their  affiliates  and  customers.  SBC  Comments  at  17,  22-  24;  SBC  Reply  Comments  at  9. 
 316  CPNI  Order,  13  FCC  Rcd  at  8174  -79,  paras.  158-  169;  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14481-  87, 
 paras.  137-  145. 
60
 Federal  Communications  Commission  FCC  02-  214 
 61 
 upon  statutory  analysis  and  application  of  the  terms  used  in  the  Act.  317  However,  even  if  we  were  to  review  the  portion  of  analysis  that  discussed  the  opt-  in  mechanism,  we  would  still  reach  the 
 same  conclusion,  as  discussed  below. 
 137.  We  find  that  the  legal  basis  for  our  decision  does  not  change  with  our  modification  of  the  customer  approval  mechanism.  In  prior  orders,  the  Commission  found  that 

 in  the  context  of  the  1996  Act,  it  is  not  readily  apparent  that  the  meaning  of  information  in  section  272  necessarily  includes  CPNI.  The  Commission  found  that  the  most  reasonable 
 interpretation  of  the  interplay  between  sections  222  and  272  is  that  section  272  does  not  impose  any  additional  CPNI  requirements  on  BOCs  sharing  of  CPNI  with  their  section  272  affiliates 
 when  they  share  information  with  their  section  272  affiliates  according  to  the  requirements  of  section  222.  318  The  Commission  found  this  to  be  reasonable  because,  as  we  have  affirmed 
 above,  319  section  222(  c)(  1)  contemplates  that,  under  the  total  service  approach,  carriers  have  implied  approval  to  market  services  within  the  package  of  services  to  which  the  customer 
 subscribes,  and  can  also  share  CPNI  with  their  affiliates  to  do  so.  However,  section  272(  c)(  1)  prohibits  BOCs  from  discriminating  against  other  parties  in  the  provision  and  procurement  of 
 information.  Thus,  if  information  includes  CPNI,  BOCs  would  be  unable  to  share  CPNI  with  their  affiliates  to  the  extent  contemplated  by  section  222,  unless  they  also  met  the 
 nondiscrimination  requirements  of  section  272.  To  meet  these  requirements,  the  BOC  would  be  required,  under  section  222,  to  seek  express  approval  from  its  customers  to  share  CPNI  with  its 
 affiliates  and  with  any  third  parties.  320  Thus,  the  Commission  found  that  these  requirements,  in  the  context  of  an  opt-  in  approach,  pose  a  potentially  insurmountable  burden  because  a  BOC 
 soliciting  approval  to  share  CPNI  with  its  affiliates  would  have  to  solicit  approval  for  countless  other  carriers  as  well,  known  or  unknown.  321 

 138.  This  rationale  is  still  applicable  under  the  Commissions  new  approval  mechanism.  First,  because  opt-  in  is  required  for  third  parties,  a  BOC  would  still  need  to  obtain 
 express  approval  for  sharing  with  its  272  affiliates  and  third  parties  to  meet  the  nondiscrimination  requirements  of  272.  322  Applying  opt-  out  to  intracompany  sharing  would  not 
 therefore  alter  the  potentially  insurmountable  burden  upon  BOCs  to  obtain  customer  approval 
 317  CPNI  Order,  13  FCC  Rcd  at  8174-  8176,  paras.  160-  162;  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14482- 
 87,  paras.  139-  144;  In  the  Matter  of  AT&  T  Corp.  v.  New  York  Telephone  Co.,  d/  b/  a  Bell  Atlantic    New  York,  15  FCC  Rcd  19997,  20004-  05  (2000).  The  Commission  also  listed  other  rationales,  which  were  independent  of 

 Commissions  view  that  one  of  Congress  purposes  in  enacting  222  was  to  promote  competition. 
 318  CPNI  Order,  13  FCC  Rcd  at  8174-  75,  8179,  paras.  160,  169;  CPNI  Reconsideration  Order,  14  FCC  Rcd  at 
 14480-  81,  para.  136.  319 
 See  section  III.  B.  2,  supra. 
 320  CPNI  Order,  13  FCC  Rcd  at  8174,  paras.  158-  59;  CPNI  Clarification  Order,  16  FCC  Rcd  at  16518-  19,  para. 
 25.  321 
 CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14485,  para.  142.  322 
 A  few  commenters  argue  that  BOCs  section  272  affiliates  effectively  should  be  treated  as  third  parties  instead  of  intra-  company  affiliates  with  respect  to  the  disclosure  and  use  of  CPNI  to  neutralize  the  BOC  affiliates 

 competitive  disparity.  AT&  T  Comments  at  15;  Nextel  Comments  at  12-  13. 
61
 Federal  Communications  Commission  FCC  02-  214 
 62 
 either.  Even  in  a  completely  opt-  out  environment,  a  BOC  seeking  to  share  CPNI  with  its  affiliates  would  have  to  solicit  approval  for  countless  other  carriers  as  well,  known  or 
 unknown.  323  We  find  that  this  result  is  neither  required  by  the  statute  nor  is  it  necessary  to  protect  consumers  privacy  interests.  If  we  adopted  AT&  Ts  proposal  to  allow  competing 
 carriers  to  obtain  CPNI  on  the  same  basis  as  the  BOCs  272  affiliates    that  is,  using  an  opt-  out  approval  method  under  the  rules  adopted  today    we  would  defeat  our  purpose  in  requiring  opt-in 
 approval  for  third  parties.  As  described  above,  we  have  found  that  disclosure  to  and  use  of  CPNI  by  third  parties  requires  greater  assurance  of  a  customers  knowing  consent  to  prevent 
 unintentional  disclosure  of  CPNI.  Therefore,  as  in  our  previous  orders,  we  still  find  that  our  interpretation  best  furthers  the  goals  of  Congress  to  protect  customer  privacy  and  to  promote 
 customer  convenience  and  control.  324 
 139.  At  any  rate,  the  Commission  has  previously  concluded  that  section  222s  customer  privacy  protections  effectively  preclude  the  same  anticompetitive  behaviors  as  section 

 272,  and  this  conclusion  is  not  altered  by  the  Order  we  adopt  today.  325  In  the  CPNI  Reconsideration  Order,  the  Commission  outlined  three  factors  in  section  222  that  eliminate  the 
 necessity  for  the  application  of  section  272s  nondiscrimination  requirements  to  prevent  anticompetitive  harms.  326  First,  competitors  are  still  afforded  access  to  customer  CPNI  through 
 section  222(  c)(  2),  which  requires  disclosure  of  CPNI  to  any  person  designated  by  the  customer,  upon  affirmative  written  request  by  the  customer.  327  Changing  the  mechanism  for 
 obtaining  customer  approval  under  section  222(  c)(  1)  does  not  alter  the  ability  of  competitors  to  obtain  CPNI  through  section  222(  c)(  2).  Second,  section  222(  c)(  3)  continues  to  allow  a  LEC  to 
 use  customer  aggregate  information  only  if  it  provides  that  information  to  other  carriers  upon  reasonable  request.  328  Again,  changing  section  222(  c)(  1)  s  approval  mechanism  does  not  alter 
 the  ability  of  competitors  to  obtain  aggregate  information  through  section  222(  c)(  3). 
 140.  Third,  the  Commission  stated  that  under  the  opt-  in  mechanism,  BOCs  could  not  share  CPNI  with  their  section  272  affiliates  unless  they  either  obtained  express  customer 

 approval  or  the  customer  is  an  existing  subscriber  of  a  service  of  that  affiliate.  329  Under  the  opt-in/  opt-  out  mechanisms  established  in  this  Order,  BOCs  are  allowed  to  share  customer  CPNI  with 

 323  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14485,  para.  142. 
 324  CPNI  Order,  13  FCC  Rcd  at  8174-  75,  para.  160;  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14485,  para. 
 142. 
 325  CPNI  Order,  13  FCC  Rcd  at  8177,  para.  164.  We  disagree  with  AT&  Ts  assertion  that  the  Commissions 
 decision  to  implement  an  opt-  in  policy  was  inextricably  intertwined  with  the  interpretation  of  section  272.  AT&  T  Comments  at  12.  The  Commission  only  tangentially  discussed  the  opt-  in  policy  in  its  prior  analysis  of  the  interplay 

 of  sections  222  and  272,  and  AT&  T  has  provided  us  with  no  convincing  argument  to  the  contrary. 
 326  CPNI  Order,  13  FCC  Rcd  at  8177-  78,  paras.  164-  65. 

 327  47  U.  S.  C.    222(  c)(  2). 
 328  SBC  Comments  at  21. 
 329  CPNI  Order,  13  FCC  Rcd  at  8177,  para.  164. 
62
 Federal  Communications  Commission  FCC  02-  214 
 63 
 their  section  272  affiliates  without  obtaining  express  customer  approval.  Under  the  opt-  out  approval  mechanism  we  adopt  today,  BOCs  must  still  provide  customer  notice  and  the 
 opportunity  for  customers  to  opt  out  for  CPNI  uses  beyond  the  existing  carrier-  customer  relationship  prior  to  sharing  CPNI  with  an  affiliate.  330  However,  as  a  practical  matter,  it  is  likely 
 that  the  BOCs  will  be  able  to  share  more  CPNI  with  their  272  affiliates  under  opt-  out  than  they  would  have  been  able  to  share  under  opt-  in.  As  shown  above,  consumers  typically  will  accept 
 whatever  choice  does  not  require  any  action  on  their  part.  331  As  a  result,  when  the  default  is  opt-out,  carriers  will  be  able  to  use  more  customer  CPNI.  332 

 141.  The  possibility  that  BOCs  will  share  more  CPNI  with  their  affiliates  does  not  tip  the  scale  to  require  application  of  section  272  to  CPNI.  333  First,  section  222  applies  to  all 
 telecommunications  carriers  and  does  not  single  out  any  carriers  for  specific  treatment,  signaling  Congress  intent  that  all  carriers  should  be  treated  alike  in  the  CPNI  context.  For 
 example,  an  interexchange  carrier  with  a  significant  customer  base  can  share  CPNI,  after  receiving  opt-  out  approval,  with  its  local  or  wireless  affiliates.  Thus,  under  our  rules,  all  carriers 
 can  share  CPNI  with  their  affiliates.  Accordingly,  we  decline  to  place  additional  restrictions  upon  BOCs.  Second,  section  272(  g)  allows  BOCs  and  their  section  272  affiliates  to  market  their 
 services  jointly.  334  A  fair  reading  of  that  section  indicates  that  Congress  did  not  intend  to  preclude  BOCs  and  their  long  distance  affiliates  from  conducting  joint  marketing,  which  is  the 
 primary  intent  behind  CPNI  use.  335  As  we  found  in  earlier  orders,  we  believe  our  conclusion  is  therefore  consistent  with  the  regulatory  symmetry  Congress  intended  for  carrier  marketing 
 activities.  336 
 142.  Finally,  numerous  commenters  used  the  Further  NPRM  as  an  opportunity  to  reargue  the  statutory  and  policy  issues  that  we  have  previously  addressed  and  that  are  unrelated 

 330  Under  the  total  service  approach,  carriers  can  use  a  customers  CPNI  to  market  services  with  the  parameters  of 
 the  existing  customer-  carrier  relationship.  See  section  III.  B.  2,  infra.  So  a  carriers  affiliate  could  use  the  CPNI  without  notice  and  approval  if  the  affiliate  were  marketing  the  same  services  the  customer  already  uses. 

 331  See  section  III.  A,  supra. 
 332  Id. 
 333  Sections  251  and  201(  b)  ensure  that  BOCs  disclose  customer  information  in  connection  with  their 
 interconnection  obligations  and  by  requiring  the  BOC  to  act  in  a  reasonable  manner.  SBC  Comments  at  21. 
 334  47  U.  S.  C.    272(  g). 

 335  Several  commenters  agree  with  us  that  section  272(  g)  allows  the  BOCs  to  conduct  joint  marketing  with  their 
 272  affiliates,  while  arguing  that  if  the  BOCs  272  affiliates  use  BOC  customer  CPNI,  the  BOCs  must  provide  that  CPNI  to  competitive  carriers.  ASCENT  Reply  Comments  at  7;  AT&  T  Reply  Comments  at  19;  Excel  Reply 

 Comments  at  12;  WorldCom  Reply  Comments  at  9.  The  exact  nature  of  BOC/  272  affiliate  joint  marketing  was  not  explicitly  detailed  in  the  statute,  and  therefore  we  must  decide  what  is  permissible.  For  all  the  reasons  described 
 above,  we  have  drawn  the  line  more  broadly  than  the  commenters  would  like. 
 336  CPNI  Order,  13  FCC  Rcd  at  8178,  para.  167. 
63
 Federal  Communications  Commission  FCC  02-  214 
 64 
 to  the  issue  before  us.  337  AT&  T  and  other  commenters  that  request  we  reverse  our  holding  in  the  CPNI  Order  do  not  get  yet  another  bite  at  the  apple.  The  Commission  has  previously 
 considered  these  arguments  in  both  the  CPNI  Order  and  the  CPNI  Reconsideration  Order.  338  The  Further  NPRM  did  not  request  comment  on  these  issues,  and  commenters  have  not 
 presented  changed  circumstances,  new  evidence  or  additional  arguments  that  would  affect  our  prior  decisions.  Therefore,  we  decline  to  address  them  again  here. 

 IV.  THIRD  FURTHER  NOTICE  OF  PROPOSED  RULEMAKING 
 143.  In  this  Further  Notice  of  Proposed  Rulemaking,  we  seek  to  refresh  the  record  on  two  issues  raised  in  the  CPNI  Order  Further  NPRM  and  we  request  comment  on  an  issue  of 

 emerging  importance,  CPNI  implications  when  a  carrier  goes  out  of  business,  sells  all  or  part  of  its  customer  base,  or  seeks  bankruptcy  protection. 

 A.  Regulation  of  Foreign  Storage  of  and  Access  to  Domestic  CPNI 
 144.  In  a  July  8,  1997  Ex  Parte  letter,  the  FBI  requested  that  the  Commission  regulate  the  foreign  storage  of  and  foreign-  based  access  to  CPNI  of  U.  S.  customers  who  use  domestic 

 telecommunications  services.  339  The  Commission  requested  comment  on  this  proposal  in  its  CPNI  Order  Further  NPRM.  340  As  an  alternative,  the  FBI  suggested  that  foreign  storage  or 
 access  to  domestic  CPNI  be  permitted  only  upon  informed  written  customer  approval.  To  the  degree  that  CPNI  is  stored  in  a  foreign  country,  the  FBI  asked  that  the  Commission  require 
 carriers  to  keep  a  copy  of  customers  CPNI  records  within  the  U.  S.  for  public  safety,  law  enforcement,  and  national  security  reasons.  The  FBI  also  requested  that  we  require  carriers  to 
 maintain  copies  of  the  CPNI  of  all  U.  S.-  based  customers  because  of  the  need  for  prompt  and  secure  law  enforcement  purposes.  The  Commission  now  requests  that  commenters  refresh  the 
 record  on  this  topic.  Specifically,  we  request  that  commenters  consider  the  FBI  proposal  in  light  of  heightened  national  security  concerns.  In  addition,  we  request  input  as  to  whether  any  of  the 
 concerns  raised  by  the  FBI  have  been  realized  since  comments  were  received  on  this  topic.  Finally,  we  ask  commenters  to  provide  estimates  of  the  costs  that  would  be  incurred  if  we  were 
 to  mandate  carriers  to  maintain  the  domestic  storage  of,  and  access  to,  domestic  CPNI. 

 337  Commenters  argue  that  (1)  the  Commissions  statutory  interpretation  is  incorrect  and  (2)  BOCs  must  operate 
 independently  and  therefore  be  treated  as  third  parties.  AT&  T  Comments  at  12-  15;  WorldCom  Comments  at  11;  ASCENT  Reply  Comments  at  3;  Excel  Reply  Comments  at  7-  10.  WorldCom  also  argues  that,  with  an  opt-  out 

 mechanism,  sections  222  and  272  are  not  in  conflict.  WorldCom  Reply  at  6. 
 338  CPNI  Order,  13  FCC  Rcd  at  8174-  79,  paras.  158-  169;  CPNI  Reconsideration  Order,  14  FCC  Rcd  at  14481-  87, 
 paras.  137-  145. 
 339  Letter  from  John  F.  Lewis,  Jr.,  Federal  Bureau  of  Investigation,  to  William  F.  Caton,  Acting  Secretary,  Federal 
 Communications  Commission,  CC  Docket  No.  96-  115  (filed  July  8,  1997)  (FBI  July  8,  1998  Ex  Parte  Letter). 
 340  CPNI  Order,  13  FCC  Rcd  at  8203-  8204,  paras.  208-  210. 
64
 Federal  Communications  Commission  FCC  02-  214 
 65 
 B.  Protections  for  Carrier  Information  and  Enforcement  Mechanisms 
 145.  In  the  CPNI  Order  Further  NPRM,  341  the  Commission  sought  comment  on  what  safeguards  in  addition  to  those  adopted  in  the  CPNI  Order,  if  any,  are  needed  to  protect  the 

 confidentiality  of  carrier  proprietary  information  (CPI),  including  that  of  resellers  and  ISPs.  The  CPNI  Order  Further  NPRM  also  sought  comment  on  what,  if  any,  further  enforcement 
 mechanisms  the  Commission  should  adopt  to  ensure  carrier  compliance  with  our  CPNI  policies  and  rules.  342  We  seek  to  refresh  the  record  on  this  topic.  Specifically,  we  request  that  in  light  of 
 the  fact  that  carriers  and  other  interested  parties  have  actual  experience  with  problems,  commenters  describe  what,  if  any,  problems  have  occurred  since  we  originally  issued  the  CPNI 
 Order  Further  NPRM. 
 C.  CPNI  Implications  When  a  Carrier  Goes  Out  of  Business 
 146.  In  light  of  inquiries  the  Commission  has  received  in  the  face  of  recent  carrier  bankruptcies,  mergers,  and  asset  sales,  the  Commission  seeks  comment  on  carrier  use  and 

 disclosure  of  CPNI  when  it  sells  its  assets  or  goes  out  of  business.  We  seek  comment  on  whether  an  exiting  carrier  should  be  able  to  use  CPNI  for  transition  of  its  customers  to  another  carrier.  If 
 commenters  believe  that  an  exiting  carrier  should  be  able  to  disclose  CPNI  to  the  acquiring  carrier,  should  we  require  the  exiting  carrier  to  state  that  fact  in  advance  notice  provided  to 
 customers  acquired  by  the  sale  or  transfer  from  another  carrier  in  compliance  with  our  authorization  and  verification  (slamming)  rules?  343  Further,  to  the  degree  that  the  exiting  carrier 
 has  obtained  CPNI  approvals  from  its  customer,  should  the  new  carrier  be  deemed  to  have  received  such  approvals,  or  should  it  be  required  to  provide  notice  and  obtain  approval  for  CPNI 
 use  and  disclosure  from  the  acquired  customers?  Also,  what  is  the  proper  application  of  section  222  to  DSL  providers?  Will  this  applicability  change  if  the  Commission  adopts  the  tentative 
 conclusions  in  the  Wireline  Broadband  NPRM?  344 
 147.  Further,  should  the  Commission  recognize  a  difference  between  service  types?  For  example,  the  Commission  might  allow  more  liberal  CPNI  sharing  to  effectuate  a  LECs 

 customer  base  transition  than  other  types  of  service  to  ensure  that  customers  continue  to  receive  dial  tone.  We  also  seek  comment  on  whether  carriers  can  sell  CPNI  as  an  asset.  If  not,  is  such  a 
 limitation  constitutional?  Would  such  regulations  go  beyond  the  scope  of  section  222  or  the  Commissions  authority?  345 

 341  CPNI  Order,  13  FCC  Rcd  at  8201-  8202,  paras.  206-  207. 
 342  Id. 
 343  47  C.  F.  R.    64.  1120(  e)  and  orders  in  CC  Docket  No.  00-  257. 
 344  Appropriate  Framework  for  Broadband  Access  to  the  Internet  Over  Wireline  Facilities,  Universal  Service 
 Obligations  of  Broadband  Providers,  CC  Docket  No.  02-  33,  Notice  of  Proposed  Rulemaking  (rel.  Feb.  15,  2002). 
 345  Qwest  Comments  at  15,  n.  52. 
65
 Federal  Communications  Commission  FCC  02-  214 
 66 
 V.  PROCEDURAL  MATTERS 
 A.  Third  Report  and  Order 
 1.  Final  Regulatory  Flexibility  Analysis 
 148.  As  required  by  the  Regulatory  Flexibility  Act,  as  amended,  (RFA),  346  an  Initial  Regulatory  Flexibility  Analysis  (IRFA)  was  incorporated  in  the  CPNI  Clarification  Order 

 Further  NPRM.  347  The  Commission  sought  written  public  comment  on  the  proposals  in  the  CPNI  Clarification  Order  Further  NPRM,  including  comment  on  the  IRFA.  Appendix  C  sets 
 forth  a  Final  Regulatory  Flexibility  Analysis  for  the  present  Report  and  Order. 
 2.  Final  Paperwork  Reduction  Act  Analysis 
 149.  This  Order  contains  new  and  modified  information  collections  subject  to  the  Paperwork  Reduction  Act  of  1995  (PRA),  Public  Law  104-  13.  It  will  be  submitted  to  the  Office 

 of  Management  and  Budget  (OMB)  for  review  under  Section  3507(  d)  of  the  PRA.  OMB,  the  general  public,  and  other  Federal  agencies  are  invited  to  comment  on  the  new  or  modified 
 information  collection(  s)  contained  in  this  proceeding.  Implementation  of  these  new  or  modified  reporting  and/  or  recordkeeping  requirements  will  be  subject  to  approval  by  the  OMB,  as 
 prescribed  by  the  Act,  and  will  go  into  effect  upon  announcement  in  the  Federal  Register  of  OMB  approval. 

 B.  Third  Further  Notice  of  Proposed  Rulemaking 
 1.  Ex  Parte  Presentations 
 150.  These  matters  shall  be  treated  as  a  permit-  but-  disclose  proceeding  in  accordance  with  the  Commissions  ex  parte  rules.  348  Persons  making  oral  ex  parte  presentations 

 are  reminded  that  memoranda  summarizing  the  presentations  must  contain  summaries  of  the  substance  of  the  presentations  and  not  merely  a  listing  of  the  subjects  discussed.  More  than  a 
 one  or  two  sentence  description  of  the  views  and  arguments  presented  is  generally  required.  349  Other  rules  pertaining  to  oral  and  written  presentations  are  set  forth  in  section  1.1206(  b)  as  well. 

 2.  Initial  Regulatory  Flexibility  Act  Analysis 
 151.  Appendix  D  sets  forth  the  Commissions  IRFA  regarding  policies  and  rules  proposed  in  the  Third  Further  NPRM.  Written  public  comments  are  requested  on  this  IRFA. 

 346  See  5  U.  S.  C.    603.  The  RFA,  5  U.  S.  C.    601-  612,  has  been  amended  by  the  Small  Business  Regulatory 
 Enforcement  Fairness  Act  of  1996  (SBREFA),  Pub.  L.  No.  104-  121,  Title  II,  110  Stat.  857  (1996). 
 347  See  CPNI  Clarification  Order,  16  FCC  Rcd  at  16527-  37. 

 348  47  C.  F.  R.    1.  1200  et  seq. 
 349  See  47  C.  F.  R.    1.1206(  b)(  2). 
66
 Federal  Communications  Commission  FCC  02-  214 
 67 
 Comments  must  be  identified  as  responses  to  the  IRFA  and  must  be  filed  by  the  deadlines  for  comments  on  the  Third  Further  NPRM.  The  Commission  will  send  a  copy  of  the  Third  Further 
 NPRM,  including  this  IRFA,  to  the  Chief  Counsel  for  Advocacy  of  the  Small  Business  Administration.  350  In  addition,  the  Third  Further  NPRM  and  IRFA  (or  summaries  thereof)  will 
 be  published  in  the  Federal  Register.  351 
 3.  Initial  Paperwork  Reduction  Act  Analysis 
 152.  This  Third  Further  NPRM  may  modify  an  information  collection.  As  part  of  our  continuing  effort  to  reduce  paperwork  burdens,  we  invite  the  general  public  and  the  Office  of 

 Management  and  Budget  (OMB)  to  take  this  opportunity  to  comment  on  the  possible  changes  in  information  collections  contained  in  this  Third  Further  NPRM,  as  required  by  the  Paperwork 
 Reduction  Act  of  1995,  Pub.  L.  No.  104-  13.  Public  and  agency  comments  are  due  at  the  same  time  as  other  comments  on  this  NPRM;  OMB  comments  are  due  60  days  from  date  of 
 publication  of  this  Third  Further  NPRM  in  the  Federal  Register.  Comments  should  address:  (1)  whether  the  possible  changes  in  the  collections  of  information  are  necessary  for  the  proper 
 performance  of  the  functions  of  the  Commission,  including  whether  the  information  will  have  practical  utility;  (2)  the  accuracy  of  the  Commissions  burden  estimates;  (3)  ways  to  enhance  the 
 quality,  utility,  and  clarity  of  any  information  collected;  and  (4)  ways  to  minimize  the  burden  of  any  collection  of  information  on  the  respondents,  including  the  use  of  automated  collection 
 techniques  or  other  forms  of  information  technology. 
 4.  Comment  Filing  Procedures 
 153.  Pursuant  to  Sections  1.415  and  1.419  of  the  Commissions  rules,  47  C.  F.  R.    1.415,  1.419,  interested  parties  may  file  comments  on  or  before  30  days  after  Federal  Register 

 Publication  of  this  NPRM,  and  reply  comments  on  or  before  60  days  after  Federal  Register  Publication  of  this  NPRM.  Comments  may  be  filed  using  the  Commissions  Electronic 
 Comment  Filing  System  (ECFS)  or  by  filing  paper  copies.  See  Electronic  Filing  of  Documents  in  Rulemaking  Proceedings,  63  Fed.  Reg.  24121  (1998). 

 154.  Comments  filed  through  the  ECFS  can  be  sent  as  an  electronic  file  via  the  Internet  to  <http://  www.  fcc.  gov/  e-  file/  ecfs.  html>.  Generally,  only  one  copy  of  an  electronic  submission 
 must  be  filed.  If  multiple  dockets  or  rulemaking  numbers  appear  in  the  caption  of  this  proceeding,  however,  commenters  must  transmit  one  electronic  copy  of  the  comments  to  each 
 docket  or  rulemaking  number  referenced  in  the  caption.  In  completing  the  transmittal  screen,  commenters  should  include  their  full  name,  U.  S.  Postal  Service  mailing  address,  and  the 
 applicable  docket  or  rulemaking  number.  Parties  may  also  submit  an  electronic  comment  by  Internet  e-  mail.  To  get  filing  instructions  for  e-  mail  comments,  commenters  should  send  an  e-mail 
 to  ecfs@  fcc.  gov,  and  should  include  the  following  words  in  the  body  of  the  message,  get  form  <your  e-  mail  address>.  A  sample  form  and  directions  will  be  sent  in  reply.  Parties  who 
 choose  to  file  by  paper  must  file  an  original  and  four  copies  of  each  filing.  In  more  than  one 
 350  See  5  U.  S.  C.    603(  a). 
 351  Id. 
67
 Federal  Communications  Commission  FCC  02-  214 
 68 
 docket  or  rulemaking  number  appear  in  the  caption  of  this  proceeding,  commenters  must  submit  two  additional  copies  for  each  additional  docket  or  rulemaking  number.  Filings  can  be  sent  by 
 hand  or  messenger  delivery,  by  commercial  overnight  courier,  or  by  first-  class  or  overnight  U.  S.  Postal  Service  mail  (although  we  continue  to  experience  delays  in  receiving  U.  S.  Postal  Service 
 mail).  The  Commissions  contractor,  Vistronix,  Inc.,  will  receive  hand-  delivered  or  messenger-delivered  paper  filings  for  the  Commissions  Secretary  at  236  Massachusetts  Ave.,  N.  E.,  Suite 
 110,  Washington,  D.  C.,  20002.  The  filing  hours  at  this  location  are  8:  00  a.  m.  to  7:  00  p.  m.  All  hand  deliveries  must  be  held  together  with  rubber  bands  or  fasteners.  Any  envelopes  must  be 
 disposed  of  before  entering  the  building.  Commercial  overnight  mail  (other  than  U.  S.  Postal  Service  Express  Mail  or  Priority  Mail)  must  be  sent  to  9300  East  Hampton  Drive,  Capitol 
 Heights,  MD  20743.  U.  S.  Postal  Service  first-  class  mail,  Express  Mail,  and  Priority  Mail  should  be  addressed  to  445  12  th  Street,  SW,  Washington,  D.  C.  20554.  All  filings  must  be  addressed  to 
 the  Commissions  Secretary,  Office  of  the  Secretary,  Federal  Communications  Commission. 
 VI.  ORDERING  CLAUSES 
 155.  Accordingly,  IT  IS  ORDERED,  pursuant  to  Sections  1,  4(  i),  222  and  303(  r)  of  the  Communications  Act  of  1934,  as  amended,  47  U.  S.  C.    151,  154(  i),  222  and  303(  r  ),  that  the 

 Third  Report  and  Order  and  Third  Further  Notice  of  Proposed  Rulemaking  in  CC  Docket  Nos.  96-  115,  96-  149,  and  00-  257  ARE  ADOPTED,  and  that  Part  64  of  the  Commissions  rules,  47 
 C.  F.  R.  Part  64,  is  amended  as  set  forth  in  Appendix  B.  The  requirements  of  this  Order  shall  become  effective  30  days  after  publication  of  a  summary  thereof  in  the  Federal  Register. 
 Sections  64.2007,  64.2008,  and  64.2009  contain  new  or  modified  information  collections  that  have  not  been  approved  by  OMB.  The  Commission  will  publish  a  document  in  the  Federal 
 Register  announcing  the  effective  date  of  these  rules. 
 156.  IT  IS  FURTHER  ORDERED  that  the  collection  of  information  contained  herein  is  contingent  upon  approval  by  the  Office  of  Management  and  Budget. 

 157.  IT  IS  FURTHER  ORDERED  that  the  California  Public  Utilities  Commissions  Motion  to  Accept  Late-  Filed  Comments  is  hereby  GRANTED. 
 158.  IT  IS  FURTHER  ORDERED  that,  pursuant  to  sections  1,  4(  i),  10  and  222  of  the  Communications  Act  of  1934,  as  amended,  47  U.  S.  C.    151,  154(  i),  160  and  222,  MCI 
 WorldComs  Petition  for  Further  Reconsideration  IS  GRANTED  to  the  extent  indicated  herein  and  otherwise  DENIED. 

 159.  IT  IS  FURTHER  ORDERED  that  the  Commissions  Consumer  and  Governmental  Affairs  Bureau,  Reference  Information  Center,  SHALL  SEND  a  copy  of  this 
 Third  Report  and  Order,  including  the  Final  Regulatory  Flexibility  Analysis,  to  the  Chief  Counsel  for  Advocacy  of  the  Small  Business  Administration. 

 FEDERAL  COMMUNICATIONS  COMMISSION 

 Marlene  H.  Dortch  Secretary 
68
 Federal  Communications  Commission  FCC  02-  214 
 APPENDIX  A 
 Comments  Filed 
 ALLTEL  Communications,  Inc.  AT&  T  Corp. 
 AT&  T  Wireless  Services,  Inc.  ATX  Technologies,  Inc. 
 Association  of  Communications  Enterprises  (ASCENT)  BellSouth  Corporation 
 California  Public  Utility  Commission  (Cal.  PUC)  Cellular  Telecommunications  &  Internet  Association  (CTIA) 
 CenturyTel,  Inc.  Cingular  Wireless  LLC 
 Competition  Policy  Institute  (CPI)  Direct  Marketing  Association 
 Electronic  Privacy  Information  Center,  American  Civil  Liberties  Union,  American  Library  Association,  Center  for  Digital  democracy,  Center  for  Media  Education,  Computer 
 Professionals  for  Social  Responsibility,  Consumer  Action,  Consumer  federation  of  America,  Junkbusters,  Media  Access,  PrivacyActivism,  Privacy  Journal,  Privacy  Right 
 Clearinghouse,  Privacy  Times,  Public  Citizens  Litigation  Group,  and  US  PIRG  (EPIC  et  al.) 
 Intellione  Inc.  Mpower  Communications  Corp. 
 National  Association  of  Regulatory  Utility  Commissioners  (NARUC)  National  Telephone  Cooperative  Association  (NTCA) 
 Nextel  Communications,  Inc.  Organization  for  the  Promotion  and  Advancement  of  Small  Telecommunications  Companies 
 (OPASTCO)  Qwest  Services  Corporation 
 SBC  Communications,  Inc.  Sprint  Corporation 
 United  States  Telecom  Association  (USTA)  VarTec  Telecom,  Inc. 
 Verizon  Verizon  Wireless 
 WorldCom,  Inc. 
69
 Federal  Communications  Commission  FCC  02-  214 
 2 
 Reply  Comments  Filed 
 Association  of  Communications  Enterprises  (ASCENT)  AT&  T  Corp. 
 ATX  Technologies,  Inc.  CTSI,  LLC 
 Direct  Marketing  Association  (DMA)  EPIC  et  al. 
 Excel  Communications,  Inc.  Intelligent  Transportation  Society  of  America  (ITSA) 
 Mercedes-  Benz  USA,  LLC  National  Association  of  Regulatory  Utility  Commissioners  (NARUC) 
 Progress  &  Freedom  Foundation  (PFF)  Qwest  Services  Corporation 
 SBC  Communications,  Inc.  United  States  Telecom  Association  (USTA) 
 VarTec  Telecom,  Inc.  Verizon 
 Verizon  Wireless  WorldCom,  Inc. 
70
 Federal  Communications  Commission  FCC  02-  214 
 APPENDIX  B    Final  Rules 
 Part  64  of  Title  47  of  the  Code  of  Federal  Regulations  is  revised  to  read  as  follows: 
 *  *  *  *  * 
 Subpart  U    Customer  Proprietary  Network  Information 

   64.2001  Basis  and  Purpose. 
 (a)  Basis.  The  rules  in  this  subpart  are  issued  pursuant  to  the  Communications  Act  of  1934,  as  amended. 

 (b)  Purpose.  The  purpose  of  the  rules  in  this  subpart  is  to  implement  section  222  of  the  Communications  Act  of  1934,  as  amended,  47  U.  S.  C.    222. 

   64.2003  Definitions. 
 Terms  in  this  subpart  have  the  following  meanings: 
 (a)  Affiliate.  The  term  affiliate  has  the  same  meaning  given  such  term  in  section  3(  1)  of  the  Communications  Act  of  1934,  as  amended,  47  U.  S.  C.    153(  1). 

 (b)  Communications-  related  services.  The  term  communications-  related  services  means  telecommunications  services,  information  services  typically  provided  by 
 telecommunications  carriers,  and  services  related  to  the  provision  or  maintenance  of  customer  premises  equipment. 

 (c)  Customer.  A  customer  of  a  telecommunications  carrier  is  a  person  or  entity  to  which  the  telecommunications  carrier  is  currently  providing  service. 
 (d)  Customer  proprietary  network  information  (CPNI).  The  term  customer  proprietary  network  information  (CPNI)  has  the  same  meaning  given  to  such  term  in  section  222(  h)(  1)  of 
 the  Communications  Act  of  1934,  as  amended,  47  U.  S.  C.    222(  h)(  1). 
 (e)  Customer  premises  equipment  (CPE).  The  term  customer  premises  equipment  (CPE)  has  the  same  meaning  given  to  such  term  in  section  3(  14)  of  the  Communications  Act  of 
 1934,  as  amended,  47  U.  S.  C.  153(  14). 
 (f)  Information  services  typically  provided  by  telecommunications  carriers.  The  phrase  "information  services  typically  provided  by  telecommunications  carriers"  means  only  those 
 information  services  (as  defined  in  section  3(  20)  of  the  Communications  Act  of  1934,  as  amended,  47  U.  S.  C.    153(  2))  that  are  typically  provided  by  telecommunications  carriers,  such 
71
 Federal  Communications  Commission  FCC  02-  214 
 2 
 as  Internet  access  or  voice  mail  services.  Such  phrase  information  services  typically  provided  by  telecommunications  carriers,"  as  used  in  this  subpart,  shall  not  include  retail  consumer 
 services  provided  using  Internet  websites  (such  as  travel  reservation  services  or  mortgage  lending  services),  whether  or  not  such  services  may  otherwise  be  considered  to  be  information 
 services. 
 (g)  Local  exchange  carrier  (LEC).  The  term  local  exchange  carrier  (LEC)  has  the  same  meaning  given  to  such  term  in  section  3(  26)  of  the  Communications  Act  of  1934,  as 
 amended,  47  U.  S.  C.    153(  26). 
 (h)  Opt-  in  approval.  The  term  opt-  in  approval  refers  to  a  method  for  obtaining  customer  consent  to  use,  disclose,  or  permit  access  to  the  customers  CPNI.  This  approval 
 method  requires  that  the  carrier  obtain  from  the  customer  affirmative,  express  consent  allowing  the  requested  CPNI  usage,  disclosure,  or  access  after  the  customer  is  provided  appropriate 
 notification  of  the  carriers  request  consistent  with  the  requirements  set  forth  in  this  subpart. 
 (i)  Opt-  out  approval.  The  term  opt-  out  approval  refers  to  a  method  for  obtaining  customer  consent  to  use,  disclose,  or  permit  access  to  the  customers  CPNI.  Under  this  approval 
 method,  a  customer  is  deemed  to  have  consented  to  the  use,  disclosure,  or  access  to  the  customers  CPNI  if  the  customer  has  failed  to  object  thereto  within  the  waiting  period  described 
 in  section  64.2009(  d)(  1)  of  this  subpart,  after  the  customer  is  provided  appropriate  notification  of  the  carriers  request  for  consent  consistent  with  the  rules  in  this  subpart. 

 (j)  Subscriber  list  information  (SLI).  The  term  subscriber  list  information  (SLI)  has  the  same  meaning  given  to  such  term  in  section  222(  h)(  3)  of  the  Communications  Act  of  1934, 
 as  amended,  47  U.  S.  C.    222(  h)(  3). 
 (k)  Telecommunications  carrier  or  carrier.  The  terms  telecommunications  carrier  or  carrier  shall  have  the  same  meaning  as  set  forth  in  section  3(  44)  of  the  Communications  Act  of 
 1934,  as  amended,  47  U.  S.  C.  153(  44). 
 (l)  Telecommunications  service.  The  term  telecommunications  service  has  the  same  meaning  given  to  such  term  in  section  3(  46)  of  the  Communications  Act  of  1934,  as  amended,  47 
 U.  S.  C.  153(  46). 

   64.2005  Use  of  Customer  Proprietary  Network  Information  Without  Customer  Approval. 
 (a)  Any  telecommunications  carrier  may  use,  disclose,  or  permit  access  to  CPNI  for  the  purpose  of  providing  or  marketing  service  offerings  among  the  categories  of  service  (i.  e.,  local, 
 interexchange,  and  CMRS)  to  which  the  customer  already  subscribes  from  the  same  carrier,  without  customer  approval. 

 (1)  If  a  telecommunications  carrier  provides  different  categories  of  service,  and  a  customer  subscribes  to  more  than  one  category  of  service  offered  by  the  carrier,  the  carrier  is 
72
 Federal  Communications  Commission  FCC  02-  214 
 3 
 permitted  to  share  CPNI  among  the  carrier's  affiliated  entities  that  provide  a  service  offering  to  the  customer. 
 (2)  If  a  telecommunications  carrier  provides  different  categories  of  service,  but  a  customer  does  not  subscribe  to  more  than  one  offering  by  the  carrier,  the  carrier  is  not  permitted 
 to  share  CPNI  with  its  affiliates,  except  as  provided  in  section  64.2007(  b). 
 (b)  A  telecommunications  carrier  may  not  use,  disclose,  or  permit  access  to  CPNI  to  market  to  a  customer  service  offerings  that  are  within  a  category  of  service  to  which  the 
 subscriber  does  not  already  subscribe  from  that  carrier,  unless  that  carrier  has  customer  approval  to  do  so,  except  as  described  in  paragraph  (c)  of  this  section. 

 (1)  A  wireless  provider  may  use,  disclose,  or  permit  access  to  CPNI  derived  from  its  provision  of  CMRS,  without  customer  approval,  for  the  provision  of  CPE  and  information 
 service(  s).  A  wireline  carrier  may  use,  disclose  or  permit  access  to  CPNI  derived  from  its  provision  of  local  exchange  service  or  interexchange  service,  without  customer  approval,  for  the 
 provision  of  CPE  and  call  answering,  voice  mail  or  messaging,  voice  storage  and  retrieval  services,  fax  store  and  forward,  and  protocol  conversion. 

 (2)  A  telecommunications  carrier  may  not  use,  disclose  or  permit  access  to  CPNI  to  identify  or  track  customers  that  call  competing  service  providers.  For  example,  a  local  exchange 
 carrier  may  not  use  local  service  CPNI  to  track  all  customers  that  call  local  service  competitors. 
 (c)  A  telecommunications  carrier  may  use,  disclose,  or  permit  access  to  CPNI,  without  customer  approval,  as  described  in  this  subparagraph  (c). 

 (1)  A  telecommunications  carrier  may  use,  disclose,  or  permit  access  to  CPNI,  without  customer  approval,  in  its  provision  of  inside  wiring  installation,  maintenance,  and  repair  services. 
 (2)  CMRS  providers  may  use,  disclose,  or  permit  access  to  CPNI  for  the  purpose  of  conducting  research  on  the  health  effects  of  CMRS. 
 (3)  LECs  and  CMRS  providers  may  use  CPNI,  without  customer  approval,  to  market  services  formerly  known  as  adjunct-  to-  basic  services,  such  as,  but  not  limited  to,  speed  dialing, 
 computer-  provided  directory  assistance,  call  monitoring,  call  tracing,  call  blocking,  call  return,  repeat  dialing,  call  tracking,  call  waiting,  caller  I.  D.,  call  forwarding,  and  certain  centrex 
 features. 
 (d)  A  telecommunications  carrier  may  use,  disclose  or  permit  access  to  CPNI  to  protect  the  rights  or  property  of  the  carrier,  or  to  protect  users  of  those  services  and  other  carriers  from 
 fraudulent,  abusive,  or  unlawful  use  of,  or  subscription  to,  such  services. 

   64.2007  Approval  Required  for  Use  of  Customer  Proprietary  Network  Information. 
 (a)  A  telecommunications  carrier  may  obtain  approval  through  written,  oral  or  electronic 
73
 Federal  Communications  Commission  FCC  02-  214 
 4 
 methods. 
 (1)  A  telecommunications  carrier  relying  on  oral  approval  shall  bear  the  burden  of  demonstrating  that  such  approval  has  been  given  in  compliance  with  the  Commission's  rules  in 
 this  part. 
 (2)  Approval  or  disapproval  to  use,  disclose,  or  permit  access  to  a  customers  CPNI  obtained  by  a  telecommunications  carrier  must  remain  in  effect  until  the  customer  revokes  or 
 limits  such  approval  or  disapproval. 
 (3)  A  telecommunications  carrier  must  maintain  records  of  approval,  whether  oral,  written  or  electronic,  for  at  least  one  year. 

 (b)  Use  of  Opt-  Out  and  Opt-  In  Approval  Processes. 
 (1)  A  telecommunications  carrier  may,  subject  to  opt-  out  approval  or  opt-  in  approval,  use  its  customers  individually  identifiable  CPNI  for  the  purpose  of  marketing  communications-related 

 services  to  that  customer.  A  telecommunications  carrier  may,  subject  to  opt-  out  approval  or  opt-  in  approval,  disclose  its  customers  individually  identifiable  CPNI,  for  the  purpose  of 
 marketing  communications-  related  services  to  that  customer,  to  (i)  its  agents,  (ii)  its  affiliates  that  provide  communications-  related  services,  and  (iii)  its  joint  venture  partners  and  independent 
 contractors.  A  telecommunications  carrier  may  also  permit  such  persons  or  entities  to  obtain  access  to  such  CPNI  for  such  purposes.  Any  such  disclosure  to  or  access  provided  to  joint 
 venture  partners  and  independent  contractors  shall  be  subject  to  the  safeguards  set  forth  below  in  paragraph  (2)  of  this  subsection  (b). 

 (2)  Joint  Venture/  Contractor  Safeguards.  A  telecommunications  carrier  that  discloses  or  provides  access  to  CPNI  to  its  joint  venture  partners  or  independent  contractors  shall  enter  into 
 confidentiality  agreements  with  independent  contractors  or  joint  venture  partners  that  comply  with  the  following  requirements.  The  confidentiality  agreement  shall:  (A)  require  that  the 
 independent  contractor  or  joint  venture  partner  use  the  CPNI  only  for  the  purpose  of  marketing  or  providing  the  communications-  related  services  for  which  that  CPNI  has  been  provided;  (B) 
 disallow  the  independent  contractor  or  joint  venture  partner  from  using,  allowing  access  to,  or  disclosing  the  CPNI  to  any  other  party,  unless  required  to  make  such  disclosure  under  force  of 
 law;  (C)  require  that  the  independent  contractor  or  joint  venture  partner  have  appropriate  protections  in  place  to  ensure  the  ongoing  confidentiality  of  consumers  CPNI. 

 (3)  Except  for  use  and  disclosure  of  CPNI  that  is  permitted  without  customer  approval  under  section  64.2005,  or  that  is  described  in  paragraph  (1)  of  this  section,  or  as  otherwise 
 provided  in  section  222  of  the  Communications  Act  of  1934,  as  amended,  a  telecommunications  carrier  may  only  use,  disclose,  or  permit  access  to  its  customers  individually  identifiable  CPNI 
 subject  to  opt-  in  approval. 
74
 Federal  Communications  Commission  FCC  02-  214 
 5 
   64.2008  Notice  Required  for  Use  of  Customer  Proprietary  Network  Information 
 (a)  Notification,  Generally.  (1)  Prior  to  any  solicitation  for  customer  approval,  a  telecommunications  carrier  must  provide  notification  to  the  customer  of  the  customer's  right  to 
 restrict  use  of,  disclosure  of,  and  access  to  that  customer's  CPNI. 
 (2)  A  telecommunications  carrier  must  maintain  records  of  notification,  whether  oral,  written  or  electronic,  for  at  least  one  year. 

 (b)  Individual  notice  to  customers  must  be  provided  when  soliciting  approval  to  use,  disclose,  or  permit  access  to  customers  CPNI. 
 (c)  Content  of  Notice.  Customer  notification  must  provide  sufficient  information  to  enable  the  customer  to  make  an  informed  decision  as  to  whether  to  permit  a  carrier  to  use, 
 disclose,  or  permit  access  to,  the  customer's  CPNI. 
 (1)  The  notification  must  state  that  the  customer  has  a  right,  and  the  carrier  has  a  duty,  under  federal  law,  to  protect  the  confidentiality  of  CPNI. 

 (2)  The  notification  must  specify  the  types  of  information  that  constitute  CPNI  and  the  specific  entities  that  will  receive  the  CPNI,  describe  the  purposes  for  which  CPNI  will  be  used, 
 and  inform  the  customer  of  his  or  her  right  to  disapprove  those  uses,  and  deny  or  withdraw  access  to  CPNI  at  any  time. 

 (3)  The  notification  must  advise  the  customer  of  the  precise  steps  the  customer  must  take  in  order  to  grant  or  deny  access  to  CPNI,  and  must  clearly  state  that  a  denial  of  approval  will  not 
 affect  the  provision  of  any  services  to  which  the  customer  subscribes.  However,  carriers  may  provide  a  brief  statement,  in  clear  and  neutral  language,  describing  consequences  directly 
 resulting  from  the  lack  of  access  to  CPNI. 
 (4)  The  notification  must  be  comprehensible  and  must  not  be  misleading. 
 (5)  If  written  notification  is  provided,  the  notice  must  be  clearly  legible,  use  sufficiently  large  type,  and  be  placed  in  an  area  so  as  to  be  readily  apparent  to  a  customer. 

 (6)  If  any  portion  of  a  notification  is  translated  into  another  language,  then  all  portions  of  the  notification  must  be  translated  into  that  language. 
 (7)  A  carrier  may  state  in  the  notification  that  the  customer's  approval  to  use  CPNI  may  enhance  the  carrier's  ability  to  offer  products  and  services  tailored  to  the  customer's  needs.  A 
 carrier  also  may  state  in  the  notification  that  it  may  be  compelled  to  disclose  CPNI  to  any  person  upon  affirmative  written  request  by  the  customer. 

 (8)  A  carrier  may  not  include  in  the  notification  any  statement  attempting  to  encourage  a  customer  to  freeze  third-  party  access  to  CPNI. 
75
 Federal  Communications  Commission  FCC  02-  214 
 6 
 (9)  The  notification  must  state  that  any  approval,  or  denial  of  approval  for  the  use  of  CPNI  outside  of  the  service  to  which  the  customer  already  subscribes  from  that  carrier  is  valid 
 until  the  customer  affirmatively  revokes  or  limits  such  approval  or  denial. 
 (10)  A  telecommunications  carrier's  solicitation  for  approval  must  be  proximate  to  the  notification  of  a  customer's  CPNI  rights. 

 (d)  Notice  Requirements  Specific  to  Opt-  Out.  A  telecommunications  carrier  must  provide  notification  to  obtain  opt-  out  approval  through  electronic  or  written  methods,  but  not  by 
 oral  communication  (except  as  provided  in  paragraph  (f)  of  this  section).  The  contents  of  any  such  notification  must  comply  with  the  requirements  of  subsection  (c)  of  this  section. 

 (1)  Carriers  must  wait  a  30-  day  minimum  period  of  time  after  giving  customers  notice  and  an  opportunity  to  opt-  out  before  assuming  customer  approval  to  use,  disclose,  or  permit 
 access  to  CPNI.  A  carrier  may,  in  its  discretion,  provide  for  a  longer  period.  Carriers  must  notify  customers  as  to  the  applicable  waiting  period  for  a  response  before  approval  is  assumed. 

 (A)  In  the  case  of  an  electronic  form  of  notification,  the  waiting  period  shall  begin  to  run  from  the  date  on  which  the  notification  was  sent. 
 (B)  In  the  case  of  notification  by  mail,  the  waiting  period  shall  begin  to  run  on  the  third  day  following  the  date  that  the  notification  was  mailed. 
 (2)  Carriers  using  the  opt-  out  mechanism  must  provide  notices  to  their  customers  every  two  years. 
 (3)  Telecommunications  carriers  that  use  e-  mail  to  provide  opt-  out  notices  must  comply  with  the  following  requirements  in  addition  to  the  requirements  generally  applicable  to 
 notification: 
 (A)  carriers  must  obtain  express,  verifiable,  prior  approval  from  consumers  to  send  notices  via  e-  mail  regarding  their  service  in  general,  or  CPNI  in  particular; 

 (B)  carriers  must  allow  customers  to  reply  directly  to  e-  mails  containing  CPNI  notices  in  order  to  opt-  out; 
 (C)  opt-  out  e-  mail  notices  that  are  returned  to  the  carrier  as  undeliverable  must  be  sent  to  the  customer  in  another  form  before  carriers  may  consider  the  customer  to  have  received  notice; 
 and 
 (D)  carriers  that  use  e-  mail  to  send  CPNI  notices  must  ensure  that  the  subject  line  of  the  message  clearly  and  accurately  identifies  the  subject  matter  of  the  e-  mail. 

 (E)  Telecommunications  carriers  must  make  available  to  every  customer  a  method  to  opt-  out  that  is  of  no  additional  cost  to  the  customer  and  that  is  available  24  hours  a  day,  seven 
 days  a  week.  Carriers  may  satisfy  this  requirement  through  a  combination  of  methods,  so  long  as 
76
 Federal  Communications  Commission  FCC  02-  214 
 7 
 all  customers  have  the  ability  to  opt-  out  at  no  cost  and  are  able  to  effectuate  that  choice  whenever  they  choose. 
 (e)  Notice  Requirements  Specific  to  Opt-  In.  (1)  A  telecommunications  carrier  may  provide  notification  to  obtain  opt-  in  approval  through  oral,  written,  or  electronic  methods.  The 
 contents  of  any  such  notification  must  comply  with  the  requirements  of  subsection  (c)  of  this  section. 

 (f)  Notice  Requirements  Specific  to  One-  Time  Use  of  CPNI.  Carriers  may  use  oral  notice  to  obtain  limited,  one-  time  use  of  CPNI  for  inbound  and  outbound  customer  telephone  contacts 
 for  the  duration  of  the  call,  regardless  of  whether  carriers  use  opt-  out  or  opt-  in  approval  based  on  the  nature  of  the  contact. 

 (1)  The  contents  of  any  such  notification  must  comply  with  the  requirements  of  subsection  (c)  of  this  section,  except  that  telecommunications  carriers  may  omit  any  of  the 
 following  notice  provisions  if  not  relevant  to  the  limited  use  for  which  the  carrier  seeks  CPNI: 
 (A)  carriers  need  not  advise  customers  that  if  they  have  opted-  out  previously,  no  action  is  needed  to  maintain  the  opt-  out  election. 

 (B)  carriers  need  not  advise  customers  that  they  may  share  CPNI  with  their  affiliates  or  third  parties  and  need  not  name  those  entities,  if  the  limited  CPNI  usage  will  not  result  in  use  by, 
 or  disclosure  to,  an  affiliate  or  third  party. 
 (C)  carriers  need  not  disclose  the  means  by  which  a  customer  can  deny  or  withdraw  future  access  to  CPNI,  so  long  as  carriers  explain  to  customers  that  the  scope  of  the  approval  the 
 carrier  seeks  is  limited  to  one-  time  use. 
 (D)  carriers  may  omit  disclosure  of  the  precise  steps  a  customer  must  take  in  order  to  grant  or  deny  access  to  CPNI,  as  long  as  the  carrier  clearly  communicates  that  the  customer  can 
 deny  access  to  his  CPNI  for  the  call. 

   64.2009  Safeguards  Required  for  Use  of  Customer  Proprietary  Network  Information 
 (a)  Telecommunications  carriers  must  implement  a  system  by  which  the  status  of  a  customers  CPNI  approval  can  be  clearly  established  prior  to  the  use  of  CPNI. 

 (b)  Telecommunications  carriers  must  train  their  personnel  as  to  when  they  are,  and  are  not,  authorized  to  use  CPNI,  and  carriers  must  have  an  express  disciplinary  process  in  place. 
 (c)  All  carriers  shall  maintain  a  record,  electronically  or  in  some  other  manner,  of  their  own  and  their  affiliates  sales  and  marketing  campaigns  that  use  their  customers  CPNI.  All 
 carriers  shall  maintain  a  record  of  all  instances  where  CPNI  was  disclosed  or  provided  to  third  parties,  or  where  third  parties  were  allowed  access  to  CPNI.  The  record  must  include  a 
 description  of  each  campaign,  the  specific  CPNI  that  was  used  in  the  campaign,  and  what 
77
 Federal  Communications  Commission  FCC  02-  214 
 8 
 products  and  services  were  offered  as  a  part  of  the  campaign.  Carriers  shall  retain  the  record  for  a  minimum  of  one  year. 
 (d)  Telecommunications  carriers  must  establish  a  supervisory  review  process  regarding  carrier  compliance  with  the  rules  in  this  subpart  for  outbound  marketing  situations  and  maintain 
 records  of  carrier  compliance  for  a  minimum  period  of  one  year.  Specifically,  sales  personnel  must  obtain  supervisory  approval  of  any  proposed  outbound  marketing  request  for  customer 
 approval. 
 (e)  A  telecommunications  carrier  must  have  a  corporate  officer,  as  an  agent  of  the  carrier,  sign  a  compliance  certificate  on  an  annual  basis  stating  that  the  officer  has  personal 
 knowledge  that  the  company  has  established  operating  procedures  that  are  adequate  to  ensure  compliance  with  the  rules  in  this  subpart.  The  carrier  must  provide  a  statement  accompanying 
 the  certificate  explaining  how  its  operating  procedures  ensure  that  it  is,  or  is  not,  in  compliance  with  the  rules  in  this  subpart. 

 (f)  Carriers  must  provide  written  notice  within  five  business  days  to  the  Commission  of  any  instance  where  the  opt-  out  mechanisms  do  not  work  properly,  to  such  a  degree  that 
 consumers  inability  to  opt-  out  is  more  than  an  anomaly. 
 (1)  The  notice  shall  be  in  the  form  of  a  letter,  and  shall  include  the  carriers  name,  a  description  of  the  opt-  out  mechanism(  s)  used,  the  problem(  s)  experienced,  the  remedy  proposed 
 and  when  it  will  be/  was  implemented,  whether  the  relevant  state  commission(  s)  has  been  notified  and  whether  it  has  taken  any  action,  a  copy  of  the  notice  provided  to  customers,  and  contact 
 information. 
 (2)  Such  notice  must  be  submitted  even  if  the  carrier  offers  other  methods  by  which  consumers  may  opt-  out. 
78
 Federal  Communications  Commission  FCC  02-  214 
 APPENDIX  C    FINAL  REGULATORY  FLEXIBILITY  ANALYSIS 
 1.  As  required  by  the  Regulatory  Flexibility  Act,  as  amended,  (RFA),  1  an  Initial  Regulatory  Flexibility  Analysis  (IRFA)  was  incorporated  in  the  Clarification  Order  and  Second 
 Further  Notice  of  Proposed  Rulemaking  issued  in  CC  Docket  No.  96-  115  and  CC  Docket  No.  96-  149.  2  The  Commission  sought  written  public  comment  on  the  proposals  in  the  Notice, 
 including  comment  on  the  IRFA.  This  present  Final  Regulatory  Flexibility  Analysis  (FRFA)  conforms  to  the  RFA.  3 

 A.  Need  for,  and  Objectives  of,  the  Third  Report  and  Order 
 2.  The  initial  need  for  the  proceeding  of  which  this  Report  and  Order  is  a  part  is  that  on  May  17,  1996,  the  Commission  initiated  a  rulemaking  in  response  to  requests  for  guidance 

 from  the  telecommunications  industry  regarding  the  obligations  of  telecommunications  carriers  under  section  222  of  the  Act  and  related  issues.  4  The  Commission  released  the  CPNI  Order  on 
 February  26,  1998,  in  which  it  addressed  the  scope  and  meaning  of  section  222  and  promulgated  implementing  regulations.  5  On  August  18,  1999,  the  Tenth  Circuit  issued  an  opinion  vacating  a 
 portion  of  the  CPNI  Order  in  U  S  WEST  v.  FCC.  6  That  left  the  Commission  with  a  need  to  clarify  the  CPNI  rules  and  their  future  operation.  We  do  so  herein. 

 3.  On  August  28,  2001,  the  Commission  adopted  an  order  (CPNI  Clarification  Order)  clarifying  the  status  of  its  CPNI  rules  in  light  of  the  Tenth  Circuit  order  and  issuing  a 
 Further  Notice  of  Proposed  Rulemaking  (Clarification  Order  Further  NPRM).  7  Specifically,  the 
 1  See  5  U.  S.  C.    603.  The  RFA,  5  U.  S.  C.    601-  612,  has  been  amended  by  the  Small  Business  Regulatory 
 Enforcement  Fairness  Act  of  1996  (SBREFA),  Pub.  L.  No.  104-  121,  Title  II,  110  Stat.  857  (1996). 
 2  Implementation  of  the  Telecommunications  Act  of  1996;  Telecommunications  Carriers  Use  of  Customer 
 Proprietary  Network  Information  and  Other  Customer  Information;  Implementation  of  the  Non-  Accounting  Safeguards  of  Sections  271  and  272  of  the  Communications  Act  of  1934,  as  Amended,  Clarification  Order  and 

 Second  Further  Notice  of  Proposed  Rulemaking,  16  FCC  Rcd  at  16527-  16537  (2001)  (CPNI  Clarification  Order). 
 3  See  5  U.  S.  C.    604. 

 4  In  the  Matter  of  Implementation  of  the  Telecommunications  Act  of  1996;  Telecommunications  Carriers  Use  of 
 Customer  Proprietary  Network  Information  and  Other  Customer  Information,  Notice  of  Proposed  Rulemaking,  11  FCC  Rcd  12513  (1996)  (1996  NPRM).  See  also  section  II.  A,  supra 

 5  Implementation  of  the  Telecommunications  Act  of  1996:  Telecommunications  Carriers  Use  of  Customer 
 Proprietary  Network  Information  and  Other  Customer  Information;  and  Implementation  of  the  Non-  Accounting  Safeguards  of  Sections  271  and  272  of  the  Communications  Act  of  1934,  as  amended;  Second  Report  and  Order  and 

 Further  Notice  of  Proposed  Rulemaking,  13  FCC  Rcd  8061  (1998)  (CPNI  Order).  See  also  section  II.  B,  supra. 
 6  U.  S.  WEST,  Inc.  v.  FCC,  182  F.  3d  1224  (10  th  Cir.  1999),  cert.  denied,  530  U.  S.  1213  (June  5,  2000)  (No.  99-1427) 
 (U  S  WEST  v.  FCC). 
 7  Implementation  of  the  Telecommunications  Act  of  1996;  Telecommunications  Carriers  Use  of  Customer 
 Proprietary  Network  Information  and  Other  Customer  Information;  Implementation  of  the  Non-  Accounting  Safeguards  of  Sections  271  and  272  of  the  Communications  Act  of  1934,  as  Amended;  Clarification  Order  and 

 Second  Further  Notice  of  Proposed  Rulemaking,  16  FCC  Rcd  16506  (2001)  (CPNI  Clarification  Order). 
79
 Federal  Communications  Commission  FCC  02-  214 
 2 
 Commission  sought  comment  on  (1)  its  interpretation  of  the  scope  of  the  Tenth  Circuit  order;  (2)  what  type  of  approval  (opt-  in  or  opt-  out)  would  best  serve  the  governments  goals  while 
 respecting  constitutional  limits;  8  (3)  ways  in  which  consumers  can  consent  to  a  carriers  use  of  their  CPNI;  9  (4)  what  methods  of  approval  would  serve  the  governmental  interests  at  issue  and 
 afford  informed  consent,  while  also  satisfying  the  First  Amendments  requirement  that  any  restrictions  on  speech  be  narrowly  tailored;  10  (5)  the  interests  and  policies  underlying  section 
 222  that  are  relevant  to  formulating  an  approval  requirement,  including  an  analysis  of  the  privacy  interests  that  are  at  issue,  and  on  the  extent  to  which  it  should  take  competitive  concerns  into 
 account;  11  (6)  the  likely  difference  in  competitive  harms  under  opt-  in  and  opt-  out  approvals;  and  (7)  whether  adoption  of  an  opt-  out  mechanism  is  consistent  with  the  rationale  for  the  total 
 service  approach  set  forth  in  the  CPNI  Order.  12  In  addition,  the  Commission  sought  comment  on  whether  its  consent  mechanism  would  affect  its  previous  findings  on  the  interplay  between 
 sections  222  and  272.  13 
 4.  In  this  Order,  the  Commission  reaches  the  objective  of  resolving  several  issues  in  connection  with  carriers  use  of  customer  proprietary  network  information  pursuant  to  section 

 222  of  the  Telecommunications  Act  of  1996.  14  In  formulating  the  required  approval  mechanism  described  below,  we  carefully  balance  carriers  First  Amendment  rights  and  consumers  privacy 
 interests  so  as  to  permit  carriers  flexibility  in  their  communications  with  their  customers  while  providing  the  level  of  protection  to  consumers  privacy  interests  that  Congress  envisioned  under 
 section  222. 
 5.  More  specifically,  we  adopt  an  approach  that  comports  with  the  decision  15  of  the  United  States  Court  of  Appeals  for  the  Tenth  Circuit  vacating  the  Commissions  requirement  that 

 carriers  obtain  express  customer  consent  for  all  sharing  between  a  carrier  and  its  affiliates,  as  well  as  unaffiliated  entities.  16  We  adopt  today  an  approach  that  is  derived  from  a  careful 

 8  CPNI  Clarification  Order,  16  FCC  Rcd  at  16512-  16517,  paras.  14-  22. 
 9  CPNI  Clarification  Order,  16  FCC  Rcd  at  16512,  para.  12. 
 10  Id  See  section  III.  A,  supra,  for  a  discussion  of  the  constitutional  standard  governing  regulation  of  commercial 
 speech. 
 11  Id. 

 12  CPNI  Clarification  Order,  16  FCC  Rcd  at  16516,  para.  21. 
 13  CPNI  Clarification  Order,  16  FCC  Rcd  at  16518,  para.  24. 
 14  Telecommunications  Act  of  1996,  Pub.  L.  No.  104-  104,  110  Stat.  56  (1996  Act)  (codified  at  47  U.  S.  C.    151 
 et  seq.).  Hereinafter,  all  citations  to  the  1996  Act  will  be  to  the  1996  Act  as  it  is  codified  in  the  United  States  Code.  The  1996  Act  amended  the  Communications  Act  of  1934.  We  will  refer  to  the  Communications  Act  of  1934,  as 

 amended,  as  the  Communications  Act  or  the  Act. 
 15  U.  S.  West,  Inc.  v.  FCC,  182  F.  3d  1224  (10  th  Cir.  1999),  cert.  denied,  530  U.  S.  1213  (June  5,  2000)  (No.  99-1427) 
 (U  S  WEST  v.  FCC). 
 16  Implementation  of  the  Telecommunications  Act  of  1996:  Telecommunications  Carriers  Use  of  Customer 
 Proprietary  Network  Information  and  Other  Customer  Information;  and  Implementation  of  the  Non-  Accounting  (continued.) 
80
 Federal  Communications  Commission  FCC  02-  214 
 3 
 balancing  of  harms,  benefits,  and  governmental  interests.  First,  use  of  CPNI  by  carriers  or  disclosure  to  their  affiliated  entities  providing  communications-  related  services,  17  as  well  as 
 third-  party  agents  and  joint  venture  partners  providing  communications-  related  services,  requires  a  customers  knowing  consent  in  the  form  of  notice  and  opt-  out  approval.  18  Second,  disclosure 
 of  CPNI  to  unrelated  third  parties  or  to  carrier  affiliates  that  do  not  provide  communications-related  services  requires  express  customer  consent,  described  as  opt-  in  approval.  19  Finally,  we 
 reaffirm  our  total  services  approach,  which  permits  the  carrier  to  use  CPNI  to  market  new  product  offerings  within  the  carrier-  customer  service  relationship,  on  the  basis  of  the  customers 
 implied  consent.  20 
 6.  In  this  Order,  we  also  further  refine  the  rules  governing  the  process  by  which  carriers  provide  notification  to  customers  of  their  CPNI  rights.  Specifically,  we  clarify  the  form, 

 content  and  frequency  of  carrier  notices.  21  In  addition,  although  we  decline  to  reconsider  our  conclusion  that  customers  preferred  carrier  (PC)  freeze  information  constitutes  CPNI  and 
 thereby  continue  to  accord  it  privacy  protection  pursuant  to  section  222,  we  choose  to  forbear  from  imposing  the  express  consent  requirements  announced  in  this  Order  with  respect  to  PC-freezes. 
 Through  our  limited  exercise  of  forbearance,  we  balance  customers  privacy  concerns  with  carriers  meaningful  commercial  interests,  resulting  in  PC-  freeze  information  being  made 
 more  readily  available  among  competing  carriers,  consistent  with  the  public  interest.  22  We  also  affirm  our  previous  determination  that  the  word  information  in  section  272  does  not  include 
 CPNI,  which  is  governed  instead  by  section  222  of  the  Act.  23 
 7.  Finally,  we  accompany  this  Order  with  a  Further  Notice  of  Proposed  Rulemaking  (  Further  NPRM)  to  refresh  the  record  on  two  issues  raised  in  the  CPNI  Order  Further  NPRM: 

 foreign  storage  of  and  access  to  domestic  CPNI,  and  CPNI  safeguards  and  enforcement  mechanisms.  We  additionally  request  comment  on  what,  if  any,  appropriate  regulations  should 
 govern  the  CPNI  held  by  carriers  that  go  out  of  business,  sell  all  or  part  of  their  customer  base,  or 

 (Continued  from  previous  page)  Safeguards  of  Sections  271  and  272  of  the  Communications  Act  of  1934,  as  amended,  Second  Report  and  Order  and 
 Further  Notice  of  Proposed  Rulemaking,  13  FCC  Rcd  8061  (1998)  (CPNI  Order). 
 17  In  this  Order  and  Further  NPRM,  we  use  the  term  "communications-  related  services"  to  mean 
 telecommunications  services,  information  services  typically  provided  by  telecommunications  carriers,  and  services  related  to  the  provision  or  maintenance  of  customer  premises  equipment.  We  use  this  term  only  for  convenience  in 

 this  Order  and  FNRPM  and  not  for  any  other  purposes. 
 18  See  section  III.  A.  1,  supra. 

 19  See  section  III.  A.  2,  supra. 
 20  See  section  III.  B.  2,  supra. 
 21  See  section  III.  C,  supra. 
 22  See  section  III.  D.  1,  supra. 
 23  See  section  III.  D.  4,  supra. 
81
 Federal  Communications  Commission  FCC  02-  214 
 4 
 seek  bankruptcy  protection.  24 
 B.  Summary  of  Significant  Issues  Raised  by  Public  Comments  in  Response  to  the  IRFA 

 8.  One  party,  the  Organization  for  the  Promotion  and  Advancement  of  Small  Telecommunications  Companies  (  OPASTCO),  commented  specifically  in  response  to  the 
 IRFA.  25  OPASTCO  argues  that  the  IRFA  was  deficient  for  two  reasons.  First,  OPASTCO  notes  that  the  IRFA  reverts  to  language  which  incorrectly  suggests  that  small  ILECs  are  not 
 small  entities  under  the  Regulatory  Flexibility  Act.  26  Further,  OPASTCO  takes  issue  with  the  IRFAs  determination  that  whatever  consent  rules  are  ultimately  adopted  will  be  applicable  to  all 
 carriers.  OPTASCO  argues  that  the  Commission  has  not  considered  any  alternatives,  contrary  to  the  requirements  of  5  U.  S.  C.  603(  c).  27 

 9.  We  confirm  OPASTCOs  assumption  that  the  Clarification  Orders  IRFA  did  contain  a  clerical  error  28  regarding  the  classification  of  small  ILECs.  Accordingly,  we  affirm 
 that  Commission  practice  is  to  discuss  small  ILECs  as  small  entities  within  our  IRFAs,  under  the  RFA.  However,  we  note  that  no  party  was  prejudiced  or  harmed  by  this  error  because  the 
 IRFA  put  potentially  affected  entities  on  notice  by  affirmatively  stating  that  the  Commission  was  consider[  ing]  small  ILECs  within  this  analysis  and  us[  ing]  the  term  small  LECs  to  refer  to  any 
 ILECs  that  arguably  might  be  defined  by  SBA  as  small  business  concerns.  "  29  Hence,  the  clerical  error  was  cured  in  the  very  document  in  which  it  was  alleged  to  be  present. 

 10.  OPASTCOs  concern,  therefore,  that  if  the  rulemaking  body  itself  has  no  preconceived  idea  of  what  the  final  rules  might  be,  there  is  no  way  it  can  make  the  prejudgment 
 that  its  final  rules  will  be  appropriate  for  all  entities,  30  takes  a  statement  from  the  IRFA  out  of  context.  Furthermore,  OPASTCOs  contention  inaccurately  describes  the  Commissions 
 decision-  making  process  and  outcome  in  this  proceeding. 
 11.  First,  although  the  Clarification  Order  did  not  propose  specific  consent  requirements,  the  Clarification  Order  did  seek  comment  on  ways  in  which  carriers  can  obtain 

 their  customers  consent  and  the  extent  to  which  an  opt-  in  or  opt-  out  approach  would  satisfy  both  Sections  222  and  the  Tenth  Circuits  concerns  that  any  restrictions  on  speech  be  no  more  than 

 24  See  section  IV.  C,  supra. 
 25  OPASTCO  Comments  at  8-  11. 
 26  OPASTCO  Comments  at  8. 
 27  OPASTCO  Comments  at  8  -9. 
 28  OPASTCO  Comments  at  9. 
 29  CPNI  Clarification  Order,  16  FCC  Rcd  at  16529,  para.  9  (internal  citations  omitted). 
 30  OPASTCO  Comments  at  10. 
82
 Federal  Communications  Commission  FCC  02-  214 
 5 
 necessary  to  serve  the  asserted  state  interests.  31  Accordingly,  although  specific  consent  rules  were  not  proposed,  the  only  two  potential  types  of  consent  (opt-  in  and  opt-  out)  were  explicitly 
 mentioned  and  offered  to  interested  parties  for  consideration  and  comment.  In  an  instance  such  as  this,  where  the  Commission  has  previously  considered  what  type  of  consent  to  require,  and 
 where  the  Order  in  question  mentions  the  only  two  potential  options  for  obtaining  consent,  it  is  unreasonable  to  claim  that  the  Commission  or  any  interested  party  had  and  has  no  idea  what  the 
 final  rules  might  be.  Clearly,  the  Commission  knew  and  adequately  advised  interested  parties  that  the  final  rules  would  involve  opt-  in  approval,  opt-  out  approval,  or  some  combination  of  the 
 two.  In  fact,  every  commenter,  including  OPASTCO,  32  focused  extensively  on  whether  the  Commission  should  adopt  opt-  in  or  opt-  out  consent  requirements.  We  also  note  that  the  IRFA 
 went  on  to  state  that  [  w]  e  have,  however,  taken  the  limited  resources  of  small  entities  into  account  in  promulgating  certain  existing  CPNI  rules,  and  intend  to  do  so  again  in  addressing  the 
 customer  consent  requirements.  33  The  omission  of  ILECs,  whether  or  not  evidence  of  Commission  oversight,  is  rendered  moot  by  our  inclusion  of  this  statement. 

 12.  Furthermore,  the  previously  adopted  opt-  in  approval  rules  were  subject  to,  and  complied  with,  the  requirements  of  the  RFA.  Accordingly,  the  Commission  has  previously 
 undertaken  an  analysis  of  opt-  in  and  potential  alternatives  with  respect  to  small  carriers.  Although  such  analysis  does  not  supplant  the  analysis  that  the  Commission  must  perform  in  this 
 Order  and  in  this  FRFA,  it  provides  meaningful  guidance.  In  previous  CPNI  Orders,  the  Commission  has  received  comment  from  several  parties  on  the  impact  of  proposed  rules  on  small 
 carriers.  After  extensive  analysis,  the  Commission  found  that  [  a]  fter  consideration  of  possible  alternatives,  we  have  concluded  that  our  rules  should  apply  equally  to  all  carriers.  34  Thus  any 
 argument  that  the  Commission  ever  neglected  the  interests  of  small  carriers  is  thereby  rendered  invalid.  The  Commissions  reasoning  remains  valid  today.  We  stated:  we  are  unpersuaded  that 
 customers  of  small  businesses  have  less  meaningful  privacy  interests  in  their  CPNI."  35  Additionally,  the  weight  added  by  Congressional  intent  is  critical  in  this  context  and  deserves 
 comment.  In  drafting  section  222,  Congress  determined  that  CPNI  protections  should  apply  to  consumers  of  [  e]  very  telecommunications  carrier.  36  Finally,  we  note  that  the  rules  we  adopt 
 today  are  less  burdensome  on  all  carriers,  including  small  carriers,  than  the  Commissions  original  opt-  in  rules. 

 C.  Description  and  Estimate  of  the  Number  of  Small  Entities  to  Which  Rules  Will  Apply 

 31  CPNI  Clarification  Order,  16  FCC  Rcd  at  16536,  para.  26. 
 32  OPASTCO  Comments  at  3-  8. 
 33  CPNI  Clarification  Order,  16  FCC  Rcd  at  16536,  para.  27. 
 34  CPNI  Order,  13  FCC  Rcd  at  8213,  para.  235. 
 35  CPNI  Order,  13  FCC  Rcd  at  8214,  para.  236. 
 36  47  U.  S.  C.    222(  a). 
83
 Federal  Communications  Commission  FCC  02-  214 
 6 
 13.  The  RFA  directs  agencies  to  provide  a  description  of  and,  where  feasible,  an  estimate  of  the  number  of  small  entities  that  will  be  affected  by  the  proposed  rules,  if  adopted.  37 
 The  RFA  generally  defines  the  term  "small  entity"  as  having  the  same  meaning  as  the  terms  "small  business,"  "small  organization,"  and  "small  governmental  jurisdiction."  38  In  addition,  the 
 term  "small  business"  has  the  same  meaning  as  the  term  small  business  concern  under  the  Small  Business  Act.  39  A  small  business  concern"  is  one  that:  (1)  is  independently  owned  and 
 operated;  (2)  is  not  dominant  in  its  field  of  operation;  and  (3)  satisfies  any  additional  criteria  established  by  the  Small  Business  Administration  (SBA).  40 

 14.  The  most  reliable  source  of  information  regarding  the  total  numbers  of  certain  common  carrier  and  related  providers  nationwide  appears  to  be  data  the  Commission  publishes 
 annually  in  its  Telecommunications  Provider  Locator  report,  derived  from  filings  made  in  connection  with  the  Telecommunications  Relay  Service  (TRS).  41  According  to  data  in  the  most 
 recent  report,  there  are  5,679  interstate  service  providers.  42  These  providers  include,  inter  alia,  local  exchange  carriers,  wireline  carriers  and  service  providers,  interexchange  carriers, 
 competitive  access  providers,  operator  service  providers,  pay  telephone  operators,  providers  of  telephone  service,  providers  of  telephone  exchange  service,  and  resellers. 

 15.  We  have  included  small  incumbent  local  exchange  carriers  (ILECs)  43  in  this  present  RFA  analysis.  As  noted  above,  a  "small  business"  under  the  RFA  is  one  that,  inter  alia, 
 meets  the  pertinent  small  business  size  standard  (e.  g.,  a  telephone  communications  business  having  1,500  or  fewer  employees),  and  "is  not  dominant  in  its  field  of  operation."  44  The  SBA's 
 Office  of  Advocacy  contends  that,  for  RFA  purposes,  small  incumbent  LECs  are  not  dominant  in  their  field  of  operation  because  any  such  dominance  is  not  "national"  in  scope.  45  We  have 

 37  5  U.  S.  C.    603(  b)(  3). 
 38  5  U.  S.  C.    601(  6). 
 39  5  U.  S.  C.    601(  3)  (incorporating  by  reference  the  definition  of  small  business  concern  in  the  Small  Business 
 Act,  15  U.  S.  C.    632).  Pursuant  to  5  U.  S.  C.    601(  3),  the  statutory  definition  of  a  small  business  applies  unless  an  agency,  after  consultation  with  the  Office  of  Advocacy  of  the  Small  Business  Administration  and  after  opportunity 

 for  public  comment,  establishes  one  or  more  definitions  of  such  term  which  are  appropriate  to  the  activities  of  the  agency  and  publishes  such  definition(  s)  in  the  Federal  Register. 

 40  15  U.  S.  C.    632. 
 41  FCC,  Common  Carrier  Bureau,  Industry  Analysis  Division,  Telecommunications  Provider  Locator,  Tables  1-  2 
 (November  2001)  (Provider  Locator).  See  also  47  C.  F.  R.    64.  601  et  seq. 
 42  Provider  Locator  at  Table  1. 

 43  See  47  U.  S.  C    251(  h)  (defining  incumbent  local  exchange  carrier). 
 44  15  U.  S.  C.    632. 
 45  Letter  from  Jere  W.  Glover,  Chief  Counsel  for  Advocacy,  SBA,  to  William  E.  Kennard,  Chairman,  FCC  (May 
 27,  1999).  The  Small  Business  Act  contains  a  definition  of  "small  business  concern,"  which  the  RFA  incorporates  into  its  own  definition  of  "small  business."  See  15  U.  S.  C.    632(  a)  (Small  Business  Act);  5  U.  S.  C.    601(  3)  (RFA). 

 SBA  regulations  interpret  "small  business  concern"  to  include  the  concept  of  dominance  on  a  national  basis.  13  C.  F.  R.    121.102(  b). 
84
 Federal  Communications  Commission  FCC  02-  214 
 7 
 therefore  included  small  incumbent  LECs  46  in  this  RFA  analysis,  although  we  emphasize  that  this  RFA  action  has  no  effect  on  FCC  analyses  and  determinations  in  other,  non-  RFA  contexts. 
 16.  Total  Number  of  Telephone  Companies  Affected.  The  U.  S.  Bureau  of  Census  (Census  Bureau)  reports  that,  at  the  end  of  1992,  there  were  3,497  firms  engaged  in  providing 
 telephone  services,  as  defined  therein,  for  at  least  one  year.  47  This  number  contains  a  variety  of  different  categories  of  carriers,  including  LECs,  interexchange  carriers,  competitive  access 
 providers,  operator  service  providers,  pay  telephone  operators,  and  resellers.  It  seems  certain  that  some  of  these  3,497  telephone  service  firms  may  not  qualify  as  small  entities  or  small 
 incumbent  LECs  because  they  are  not  "independently  owned  and  operated."  48  It  seems  reasonable  to  conclude  that  fewer  than  3,497  telephone  service  firms  are  small  entity  telephone 
 service  firms  that  may  be  affected  by  these  rules. 
 17.  Wireline  Carriers  and  Service  Providers.  The  SBA  has  developed  a  definition  of  small  entities  for  telephone  communications  companies  other  than  radiotelephone  (wireless) 

 companies.  The  Census  Bureau  reports  that  there  were  2,321  such  telephone  companies  in  operation  for  at  least  one  year  at  the  end  of  1992.  49  According  to  the  SBA's  definition,  a  small 
 business  telephone  company  other  than  a  radiotelephone  (wireless)  company  is  one  employing  no  more  than  1,500  persons.  50  All  but  26  of  the  2,321  non-  radiotelephone  (wireless)  companies 
 listed  by  the  Census  Bureau  were  reported  to  have  fewer  than  1,000  employees.  Even  if  all  26  of  the  remaining  companies  had  more  than  1,500  employees,  there  would  still  be  2,295 
 non-  radiotelephone  (wireless)  companies  that  might  qualify  as  small  entities  or  small  incumbent  LECs.  Although  it  seems  certain  that  some  of  these  carriers  are  not  independently  owned  and 
 operated,  we  are  unable  at  this  time  to  estimate  with  greater  precision  the  number  of  wireline  carriers  and  service  providers  that  would  qualify  as  small  business  concerns  under  SBAs 
 definition.  Therefore,  we  estimate  that  fewer  than  2,295  small  telephone  communications  companies  other  than  radiotelephone  (wireless)  companies  are  small  entities  that  may  be  affected 
 by  these  rules. 
 18.  Local  Exchange  Carriers.  Neither  the  Commission  nor  the  SBA  has  developed  a  definition  of  small  providers  of  local  exchange  services.  The  closest  applicable  definition  under 

 the  SBA's  rules  is  for  telephone  communications  companies  other  than  radiotelephone  (wireless)  companies.  51  According  to  the  SBA's  definition,  a  small  business  telephone  company  other  than 

 46  13  C.  F.  R    121.201,  NAICS  code513310. 
 47  U.  S.  Department  of  Commerce,  Bureau  of  the  Census,  1992  Census  of  Transportation,  Communications,  and 
 Utilities:  Establishment  and  Firm  Size,  at  Firm  Size  1-  123  (1995)  (1992  Census). 
 48  See  generally  15  U.  S.  C.    632(  a)(  1). 

 49  1992  Census  at  Firm  Size  1-  123. 
 50  13  C.  F.  R.    121.201,  North  American  Industry  Classification  System  (NAICS)  codes  513310,  513330,  and 
 513340. 
 51  13  C.  F.  R.    121.201,  NAICS  code  513310. 
85
 Federal  Communications  Commission  FCC  02-  214 
 8 
 a  radiotelephone  (wireless)  company  is  one  employing  no  more  than  1,500  persons.  52  The  most  reliable  source  of  information  regarding  the  number  of  LECs  nationwide  of  which  we  are  aware 
 appears  to  be  the  data  that  we  collect  annually  in  connection  with  the  Telecommunications  Relay  Service  (TRS).  53  According  to  our  most  recent  data,  there  are  1,329  local  exchange  carriers, 
 including  incumbent  LECs.  54  Although  it  seems  certain  that  some  of  these  carriers  are  not  independently  owned  and  operated,  or  have  more  than  1,500  employees,  we  are  unable  at  this 
 time  to  estimate  with  greater  precision  the  number  of  LECs  that  would  qualify  as  small  business  concerns  under  the  SBA's  definition.  Consequently,  we  estimate  that  they  are  fewer  than  1,  329 
 small  entity  LECs  that  may  be  affected  by  the  proposals  in  the  Second  Further  Notice. 
 19.  Interexchange  Carriers.  Neither  the  Commission  nor  the  SBA  has  developed  a  definition  of  small  entities  specifically  applicable  to  providers  of  interexchange  services  (IXCs). 

 The  closest  applicable  definition  under  the  SBA's  rules  is  for  telephone  communications  companies  other  than  radiotelephone  (wireless)  companies.  55  The  most  reliable  source  of 
 information  regarding  the  number  of  IXCs  nationwide  of  which  we  are  aware  appears  to  be  the  data  that  we  collect  annually  in  connection  with  TRS.  56  According  to  our  most  recent  data,  229 
 companies  reported  that  they  were  engaged  in  the  provision  of  interexchange  services.  57  Although  it  seems  certain  that  some  of  these  carriers  are  not  independently  owned  and  operated, 
 or  have  more  than  1,500  employees,  we  are  unable  at  this  time  to  estimate  with  greater  precision  the  number  of  IXCs  that  would  qualify  as  small  business  concerns  under  the  SBA's  definition. 
 Consequently,  we  estimate  that  there  are  fewer  than  229  small  entity  IXCs  that  may  be  affected  by  this  order. 

 20.  Competitive  Access  Providers.  Neither  the  Commission  nor  the  SBA  has  developed  a  definition  of  small  entities  specifically  applicable  to  providers  of  competitive  access 
 services  (CAPs).  The  closest  applicable  definition  under  the  SBA's  rules  is  for  telephone  communications  companies  other  than  radiotelephone  (wireless)  companies.  58  According  to  the 
 SBA's  definition,  a  small  business  telephone  company  other  than  a  radiotelephone  (wireless)  company  is  one  employing  no  more  than  1,500  persons.  59  The  most  reliable  source  of 
 information  regarding  the  number  of  CAPs  nationwide  of  which  we  are  aware  appears  to  be  the 

 52  13  C.  F.  R.    121.201,  North  American  Industry  Classification  System  (NAICS)  codes  513310,  513330,  and 
 513340. 
 53  See  47  C.  F.  R.    64.  601  et  seq.;  Provider  Locator  at  Table  1. 

 54  Provider  Locator  at  Table  1. 
 55  13  C.  F.  R.    121.201,  NAICS  code  513310. 
 56  See  47  C.  F.  R.    64.  601  et  seq.;  Provider  Locator  at  Table  1. 
 57  Provider  Locator  at  Table  1. 
 58  13  C.  F.  R.    121.201,  NAICS  code  513310. 
 59  13  C.  F.  R.    121.201,  North  American  Industry  Classification  System  (NAICS)  codes  513310,  513330,  and 
 513340. 
86
 Federal  Communications  Commission  FCC  02-  214 
 9 
 data  that  we  collect  annually  in  connection  with  the  TRS.  60  According  to  our  most  recent  data,  532  companies  reported  that  they  were  engaged  in  the  provision  of  either  competitive  access 
 services  or  competitive  local  exchange  service.  61  Although  it  seems  certain  that  some  of  these  carriers  are  not  independently  owned  and  operated,  or  have  more  than  1,500  employees,  we  are 
 unable  at  this  time  to  estimate  with  greater  precision  the  number  of  CAPs  that  would  qualify  as  small  business  concerns  under  the  SBA's  definition.  Consequently,  we  estimate  that  there  are 
 fewer  than  532  small  entity  CAPs  that  may  be  affected  by  this  order. 
 21.  Operator  Service  Providers.  Neither  the  Commission  nor  the  SBA  has  developed  a  definition  of  small  entities  specifically  applicable  to  providers  of  operator  services.  The  closest 

 applicable  definition  under  the  SBA's  rules  is  for  telephone  communications  companies  other  than  radiotelephone  (wireless)  companies.  62  The  most  reliable  source  of  information  regarding 
 the  number  of  operator  service  providers  nationwide  of  which  we  are  aware  appears  to  be  the  data  that  we  collect  annually  in  connection  with  the  TRS.  63  According  to  our  most  recent  data, 
 22  companies  reported  that  they  were  engaged  in  the  provision  of  operator  services.  64  Although  it  seems  certain  that  some  of  these  companies  are  not  independently  owned  and  operated,  or  have 
 more  than  1,500  employees,  we  are  unable  at  this  time  to  estimate  with  greater  precision  the  number  of  operator  service  providers  that  would  qualify  as  small  business  concerns  under  the 
 SBA's  definition.  Consequently,  we  estimate  that  there  are  fewer  than  22  small  entity  operator  service  providers  that  may  be  affected  by  this  order. 

 22.  Pay  Telephone  Providers.  Neither  the  Commission  nor  the  SBA  has  developed  a  definition  of  small  entities  specifically  applicable  to  pay  telephone  providers.  The  closest 
 applicable  definition  under  the  SBA's  rules  is  for  telephone  communications  companies  other  than  radiotelephone  (wireless)  companies.  65  The  most  reliable  source  of  information  regarding 
 the  number  of  pay  telephone  operators  nationwide  of  which  we  are  aware  appears  to  be  the  data  that  we  collect  annually  in  connection  with  the  TRS.  66  According  to  our  most  recent  data,  936 
 companies  reported  that  they  were  engaged  in  the  provision  of  pay  telephone  services.  67  Although  it  seems  certain  that  some  of  these  carriers  are  not  independently  owned  and  operated, 
 or  have  more  than  1,500  employees,  we  are  unable  at  this  time  to  estimate  with  greater  precision  the  number  of  pay  telephone  operators  that  would  qualify  as  small  business  concerns  under  the 

 60  See  47  C.  F.  R.    64.  601  et  seq.;  Provider  Locator  at  Table  1. 
 61  Provider  Locator  at  Table  1. 
 62  13  C.  F.  R.    121.201,  NAICS  code  513310. 
 63  See  47  C.  F.  R.    64.  601  et  seq.;  Provider  Locator  at  Table  1. 
 64  Provider  Locator  at  Table  1. 
 65  13  C.  F.  R.    121.201,  NAICS  code  513310. 
 66  13  C.  F.  R.    121.201,  NAICS  code  513310. 
 67  Provider  Locator  at  Table  1. 
87
 Federal  Communications  Commission  FCC  02-  214 
 10 
 SBA's  definition.  Consequently,  we  estimate  that  there  are  fewer  than  936  small  entity  pay  telephone  operators  that  may  be  affected  by  this  order. 
 23.  Wireless  Carriers.  Wireless  telephony  includes  cellular,  personal  communications  services  (PCS)  or  specialized  mobile  radio  (SMR)  service  providers.  The  SBA 
 has  developed  a  definition  of  small  entities  for  radiotelephone  (wireless)  companies;  68  however,  neither  the  Commission  nor  the  SBA  has  developed  a  definition  of  small  entities  applicable  to 
 cellular  licensees,  or  to  providers  of  paging  and  messaging  services.  Through  categorized  under  the  same  size  standard  as  other  wireless  services  discussed  in  this  paragraph,  paging  is  now 
 considered  a  separate  industry.  69  The  closest  applicable  definition  under  the  SBA's  rules  is  for  telephone  communications  companies  other  than  radiotelephone  (wireless)  companies.  70 
 According  to  the  SBA's  definition,  a  small  business  radiotelephone  company  is  one  employing  no  more  than  1,500  persons.  71  We  consider  paging  and  messaging  services  to  fall  within  this 
 category.  According  to  the  most  recent  Provider  Locator  data,  858  carriers  reported  that  they  were  engaged  in  the  provision  of  wireless  telephony  and  576  companies  reported  that  they  were 
 engaged  in  the  provision  of  paging  and  messaging  services.  72  Although  it  seems  certain  that  some  of  these  carriers  are  not  independently  owned  and  operated,  we  are  unable  at  this  time  to 
 estimate  with  greater  precision  the  number  of  radiotelephone  carriers  and  service  providers  that  would  qualify  as  small  business  concerns  under  the  SBA's  definition.  Consequently,  we  estimate 
 that  there  are  fewer  than  858  small  carriers  providing  wireless  telephony  services  and  fewer  than  576  small  companies  providing  paging  and  messaging  services  that  may  be  affected  by  these 
 rules. 
 24.  Resellers.  Neither  the  Commission  nor  the  SBA  has  developed  a  definition  of  small  entities  specifically  applicable  to  resellers.  The  closest  applicable  definition  under  the  SBA's 

 rules  is  for  all  telephone  communications  companies.  73  The  most  reliable  source  of  information  regarding  the  number  of  toll  resellers  nationwide  of  which  we  are  aware  appears  to  be  the  data 
 that  we  collect  annually  in  connection  with  the  TRS.  74  According  to  our  most  recent  data,  710  companies  reported  that  they  were  engaged  in  the  resale  of  telephone  services.  75  Although  it 
 seems  certain  that  some  of  these  carriers  are  not  independently  owned  and  operated,  or  have  more  than  1,500  employees,  we  are  unable  at  this  time  to  estimate  with  greater  precision  the 
 number  of  resellers  that  would  qualify  as  small  business  concerns  under  the  SBA's  definition. 
 68  13  C.  F.  R.    121.201,  NAICS  codes  513321  and  513322. 
 69  13  C.  F.  R.    121.201,  NAICS  code  513321. 
 70  Id. 
 71  13  C.  F.  R.    121.201  (SIC  4812/  NAICS  513322). 
 72  Provider  Locator  at  Table  1. 
 73  13  C.  F.  R.    121.201,  NAICS  code  513310. 
 74  13  C.  F.  R.    121.201,  NAICS  code  513310. 
 75  Provider  Locator  at  Table  1.  The  total  for  resellers  includes  both  toll  resellers  and  local  resellers. 
88
 Federal  Communications  Commission  FCC  02-  214 
 11 
 Consequently,  we  estimate  that  there  are  fewer  than  710  small  entity  resellers  that  may  be  affected  by  this  order. 
 D.  Description  of  Projected  Reporting,  Recordkeeping,  and  Other  Compliance  Requirements  for  Small  Entities 
 25.  In  this  Order,  we  take  a  number  of  steps  that  may  affect  small  entities  that  use  customers  CPNI  outside  of  the  total  service  approval  or  statutory  exceptions  in  section  222.  76 
 Some  of  the  approval  and  notice  requirements  discussed  herein  will  require  additional  reporting,  recordkeeping  or  compliance  requirements  for  service  providers;  however,  certain  approval  and 
 notice  requirements  discussed  herein  will  also  decrease  certain  reporting,  recordkeeping  or  compliance  requirements  for  service  providers.  We  believe  that,  overall,  these  new  requirements 
 will  lessen  the  regulatory  burden  on  small  carriers  by  allowing  carriers  to  obtain  customers  consent  through  an  opt-  out  approval  mechanism  to  use  customers  CPNI  for  marketing 
 communications-  related  services. 
 26.  This  Order  imposes  the  following  additional  reporting,  recordkeeping  or  compliance  requirements  on  all  carriers.  None  of  these  requirements  should  affect  small  carriers 

 disproportionately  or  require  special  professional  skills.  First,  carriers  must  obtain  opt-  in  CPNI  approval  for  certain  CPNI  uses,  and  have  the  choice  of  obtaining  opt-  out  or  opt-  in  approval  for 
 other  CPNI  uses.  As  discussed  in  section  III.  C.  1,  supra,  a  carrier  may  determine  whether  to  use  one  notice  or  multiple  notices,  and  may  request  and  provide  notice  relevant  only  to  the  CPNI 
 uses  the  carriers  proposes  to  make.  Accordingly,  if,  as  OPASTCO  claims,  its  members  only  intend  to  use  CPNI  internally  for  marketing  communications-  related  services,  77  its  member  small 
 carriers  will  only  have  to  obtain  opt-  out  approval  from  their  customers. 
 27.  Carriers  who  use  opt-  out  approval  must  provide  notice  to  their  customers  every  two  years.  This  requirement,  while  an  added  burden  on  all  carriers,  is  counterbalanced  by  the 

 fact  that  carriers  who  choose  to  use  the  opt-  out  method  will  be  able  to  use  and  disclose  more  CPNI  for  marketing  than  under  the  opt-  in  method.  Accordingly,  a  carrier  that  finds  the  burden  of 
 biennial  notices  to  outweigh  the  benefit  of  expanded  CPNI  access  can  choose  to  obtain  opt-  in  approval  from  its  customers  and  avoid  the  biennial  notice  requirement.  Additionally,  notice 
 requirements  are  common  in  the  telecommunications  industry  and  the  requirements  adopted  here  allow  carriers  flexibility  in  determining  how  to  provide  such  notices.  Accordingly,  all  carriers, 
 including  small  carriers,  should  already  have  resources  in  place  to  provide  notices  required  by  such  regulations  to  their  customers. 

 28.  We  require  carriers  who  use  e-  mail  notices  to  advise  their  customers  of  their  opt-out  CPNI  choices  to  abide  by  certain  requirements.  See  section  III.  C.  1.  a,  supra.  These 
 requirements  are  not  burdensome.  To  the  degree  that  any  carrier  could  seriously  argue  that  these  requirements  are  burdensome,  carriers  are  not  required  to  use  e-  mail  to  notify  their  customers  of 
 CPNI  policies.  Accordingly,  a  carrier  can  choose  the  least  burdensome  notification  method 
 76  47  U.  S.  C.    222(  d). 
 77  OPASTCO  Comments  at  4. 
89
 Federal  Communications  Commission  FCC  02-  214 
 12 
 allowed  under  our  rules,  based  on  the  carriers  individual  circumstances. 
 29.  In  addition,  we  add  minor  content  requirements  to  our  notice  rules  to  synchronize  the  rules  with  the  newly  adopted  consent  requirements.  78  These  requirements  should  require 

 minimal  effort  on  the  part  of  carriers,  large  and  small,  to  implement.  Furthermore,  we  also  streamline  the  notice  requirements  for  carriers  to  obtain  limited,  one-  time  use  of  consumers 
 CPNI  for  the  duration  of  an  inbound  or  outbound  call  with  the  customer,  79  which  will  benefit  small  carriers. 

 30.  We  adopt  a  30-  day  minimum  period  of  time  that  carriers  must  wait  after  giving  customers  opt-  out  notice  before  assuming  customer  approval.  Every  carrier  commenter 
 supported  the  30-  day  time  period.  Such  a  time  period  imposes  minimal  burden  on  carriers.  This  is  especially  true  because  the  30-  day  waiting  period  has  been  the  interim  rule  since  we  adopted 
 the  CPNI  Clarification  Order  and  has  been  the  subject  of  no  carrier  complaints  or  concerns. 
 31.  We  adopt  a  requirement  that  carriers  make  available  to  every  customer  a  method  to  opt-  out  that  is  of  no  additional  cost  and  available  24  hours  a  day,  seven  days  a  week.  This 

 requirement  can  be  satisfied  through  a  combination  of  methods,  so  long  as  all  customers  have  the  ability  to  opt-  out  at  no  cost  and  are  able  to  effectuate  that  choice  whenever  they  choose.  To  the 
 degree  that  carriers  find  that  the  burden  of  meeting  this  requirement  outweigh  the  value  of  using  an  opt-  out  approval  method,  carriers  are  free  to  use  opt-  in.  Carriers  are  otherwise  free  to 
 determine  what  methods  to  use  to  allow  customer  to  effectuate  their  CPNI  elections.  Although  this  requirement  will  impose  a  burden  on  small  and  large  carriers  alike,  the  Commission  strongly 
 believes  that  two  factors  mitigate  against  allowing  small  carriers  to  utilize  less  burdensome  alternatives.  First,  as  the  Commission  has  previously  held,  80  there  is  nothing  in  this  record  that 
 convinces  us  that  customers  of  small  carriers  are  entitled  to  lesser  protection  of  the  privacy  of  their  calling  records  than  those  customers  of  larger  carriers.  Accordingly,  it  would  be 
 inappropriate  to  allow  small  carriers  to  provide  less  effective  methods  for  customers  to  effectuate  their  CPNI  choices.  Second,  to  the  degree  that  these  requirements  impose  burdens  on  carriers, 
 those  burdens  are  outweighed  by  the  value  of  using  an  opt-  out  approval  mechanism  to  obtain  customer  approval  to  use  CPNI  for  marketing  communications-  related  services.  Should  carriers 
 find  that  not  to  be  the  case  in  their  individual  situations,  they  can  avoid  the  24/  7  requirement  by  adopting  an  opt-  in  approval  mechanism. 

 32.  We  forbear  from  applying  our  CPNI  approval  regulations  to  preferred  carrier  (  PC)  freezes,  allowing  small  and  large  carriers  alike  easier  access  to  PC-  freeze  information.  81 

 78  See  section  III.  C,  supra. 
 79  See  section  III.  C.  2.  a,  supra. 
 80  CPNI  Order,  13  FCC  Rcd  at  8214,  para.  236. 
 81  See  section  III.  D.  1,  supra.  A  preferred  carrier  freeze  (or  freeze)  prevents  a  change  in  a  subscribers  preferred 
 carrier  selection  unless  the  subscriber  gives  the  carrier  from  whom  the  freeze  was  requested  his  or  he  express  consent.  47  C.  F.  R.    64.  1190(  a). 
90
 Federal  Communications  Commission  FCC  02-  214 
 13 
 E.  Steps  Taken  to  Minimize  Significant  Economic  Impact  on  Small  Entities,  and  Significant  Alternatives  Considered 
 33.  The  RFA  requires  an  agency  to  describe  any  significant  alternatives  that  it  has  considered  in  reaching  its  proposed  approach,  which  may  include  the  following  four  alternatives 
 (among  others):  (  1)  the  establishment  of  differing  compliance  or  reporting  requirements  or  timetables  that  take  into  account  the  resources  available  to  small  entities;  (2)  the  clarification, 
 consolidation,  or  simplification  of  compliance  or  reporting  requirements  under  the  rule  for  small  entities;  (3)  the  use  of  performance,  rather  than  design,  standards;  and  (4)  an  exemption  from 
 coverage  of  the  rule,  or  any  part  thereof,  for  small  entities.  82 
 34.  While  the  approval  and  related  notice  measures  adopted  in  this  Order  apply  similarly  to  both  small  and  large  entities,  we  expect  that  small  entities  are  likely  to  benefit  to  the 

 extent  such  firms  have  fewer  or  reduced  resources  available,  as  compared  to  large  firms.  The  Commissions  previously  adopted  rules  required  all  carriers  to  obtain  opt-  in  approval  from  their 
 customers  to  use  CPNI  outside  of  the  total  service  approach.  Although  the  Commission  allowed  carriers  to  use  opt-  out  as  an  interim  measure  in  light  of  the  Tenth  Circuits  opinion,  that  approach 
 was  never  codified  or  adopted  as  a  permanent  rule.  As  discussed  above,  this  Order  adopts  an  approach  that  is  derived  from  a  careful  balancing  of  harms,  benefits,  and  governmental 
 interests.  83  First,  use  of  CPNI  by  carriers  or  disclosure  to  their  affiliated  entities  providing  communications-  related  services,  84  as  well  as  third-  party  agents  and  joint  venture  partners 
 providing  communications-  related  services,  requires  a  customers  knowing  consent  in  the  form  of  notice  and  opt-  out  approval.  85  Second,  disclosure  of  CPNI  to  unrelated  third  parties  or  to 
 carrier  affiliates  that  do  not  provide  communications-  related  services  requires  express  customer  consent,  described  as  opt-  in  approval.  86  Finally,  we  reaffirm  our  total  services  approach, 
 which  permits  the  carrier  to  use  CPNI  to  market  new  product  offerings  within  the  carrier-customer  service  relationship,  on  the  basis  of  the  customers  implied  consent.  87 

 35.  Accordingly,  we  conclude  that  the  measures  adopted  and  described  in  this  Order  would  reduce  regulatory  burdens  for  small  carriers  including  resellers,  by  allowing  carriers 
 access  to  CPNI  for  marketing  communications-  related  services  to  their  customers  via  an  opt-  out  mechanism.  Further,  the  Order  specifically  allows  carriers  to  use  opt-  in  approval  for  all  CPNI 
 uses  should  a  carrier  determine  that  opt-  in  is  more  appropriate  for  its  individual  circumstances, 
 82  5  U.  S.  C.    603(  c)(  1)-(  c)(  4). 
 83  See  sections  I  and  III.  A,  supra. 
 84  In  this  Order  and  Further  NPRM,  we  use  the  term  "communications-  related  services"  to  mean 
 telecommunications  services,  information  services  typically  provided  by  telecommunications  carriers,  and  services  related  to  the  provision  or  maintenance  of  customer  premises  equipment.  We  use  this  term  only  for  convenience  in 

 this  Order  and  FNRPM  and  not  for  any  other  purposes. 
 85  See  section  III.  A.  1,  supra. 

 86  See  section  III.  A.  2,  supra. 
 87  See  section  III.  B.  2,  supra. 
91
 Federal  Communications  Commission  FCC  02-  214 
 14 
 allowing  carriers  to  make  decisions  regarding  their  customers  and  resources. 
 36.  Furthermore,  as  noted  above,  the  previously  adopted  opt-  in  rules  were  subject  to  and  complied  with  the  requirements  of  the  RFA.  Accordingly,  the  Commission  has  previously 

 undertaken  an  analysis  of  opt-  in  and  potential  alternatives  with  respect  to  small  carriers.  Although  such  analysis  does  not  replace  the  analysis  that  the  Commission  must  perform  in  this 
 Order,  it  provides  meaningful  guidance.  In  previous  CPNI  Orders,  the  Commission  received  comment  from  several  parties  on  the  impact  of  proposed  rules  on  small  carriers.  After  extensive 
 analysis,  the  Commission  found  that  [  a]  fter  consideration  of  possible  alternatives,  we  have  concluded  that  our  rules  should  apply  equally  to  all  carriers.  88  The  Commissions  reasoning 
 remains  valid  today.  Of  special  importance  in  this  context,  our  consistent  determination,  made  throughout  this  proceeding,  that  we  are  unpersuaded  that  customers  of  small  businesses  have 
 less  meaningful  privacy  interests  in  their  CPNI."  89  This  is  especially  true  because,  in  drafting  section  222,  Congress  determined  that  CPNI  protections  should  apply  to  consumers  of  [  e]  very 
 telecommunications  carrier.  90 
 37.  In  this  Order,  we  also  describe  commenters  positions  regarding  other  appropriate  approval  methods  and  related  notice  issues  and  state  why  those  alternatives  that  we  do  not  adopt 

 would  not  serve  the  public  interest.  91  For  example,  many  carriers,  including  small  carriers,  proposed  that  we  allow  carriers  to  use  opt-  out  approval  for  all  CPNI  uses.  However,  as  we  point 
 out  in  this  Order,  the  Commission  must  fulfill  its  statutorily  imposed  duty  to  protect  consumers  CPNI,  while  balancing  those  interests  with  carriers  First  Amendment  interests.  Therefore,  as 
 discussed  in  detail  in  the  Order,  we  conclude  that  the  CPNI  rules  we  adopt  today    which  balance  in  an  equitable  fashion  all  consumers  privacy  rights  with  carriers  First  Amendment  rights   
 strike  the  right  balance  for  small  and  large  carriers  alike.  Moreover,  we  gain  assurance  from 
 88  CPNI  Order,  13  FCC  Rcd  at  8213,  para.  235. 
 89  CPNI  Order,  13  FCC  Rcd  at  8214,  para.  236. 
 90  47  U.  S.  C.    222(  a). 
 91  See  Sections  V.  A  and  V.  B. 
92
 Federal  Communications  Commission  FCC  02-  214 
 15 
 knowing  that  the  rules  we  adopt  benefit  small  carriers  and  serve  the  public  interest  by  allowing  carriers  with  expanded  access  to  consumers  CPNI  from  our  original  opt-  in  rules. 
 38.  Report  to  Congress.  The  Commission  will  send  a  copy  of  this  Order,  including  this  FRFA,  in  a  report  to  be  sent  to  Congress  pursuant  to  the  Congressional  Review  Act.  92  In 
 addition,  the  Commission  will  send  a  copy  of  this  Order,  including  this  FRFA,  to  the  Chief  Counsel  for  Advocacy  of  the  SBA.  A  copy  of  this  Order  and  FRFA  (or  summaries  thereof)  will 
 also  be  published  in  the  Federal  Register.  93 

 92  See  5  U.  S.  C.    801(  a)(  1)(  A). 
 93  See  5  U.  S.  C.    604(  b). 
93
 Federal  Communications  Commission  FCC  02-  214 
 APPENDIX  D    INITIAL  REGULATORY  FLEXIBILITY  ANALYSIS 
 1.  As  required  by  the  Regulatory  Flexibility  Act  (RFA),  1  the  Commission  has  prepared  this  Initial  Regulatory  Flexibility  Analysis  (IRFA)  of  the  possible  significant  economic 
 impact  on  small  entities  by  the  policies  and  rules  proposed  in  this  Third  Further  Notice  of  Proposed  Rulemaking  (  Third  Further  NPRM).  Written  public  comments  are  requested  on  this 
 IRFA.  Comments  must  be  identified  as  responses  to  the  IRFA  and  must  be  filed  by  the  deadlines  for  comments  on  the  Third  Further  NPRM  provided  above  in  paragraph  153.  The  Commission 
 will  send  a  copy  of  the  Third  Further  NPRM,  including  this  IRFA,  to  the  Chief  Counsel  for  Advocacy  of  the  Small  Business  Administration.  2  In  addition,  the  Third  Further  NPRM  and 
 IRFA  (or  summaries  thereof)  will  be  published  in  the  Federal  Register.  3 
 A.  Need  for,  and  Objectives  of,  the  Proposed  Rules 
 2.  The  Commission  is  issuing  the  Third  Further  NPRM  to  refresh  the  record  on  two  issues  raised  in  the  CPNI  Order  Further  NPRM,  4  and  to  seek  comment  on  the  CPNI  implications 

 when  a  carrier  goes  out  of  business,  sells  all  or  part  of  its  customer  base,  or  seeks  bankruptcy  protection.  Specifically,  the  Third  Further  NPRM  seeks  comment  on:  (1)  foreign  storage  of  and 
 access  to  domestic  CPNI;  (2)  CPNI  safeguards  and  enforcements  mechanisms;  and  (3)  appropriate  regulations  governing  the  CPNI  held  by  carriers  that  go  out  of  business,  sell  all  or 
 part  of  their  customer  base,  or  seek  bankruptcy  protection. 
 3.  In  a  July  8,  1997  Ex  Parte  letter,  the  FBI  requested  that  the  Commission  regulate  the  foreign  storage  of  and  foreign-  based  access  to  CPNI  of  U.  S.  customers  who  use  domestic 

 telecommunications  services.  5  The  Commission  requested  comment  on  this  proposal  in  its  CPNI  Order  Further  NPRM.  6  As  an  alternative,  the  FBI  suggested  that  foreign  storage  or  access  to 
 domestic  CPNI  be  permitted  only  upon  informed  written  customer  approval.  To  the  degree  that  CPNI  is  stored  in  a  foreign  country,  the  FBI  asked  that  the  Commission  require  carriers  to  keep  a 
 copy  of  customers  CPNI  records  within  the  U.  S.  for  public  safety,  law  enforcement,  and  national  security  reasons.  The  FBI  also  requested  that  we  require  carriers  to  maintain  copies  of 
 the  CPNI  of  all  U.  S.-  based  customers  because  of  the  need  for  prompt  and  secure  law 
 1  See  5  U.  S.  C.    603.  The  RFA,  5  U.  S.  C.    601  et.  seq.,  has  been  amended  by  the  Small  Business  Regulatory 
 Enforcement  Fairness  Act  of  1996  (SBREFA),  Pub.  L.  No.  104-  121,  110  Stat.  847  (1996). 

 2  5  U.  S.  C.    603(  a). 
 3  5  U.  S.  C.    603(  a). 
 4  Implementation  of  the  Telecommunications  Act  of  1996:  Telecommunications  Carriers  Use  of  Customer 
 Proprietary  Network  Information  and  Other  Customer  Information;  and  Implementation  of  the  Non-  Accounting  Safeguards  of  Sections  271  and  272  of  the  Communications  Act  of  1934,  as  amended,  Second  Report  and  Order  and 

 Further  Notice  of  Proposed  Rulemaking,  13  FCC  Rcd  8061,  8200  (1998)  (CPNI  Order  Further  NPRM). 
 5  Letter  from  John  F.  Lewis,  Jr.,  Federal  Bureau  of  Investigation,  to  William  F.  Caton,  Acting  Secretary,  Federal 
 Communications  Commission,  CC  Docket  No.  96-  115  (filed  July  8,  1997)  (FBI  July  8,  1998  Ex  Parte  Letter). 
 6  CPNI  Order  Further  NPRM,  13  FCC  Rcd  at  8203-  8204,  paras.  208-  210. 
94
 Federal  Communications  Commission  FCC  02-  214 
 2 
 enforcement  purposes.  The  Commission  now  requests  that  commenters  refresh  the  record  on  this  topic.  Specifically,  we  request  that  commenters  consider  the  FBI  proposal  in  light  of 
 heightened  national  security  concerns.  In  addition,  we  request  input  as  to  whether  any  of  the  concerns  raised  by  the  FBI  have  been  illustrated  by  actual  incidents  during  the  period  since 
 comments  were  received  on  this  topic.  Finally,  we  ask  commenters  to  provide  estimates  of  the  costs  that  would  be  incurred  if  we  were  to  mandate  carriers  to  maintain  the  domestic  storage  of, 
 and  access  to,  domestic  CPNI.  7 
 4.  In  the  CPNI  Order  Further  NPRM,  8  the  Commission  sought  comment  on  what  safeguards  in  addition  to  those  adopted  in  the  CPNI  Order,  9  if  any,  are  needed  to  protect  the 

 confidentiality  of  carrier  proprietary  information  (CPI),  including  that  of  resellers  and  ISPs.  The  CPNI  Order  Further  NPRM  also  sought  comment  on  what,  if  any,  further  enforcement 
 mechanisms  the  Commission  should  adopt  to  ensure  carrier  compliance  with  our  CPNI  policies  and  rules.  10  We  seek  to  refresh  the  record  on  this  topic.  Specifically,  we  request  that  carriers  and 
 other  interested  parties  describe  any  actual  experience  with  problems  since  we  originally  issued  the  CPNI  Order  Further  NPRM.  11 

 5.  Finally,  in  light  of  inquiries  the  Commission  has  received  in  the  face  of  recent  carrier  bankruptcies,  mergers,  and  asset  sales,  the  Commission  seeks  comment  on  carrier  use  and 
 disclosure  of  CPNI  when  it  sells  its  assets  or  goes  out  of  business.  We  seek  comment  on  whether  an  exiting  carrier  should  be  able  to  use  CPNI  for  transition  of  its  customers  to  another  carrier.  If 
 commenters  believe  that  an  exiting  carrier  should  be  able  to  disclose  CPNI  to  the  acquiring  carrier,  we  seek  comment  on  whether  we  should  require  the  exiting  carrier  to  state  that  fact  in 
 advance  notice  provided  to  customers  acquired  by  the  sale  or  transfer  from  another  carrier  in  compliance  with  our  authorization  and  verification  (slamming)  rules.  12  Further,  we  ask,  to  the 
 degree  that  the  exiting  carrier  has  obtained  CPNI  approvals  from  its  customer,  whether  the  new  carrier  should  be  deemed  to  have  received  such  approvals,  or  whether  it  should  be  required  to 
 provide  notice  and  obtain  approval  for  CPNI  use  and  disclosure  from  the  acquired  customers.  13  Further,  we  seek  comment  on  whether  the  Commission  should  recognize  a  difference  between 
 service  types.  We  also  seek  comment  on  whether  carriers  can  sell  CPNI  as  an  asset.  We  seek  comment  on  whether  such  regulations  would  go  beyond  the  scope  of  section  222  or  the 
 Commissions  authority.  14 

 7  See  supra  para.  144. 
 8  CPNI  Order,  13  FCC  Rcd  at  8201-  8202,  paras.  206-  207. 
 9  CPNI  Order,  13  FCC  Rcd  at  8193-  8200,  paras.  190-  202. 
 10  Id. 
 11  See  supra  para.  145. 
 12  47  C.  F.  R  64.  1120(  e). 
 13  See  supra  para.  146. 
 14  See  supra  para.  147. 
95
 Federal  Communications  Commission  FCC  02-  214 
 3 
 B.  Legal  Basis 
 6.  The  Third  Further  NPRM  is  adopted  pursuant  to  Sections  1,  4(  i),  222,  and  303(  r)  of  the  Communications  Act  of  1934,  as  amended,  47  U.  S.  C.    151,  154(  i),  222,  and  303(  r). 

 C.  Description  and  Estimate  of  the  Number  of  Small  Entities  to  Which  the  Proposed  Rules  will  Apply 
 7.  The  RFA  directs  agencies  to  provide  a  description  of  and,  where  feasible,  an  estimate  of  the  number  of  small  entities  that  will  be  affected  by  the  proposed  rules,  if  adopted.  15 
 The  RFA  generally  defines  the  term  "small  entity"  as  having  the  same  meaning  as  the  terms  "small  business,"  "small  organization,"  and  "small  governmental  jurisdiction."  16  In  addition,  the 
 term  "small  business"  has  the  same  meaning  as  the  term  small  business  concern  under  the  Small  Business  Act.  17  A  small  business  concern"  is  one  that:  (1)  is  independently  owned  and 
 operated;  (2)  is  not  dominant  in  its  field  of  operation;  and  (3)  satisfies  any  additional  criteria  established  by  the  Small  Business  Administration  (SBA).  18 

 8.  The  most  reliable  source  of  information  regarding  the  total  numbers  of  certain  common  carrier  and  related  providers  nationwide  appears  to  be  data  the  Commission  publishes 
 annually  in  its  Telecommunications  Provider  Locator  report,  derived  from  filings  made  in  connection  with  the  Telecommunications  Relay  Service  (TRS).  19  According  to  data  in  the  most 
 recent  report,  there  are  5,679  interstate  service  providers.  20  These  providers  include,  inter  alia,  local  exchange  carriers,  wireline  carriers  and  service  providers,  interexchange  carriers, 
 competitive  access  providers,  operator  service  providers,  pay  telephone  operators,  providers  of  telephone  service,  providers  of  telephone  exchange  service,  and  resellers. 

 9.  We  have  included  small  incumbent  local  exchange  carriers  (LECs)  21  in  this  present  RFA  analysis.  As  noted  above,  a  "small  business"  under  the  RFA  is  one  that,  inter  alia, 
 meets  the  pertinent  small  business  size  standard  (e.  g.,  a  telephone  communications  business 

 15  5  U.  S.  C.    603(  b)(  3). 
 16  5  U.  S.  C.    601(  6). 
 17  5  U.  S.  C.    601(  3)  (incorporating  by  reference  the  definition  of  small  business  concern  in  the  Small  Business 
 Act,  15  U.  S.  C.    632).  Pursuant  to  5  U.  S.  C.    601(  3),  the  statutory  definition  of  a  small  business  applies  unless  an  agency,  after  consultation  with  the  Office  of  Advocacy  of  the  Small  Business  Administration  and  after  opportunity 

 for  public  comment,  establishes  one  or  more  definitions  of  such  term  which  are  appropriate  to  the  activities  of  the  agency  and  publishes  such  definition(  s)  in  the  Federal  Register. 

 18  15  U.  S.  C.    632. 
 19  FCC,  Common  Carrier  Bureau,  Industry  Analysis  Division,  Telecommunications  Provider  Locator,  Tables  1-  2 
 (November  2001)  (Provider  Locator).  See  also  47  C.  F.  R.    64.  601  et  seq. 
 20  Provider  Locator  at  Table  1. 

 21  See  47  U.  S.  C    251(  h)  (defining  incumbent  local  exchange  carrier). 
96
 Federal  Communications  Commission  FCC  02-  214 
 4 
 having  1,500  or  fewer  employees),  and  "is  not  dominant  in  its  field  of  operation."  22  The  SBA's  Office  of  Advocacy  contends  that,  for  RFA  purposes,  small  incumbent  LECs  are  not  dominant  in 
 their  field  of  operation  because  any  such  dominance  is  not  "national"  in  scope.  23  We  have  therefore  included  small  incumbent  LECs  in  this  RFA  analysis,  although  we  emphasize  that  this 
 RFA  action  has  no  effect  on  FCC  analyses  and  determinations  in  other,  non-  RFA  contexts. 
 10.  Total  Number  of  Telephone  Companies  Affected.  The  U.  S.  Bureau  of  Census  (Census  Bureau)  reports  that,  at  the  end  of  1992,  there  were  3,497  firms  engaged  in  providing 

 telephone  services,  as  defined  therein,  for  at  least  one  year.  24  This  number  contains  a  variety  of  different  categories  of  carriers,  including  LECs,  interexchange  carriers,  competitive  access 
 providers,  operator  service  providers,  pay  telephone  operators,  and  resellers.  It  seems  certain  that  some  of  these  3,497  telephone  service  firms  may  not  qualify  as  small  entities  or  small 
 incumbent  LECs  because  they  are  not  "independently  owned  and  operated."  25  It  seems  reasonable  to  conclude  that  fewer  than  3,497  telephone  service  firms  are  small  entity  telephone 
 service  firms  that  may  be  affected  by  these  rules. 
 11.  Wireline  Carriers  and  Service  Providers.  The  SBA  has  developed  a  definition  of  small  entities  for  telephone  communications  companies  other  than  radiotelephone  (wireless) 

 companies.  The  Census  Bureau  reports  that  there  were  2,321  such  telephone  companies  in  operation  for  at  least  one  year  at  the  end  of  1992.  26  According  to  the  SBA's  definition,  a  small 
 business  telephone  company  other  than  a  radiotelephone  (wireless)  company  is  one  employing  no  more  than  1,500  persons.  27  All  but  26  of  the  2,321  non-  radiotelephone  (wireless)  companies 
 listed  by  the  Census  Bureau  were  reported  to  have  fewer  than  1,000  employees.  Even  if  all  26  of  the  remaining  companies  had  more  than  1,500  employees,  there  would  still  be  2,295 
 non-  radiotelephone  (wireless)  companies  that  might  qualify  as  small  entities  or  small  incumbent  LECs.  Although  it  seems  certain  that  some  of  these  carriers  are  not  independently  owned  and 
 operated,  we  are  unable  at  this  time  to  estimate  with  greater  precision  the  number  of  wireline  carriers  and  service  providers  that  would  qualify  as  small  business  concerns  under  SBAs 
 definition.  Therefore,  we  estimate  that  fewer  than  2,295  small  telephone  communications 

 22  15  U.  S.  C.    632. 
 23  Letter  from  Jere  W.  Glover,  Chief  Counsel  for  Advocacy,  SBA,  to  William  E.  Kennard,  Chairman,  FCC  (May 
 27,  1999).  The  Small  Business  Act  contains  a  definition  of  "small  business  concern,"  which  the  RFA  incorporates  into  its  own  definition  of  "small  business."  See  15  U.  S.  C.    632(  a)  (Small  Business  Act);  5  U.  S.  C.    601(  3)  (RFA). 

 SBA  regulations  interpret  "small  business  concern"  to  include  the  concept  of  dominance  on  a  national  basis.  13  C.  F.  R.    121.102(  b). 

 24  U.  S.  Department  of  Commerce,  Bureau  of  the  Census,  1992  Census  of  Transportation,  Communications,  and 
 Utilities:  Establishment  and  Firm  Size,  at  Firm  Size  1-  123  (1995)  (1992  Census). 
 25  See  generally  15  U.  S.  C.    632(  a)(  1). 

 26  1992  Census  at  Firm  Size  1-  123. 
 27  13  C.  F.  R.    121.201,  North  American  Industry  Classification  System  (NAICS)  codes  513310,  513330,  and 
 513340. 
97
 Federal  Communications  Commission  FCC  02-  214 
 5 
 companies  other  than  radiotelephone  (wireless)  companies  are  small  entities  that  may  be  affected  by  these  rules. 
 12.  Local  Exchange  Carriers.  Neither  the  Commission  nor  the  SBA  has  developed  a  definition  of  small  providers  of  local  exchange  services.  The  closest  applicable  definition  under 
 the  SBA's  rules  is  for  telephone  communications  companies  other  than  radiotelephone  (wireless)  companies.  28  The  most  reliable  source  of  information  regarding  the  number  of  LECs  nationwide 
 of  which  we  are  aware  appears  to  be  the  data  that  we  collect  annually  in  connection  with  the  Telecommunications  Relay  Service  (TRS).  29  According  to  our  most  recent  data,  there  are  1,329 
 local  exchange  carriers,  including  incumbent  LECs.  30  Although  it  seems  certain  that  some  of  these  carriers  are  not  independently  owned  and  operated,  or  have  more  than  1,500  employees,  we 
 are  unable  at  this  time  to  estimate  with  greater  precision  the  number  of  LECs  that  would  qualify  as  small  business  concerns  under  the  SBA's  definition.  Consequently,  we  estimate  that  they  are 
 fewer  than  1,  329  small  entity  LECs  that  may  be  affected  by  the  proposals  in  the  Second  Further  Notice. 

 13.  Interexchange  Carriers.  Neither  the  Commission  nor  the  SBA  has  developed  a  definition  of  small  entities  specifically  applicable  to  providers  of  interexchange  services  (IXCs). 
 The  closest  applicable  definition  under  the  SBA's  rules  is  for  telephone  communications  companies  other  than  radiotelephone  (wireless)  companies.  31  The  most  reliable  source  of 
 information  regarding  the  number  of  IXCs  nationwide  of  which  we  are  aware  appears  to  be  the  data  that  we  collect  annually  in  connection  with  TRS.  32  According  to  our  most  recent  data,  229 
 companies  reported  that  they  were  engaged  in  the  provision  of  interexchange  services.  33  Although  it  seems  certain  that  some  of  these  carriers  are  not  independently  owned  and  operated, 
 or  have  more  than  1,500  employees,  we  are  unable  at  this  time  to  estimate  with  greater  precision  the  number  of  IXCs  that  would  qualify  as  small  business  concerns  under  the  SBA's  definition. 
 Consequently,  we  estimate  that  there  are  fewer  than  229  small  entity  IXCs  that  may  be  affected  by  this  order. 

 14.  Competitive  Access  Providers.  Neither  the  Commission  nor  the  SBA  has  developed  a  definition  of  small  entities  specifically  applicable  to  providers  of  competitive  access 
 services  (CAPs).  The  closest  applicable  definition  under  the  SBA's  rules  is  for  telephone  communications  companies  other  than  radiotelephone  (wireless)  companies.  34  The  most  reliable 
 source  of  information  regarding  the  number  of  CAPs  nationwide  of  which  we  are  aware  appears 
 28  13  C.  F.  R.    121.201,  NAICS  code  513310. 
 29  See  47  C.  F.  R.    64.  601  et  seq.;  Provider  Locator  at  Table  1. 
 30  Provider  Locator  at  Table  1. 
 31  13  C.  F.  R.    121.201,  NAICS  code  513310. 
 32  See  47  C.  F.  R.    64.  601  et  seq.;  Provider  Locator  at  Table  1. 
 33  Provider  Locator  at  Table  1. 
 34  13  C.  F.  R.    121.201,  NAICS  code  513310. 
98
 Federal  Communications  Commission  FCC  02-  214 
 6 
 to  be  the  data  that  we  collect  annually  in  connection  with  the  TRS.  35  According  to  our  most  recent  data,  532  companies  reported  that  they  were  engaged  in  the  provision  of  either 
 competitive  access  services  or  competitive  local  exchange  service.  36  Although  it  seems  certain  that  some  of  these  carriers  are  not  independently  owned  and  operated,  or  have  more  than  1,500 
 employees,  we  are  unable  at  this  time  to  estimate  with  greater  precision  the  number  of  CAPs  that  would  qualify  as  small  business  concerns  under  the  SBA's  definition.  Consequently,  we  estimate 
 that  there  are  fewer  than  532  small  entity  CAPs  that  may  be  affected  by  this  order. 
 15.  Operator  Service  Providers.  Neither  the  Commission  nor  the  SBA  has  developed  a  definition  of  small  entities  specifically  applicable  to  providers  of  operator  services.  The  closest 

 applicable  definition  under  the  SBA's  rules  is  for  telephone  communications  companies  other  than  radiotelephone  (wireless)  companies.  37  The  most  reliable  source  of  information  regarding 
 the  number  of  operator  service  providers  nationwide  of  which  we  are  aware  appears  to  be  the  data  that  we  collect  annually  in  connection  with  the  TRS.  38  According  to  our  most  recent  data, 
 22  companies  reported  that  they  were  engaged  in  the  provision  of  operator  services.  39  Although  it  seems  certain  that  some  of  these  companies  are  not  independently  owned  and  operated,  or  have 
 more  than  1,500  employees,  we  are  unable  at  this  time  to  estimate  with  greater  precision  the  number  of  operator  service  providers  that  would  qualify  as  small  business  concerns  under  the 
 SBA's  definition.  Consequently,  we  estimate  that  there  are  fewer  than  22  small  entity  operator  service  providers  that  may  be  affected  by  this  order. 

 16.  Pay  Telephone  Providers.  Neither  the  Commission  nor  the  SBA  has  developed  a  definition  of  small  entities  specifically  applicable  to  pay  telephone  providers.  The  closest 
 applicable  definition  under  the  SBA's  rules  is  for  telephone  communications  companies  other  than  radiotelephone  (wireless)  companies.  40  The  most  reliable  source  of  information  regarding 
 the  number  of  pay  telephone  operators  nationwide  of  which  we  are  aware  appears  to  be  the  data  that  we  collect  annually  in  connection  with  the  TRS.  41  According  to  our  most  recent  data,  936 
 companies  reported  that  they  were  engaged  in  the  provision  of  pay  telephone  services.  42  Although  it  seems  certain  that  some  of  these  carriers  are  not  independently  owned  and  operated, 
 or  have  more  than  1,500  employees,  we  are  unable  at  this  time  to  estimate  with  greater  precision  the  number  of  pay  telephone  operators  that  would  qualify  as  small  business  concerns  under  the 

 35  See  47  C.  F.  R.    64.  601  et  seq.;  Provider  Locator  at  Table  1. 
 36  Provider  Locator  at  Table  1. 
 37  13  C.  F.  R.    121.201,  NAICS  code  513310. 
 38  See  47  C.  F.  R.    64.  601  et  seq.;  Provider  Locator  at  Table  1. 
 39  Provider  Locator  at  Table  1. 
 40  13  C.  F.  R.    121.201,  NAICS  code  513310. 
 41  13  C.  F.  R.    121.201,  NAICS  code  513310. 
 42  Provider  Locator  at  Table  1. 
99
 Federal  Communications  Commission  FCC  02-  214 
 7 
 SBA's  definition.  Consequently,  we  estimate  that  there  are  fewer  than  936  small  entity  pay  telephone  operators  that  may  be  affected  by  this  order. 
 17.  Wireless  Carriers.  Wireless  telephony  includes  cellular,  personal  communications  services  (PCS)  or  specialized  mobile  radio  (SMR)  service  providers.  The  SBA 
 has  developed  a  definition  of  small  entities  for  radiotelephone  (wireless)  companies;  43  however,  neither  the  Commission  nor  the  SBA  has  developed  a  definition  of  small  entities  applicable  to 
 cellular  licensees,  or  to  providers  of  paging  and  messaging  services.  Though  categorized  under  the  same  size  standard  as  the  other  wireless  services  discussed  in  this  paragraph,  paging  is  now 
 considered  a  separate  industry.  44  The  closest  applicable  definition  under  the  SBA's  rules  is  for  telephone  communications  companies  other  than  radiotelephone  (wireless)  companies.  45 
 According  to  the  SBA's  definition,  a  small  business  radiotelephone  company  is  one  employing  no  more  than  1,500  persons.  46  According  to  the  most  recent  Provider  Locator  data,  858  carriers 
 reported  that  they  were  engaged  in  the  provision  of  wireless  telephony  and  576  companies  reported  that  they  were  engaged  in  the  provision  of  paging  and  messaging  services.  47  Although  it 
 seems  certain  that  some  of  these  carriers  are  not  independently  owned  and  operated,  we  are  unable  at  this  time  to  estimate  with  greater  precision  the  number  of  radiotelephone  carriers  and 
 service  providers  that  would  qualify  as  small  business  concerns  under  the  SBA's  definition.  Consequently,  we  estimate  that  there  are  fewer  than  858  small  carriers  providing  wireless 
 telephony  services  and  fewer  than  576  small  companies  providing  paging  and  messaging  services  that  may  be  affected  by  these  rules. 

 18.  Resellers.  Neither  the  Commission  nor  the  SBA  has  developed  a  definition  of  small  entities  specifically  applicable  to  resellers.  The  closest  applicable  definition  under  the 
 SBA's  rules  is  for  all  telephone  communications  companies.  48  The  most  reliable  source  of  information  regarding  the  number  of  toll  resellers  nationwide  of  which  we  are  aware  appears  to 
 be  the  data  that  we  collect  annually  in  connection  with  the  TRS.  49  According  to  our  most  recent  data,  710  companies  reported  that  they  were  engaged  in  the  resale  of  telephone  services.  50 
 Although  it  seems  certain  that  some  of  these  carriers  are  not  independently  owned  and  operated,  or  have  more  than  1,500  employees,  we  are  unable  at  this  time  to  estimate  with  greater  precision 
 the  number  of  resellers  that  would  qualify  as  small  business  concerns  under  the  SBA's  definition. 

 43  13  C.  F.  R.    121.201,  NAICS  codes  513321  and  513322. 
 44  13  C.  F.  R.    121.201,  NAICS  code  513321. 
 45  Id. 
 46  13  C.  F.  R.    121.201  (SIC  4812/  NAICS  513322). 
 47  Provider  Locator  at  Table  1. 
 48  13  C.  F.  R.    121.201,  NAICS  code  513310. 
 49  13  C.  F.  R.    121.201,  NAICS  code  513310. 
 50  Provider  Locator  at  Table  1.  The  total  for  resellers  includes  both  toll  resellers  and  local  resellers. 
100
 Federal  Communications  Commission  FCC  02-  214 
 8 
 Consequently,  we  estimate  that  there  are  fewer  than  710  small  entity  resellers  that  may  be  affected  by  this  order. 
 D.  Description  of  Projected  Reporting,  Recordkeeping  and  Other  Compliance  Requirements 
 19.  We  have  discussed  generally  in  the  Third  Further  NPRM,  supra  paras.  143-  147,  the  possibility  that  our  tentative  policies  and  rules,  if  adopted,  might  entail  additional  obligations 
 for  carriers.  We  ask  for  comment  on  any  reporting,  record  keeping,  or  compliance  requirements  that  might  arise  that  could  impact  any  entities,  large  and  small,  affected  by  such  requirements. 

 E.  Steps  Taken  to  Minimize  Significant  Economic  Impact  on  Small  Entities,  and  Significant  Alternatives  Considered 
 20.  The  RFA  requires  an  agency  to  describe  any  significant  alternatives  that  it  has  considered  in  reaching  its  proposed  approach,  which  may  include  the  following  four  alternatives 
 (among  others):  (1)  the  establishment  of  differing  compliance  or  reporting  requirements  or  timetables  that  take  into  account  the  resources  available  to  small  entities;  (2)  the  clarification, 
 consolidation,  or  simplification  of  compliance  or  reporting  requirements  under  the  rule  for  small  entities;  (3)  the  use  of  performance,  rather  than  design,  standards;  and  (4)  an  exemption  from 
 coverage  of  the  rule,  or  any  part  thereof,  for  small  entities.  51 
 21.  Section  222  applies  to  all  telecommunications  carriers,  and  therefore,  any  rules  that  we  adopt  will  be  applicable  to  all  carriers.  52  Accordingly,  we  cannot  exempt  small  entities 

 from  complying  with  any  rules  that  we  adopt.  We  have,  however,  taken  the  limited  resources  of  small  entities  into  account  in  promulgating  certain  existing  CPNI  rules,  53  and  intend  to  do  so 
 again  in  addressing  the  issues  that  are  addressed  in  the  Third  Further  NPRM.  In  response  to  the  IRFA  issued  in  connection  with  the  Clarification  Order  and  Second  Further  Notice  of  Proposed 
 Rulemaking,  we  note  that  some  commenters  asserted  that,  because  the  statute  requires  a  universal  standard,  the  Commission  had  not  adequately  taken  notice  of  the  issues  of  small  entities  in  this 
 area.  54  That  is  untrue;  55  it  is  of  particular  concern  to  the  Commission  that  the  interests  of  small  entities  be  addressed. 

 51  5  U.  S.  C.    603(  c). 
 52  CPNI  Order,  13  FCC  Rcd  at  8098-  8100,  paras.  49-  50. 
 53  See  Implementation  of  the  Telecommunications  Act  of  1996;  Telecommunications  Carriers  Use  of  Customer 
 Proprietary  Network  Information;  and  Implementation  of  the  Non-  Accounting  Safeguards  of  Sections  271  and  272  of  the  Communications  Act  of  1934,  as  amended,  Order  on  Reconsideration  and  Petitions  for  Forbearance,  14  FCC 

 Rcd  14409,  14472-  75,  paras.  125-  27  (1999)  (CPNI  Reconsideration  Order)  (adjusting  certain  CPNI  safeguards  to  ease  the  costs  of  compliance  for  small  carriers). 

 54  See  App.  C,  supra. 
 55  See  App.  C,  supra. 
101
 Federal  Communications  Commission  FCC  02-  214 
 9 
 22.  In  this  Third  Further  NPRM,  we  seek  comment  on  whether  we  should  regulate  the  foreign  storage  or  foreign-  based  access  to  the  CPNI  of  U.  S.  customers  who  use  domestic 
 telecommunications  services.  Specifically,  we  seek  comment  on  whether  foreign  storage  or  foreign  access  to  domestic  CPNI  should  be  permitted  only  upon  informed  customer  approval. 
 We  also  request  comment  upon  whether  we  should  require  that  copies  of  domestic  CPNI  should  be  maintained  within  the  United  States.  If  we  adopt  rules  governing  foreign  storage  of  and 
 access  to  CPNI,  all  telecommunications  carriers,  including  small  entities,  must  comply  with  such  rules.  While  additional  rules  could  place  a  burden  upon  small  entities  in  terms  of  developing, 
 tracking  and  maintaining  customer  consent  or  in  terms  of  creating  copies  of  customer  CPNI,  such  actions  would  only  be  required  to  the  extent  carriers  choose  to  store  domestic  CPNI  outside 
 of  the  United  States.  Carriers  could  decide  whether  the  burdens  of  any  such  regulations  outweighs  the  benefit  to  the  carrier  of  foreign  storage  of  or  access  to  domestic  CPNI. 

 23.  We  also  seek  to  refresh  the  record  on  what,  if  any,  additional  safeguards  may  be  needed  to  protect  the  confidentiality  of  carrier  proprietary  information,  as  well  as  what  further 
 enforcement  mechanisms,  if  any,  may  be  necessary.  In  addition,  we  seek  comment  on  the  use  and  disclosure  of  CPNI  in  the  event  a  carrier  goes  out  of  business  or  sells  its  assets.  Because  we 
 have  not  proposed  any  rules  at  this  time,  we  are  unable  to  forecast  the  economic  impact  on  small  entities.  Overall,  we  ask  for  comment  in  response  to  this  IRFA  on  what  competitive  or  economic 
 impact  any  proposed  rules  in  these  areas  would  have  on  small  entities  and  on  whether  there  is  any  alternative  form  or  proposals  that  we  should  consider  to  minimize  the  economic  impact  on 
 them.  Further,  while  we  do  not  anticipate  that  any  adopted  rules  will  have  a  different  impact  upon  small  entities,  we  seek  comment  in  particular  from  small  entities  that  have  concerns  about 
 the  affect  the  proposed  policies  or  rules,  if  adopted,  might  have  on  them  if  they  later  go  out  of  business  or  sell  their  assets. 

 F.  Federal  Rules  that  May  Duplicate,  Overlap,  or  Conflict  with  the  Proposed  Rules 
 24.  None. 
102
 Federal  Communications  Commission  FCC  02-  214 
 SEPARATE  STATEMENT  OF  CHAIRMAN  MICHAEL  K.  POWELL 
 Re:  Implementation  of  the  Telecommunications  Act  of  1996;  Telecommunications  Carriers  Use  of  Customer  Proprietary  Network  Information  and  Other  Customer  Information; 
 Implementation  of  the  Non-  Accounting  Safeguards  of  Sections  271  and  272  of  the  Communications  Act  of  1934,  as  Amended,  Third  Report  and  Order  and  Third  Further 
 Notice  of  Proposed  Rulemaking,  CC  Docket  Nos.  96-  115  et  al. 

 In  this  Order,  the  Commission  implements  the  Tenth  Circuits  directive  that  we  must,  as  a  constitutional  matter,  carefully  weigh  the  costs  and  benefits  associated  with  satisfying 
 consumers  statutory  entitlement  to  give  knowing  consent  to  the  use  and  disclosure  of  their  customer  proprietary  network  information  (CPNI).  We  do  this,  as  the  court  insisted,  while  still 
 respecting  companies  valid  speech  interests  pursuant  to  the  First  Amendment. 
 This  item  is  in  response  to  the  Tenth  Circuits  decision  remanding  our  prior  order  implementing  section  222  by  embracing  a  mixed  approach  to  customer  approval.  Companies 
 must  obtain  affirmative  consent  from  consumers  for  third  party  and  non-  communications  uses  (i.  e.,  allow  consumers  to  opt-  in  to  such  use).  But  we  conclude,  albeit  somewhat  reluctantly, 
 that  under  the  courts  constitutional  analysis,  companies  may  satisfy  the  somewhat  less  stringent  requirement  of  giving  consumers  the  chance  to  opt-  out  of  intracompany  communications-related 
 use  of  CPNI.  1  Indeed,  the  court  concluded  that  the  First  Amendment  concerns  implicated  here  are  so  grave  that  the  Commission  is  not  entitled  to  the  usual  Chevron  deference.  2  This 
 mixed  approach  we  adopt  here  tracks  evidence  on  the  record  that  consumers  have  a  reduced  expectation  of  privacy  regarding  CPNI  where  this  information  is  used  by  their  existing  carriers  to 
 market  services  customarily  offered  by  telephone  companies,  such  as  voicemail  and  Internet  access.  This  approach  also  comports  with  decisions  by  other  appeals  courts,  at  least  one  of 
 which  has  required  opt-  in  consent  for  some  purposes  and  opt-  out  consent  for  others.  3 
 Regrettably,  the  reach  of  the  Tenth  Circuits  opinion  does  not  allow  us  to  adopt  an  across-the-  board  opt-  in  regime  at  this  time.  Specifically,  the  Commission  is  severely  constrained  by  the 
 courts  overt  skepticism  that  the  record  supporting  our  prior  order  lacked  the  empirical  support  necessary  to  justify  in  this  instance  the  intrusion  on  carriers  commercial  speech  interests.  The 
 court  demanded,  if  requiring  opt-  in  consent  were  to  withstand  a  second  appeal,  that  the  record  provide  more  persuasive  empirical  evidence  that  the  privacy  interest  for  intracarrier  CPNI 
 disclosure  is  substantial  given  companies  intended  uses  of  this  information.  Yet,  despite  the 

 1  The  court  instructed  the  Commission  to  consider  an  opt-  out  strategy,  which  the  court  concluded  was  "an 
 obvious  and  substantially  less  restrictive  alternative"  to  opt-  in.  U.  S.  West  v.  FCC,  182  F.  3d  1224,  1238  (10  th  Cir.  1999),  cert.  denied  530  U.  S.  1213  (2000). 

 2  See  generally  Chevron  U.  S.  A.,  Inc.  v.  Natural  Resources  Defense  Council,  Inc.,  467  U.  S.  837  (1984). 
 3  See  Trans  Union  Corp.  v.  FTC,  267  F.  3d  1138  (D.  C.  Cir.  2001)  (declining  to  rehear  decision  approving  opt-  out 
 consent  regime  with  respect  to  disclosure  of  personal  information  in  return  for  offers  of  credit,  while  requiring  opt-  in  consent  regime  for  target  marketing  generally),  cert.  denied,  Trans  Union  LLC  v.  FTC,  122  S.  Ct.  2386  (June  10, 

 2002). 
103
 Federal  Communications  Commission  FCC  02-  214 
 2 
 laudable  efforts  of  the  parties  to  generate  such  an  empirical  record,  not  to  mention  our  own  efforts,  no  more  persuasive  evidence  emerged  that  would  satisfy  the  high  constitutional  bar  set 
 by  the  court.  Indeed,  the  most  persuasive  empirical  evidence  of  this  sort  regards  third  party  dissemination  of  CPNI,  where  this  Order  confidently  requires  opt-  in  consent. 

 In  closing,  I  would  underscore  that  I  remain  committed  to  continued  vigilance  in  this  area  and  urge  parties  to  ask  us  to  revisit  these  requirements  in  the  event  they  uncover  new  support  that 
 meets  the  courts  demanding  standard.  I  hasten  to  add,  moreover,  that  states  continue  to  be  uniquely  positioned  to  assess  the  proper  scope  of  CPNI  use  and  may  adopt  more  stringent 
 notification  requirements  where  those  can  be  squared  with  the  First  Amendment  based  on  state-specific  facts  on  which  we  lack  the  opportunity  to  rely  here.  I  take  comfort  that  these  avenues 
 will  enable  the  Commission  or  our  state  colleagues  to  protect  consumers  from  unwarranted  invasions  of  privacy  where  the  evidence  supports  more  stringent  consent  requirements  in  the 
 manner  the  Constitution  requires. 
104
 Federal  Communications  Commission  FCC  02-  214 
 STATEMENT  OF  COMMISSIONER  MICHAEL  J.  COPPS, 
 APPROVING  IN  PART,  DISSENTING  IN  PART 
 Re:  Implementation  of  the  Telecommunications  Act  of  1996;  Telecommunications  Carriers  Use  of  Customer  Proprietary  Network  Information  and  Other  Customer  Information; 
 Implementation  of  the  Non-  Accounting  Safeguards  of  Sections  271  and  272  of  the  Communications  Act  of  1934,  As  Amended 

 Few  rights  are  so  fundamental  as  the  right  to  privacy  in  our  daily  lives,  yet  few  are  under  such  frontal  assault.  Today  information  technologies  can  monitor  what  we  do,  who  we  talk  with, 
 what  we  buy,  what  organizations  we  belong  to,  what  political  activities  we  undertake,  what  gods  we  worship.  We  may  have  avoided  Orwells  1984,  but  the  threat  of  technology  intrusion  into 
 our  private  lives  is  not  only  real    it  is  growing. 
 Today  we  have  an  opportunity  to  do  something  about  it.  We  take  a  baby  step;  I  think  we  could  have  taken  a  giant  stride.  Certainly  I  support  that  part  of  the  Order  that  will  prohibit  the 
 sale  or  disclosure  of  personal  data  to  unaffiliated  third  parties  unless  consumers  give  specific  approval,  the  so-  called  opt-  in  approach,  and  I  am  pleased  that  the  decision  does  not  preempt 
 states  from  adopting  more  stringent  privacy  protections  than  we  do  today.  But  our  business  is  communications,  and  when  we  are  given  the  chance  to  decide  how  communications  companies 
 handle  personal  information  within  themselves  and  their  affiliates,  we  retreat  to  an  entirely  different  opt-  out  policy  whereby  the  company  gets  an  always-  on  green  light  to  sell  personal 
 information  about  its  customer  unless  the  customer  specifically  takes  the  initiative  to  tell  the  company  it  may  not  do  so. 

 Todays  decision  is  cast  as  pro-  consumer  and  opt-  in  except  for  what  is  implied  to  be  the  limited  and  less  problematic  sale  of  personal  information  to  communications-  related 
 affiliates,  third  party  agents,  and  joint  venture  partners,  where  opt-  out  will  be  required.  But  everyone  should  understand  that  this  decision  is  neither  narrow  nor  pro-  privacy.  It  does  not 
 preclude  companies  in  all  instances  from  selling  to  the  highest  bidder  personal  and  detailed  information  about  who  Americans  call,  when  they  call,  and  how  long  they  talk,  as  long  as  these 
 companies  use  it  for  some  communications  related  purpose  and  have  some  undefined  and  murky  affiliation,  agency  relationship,  or  partnership  with  the  phone  company.  Anyone  who  has 
 looked  at  some  of  the  incredibly  complex  organizational  charts  submitted  in  our  merger  proceedings  knows  just  how  confusing  and  murky  these  affiliations  can  be.  In  that  confusion 
 and  murkiness  I  find  potentially  serious  trouble  for  consumer  privacy. 
 Importance  of  Privacy  Safeguards 
 Telephone  carriers  obtain  a  vast  amount  of  information  about  each  of  us.  Carriers  know  not  only  the  phone  services  we  purchase,  but  also  personal  information  such  as  who  we  call,  how 
 often,  and  for  how  long.  And  in  a  converging  communications  industry,  these  same  companies  now,  or  may  soon,  also  be  able  to  track  what  Internet  sites  we  visit,  who  we  e-  mail,  what  cable  or 
 satellite  television  programs  we  watch,  what  wireless  phone  calls  we  place,  and  even  our  location  as  we  use  our  cell  phone.  Companies  can  combine  this  data  with  other  information  that  they  buy 
106
 Federal  Communications  Commission  FCC  02-  214 
 2 
 from  other  sources,  such  as  financial  data,  credit  histories,  travel  habits,  and  any  of  the  myriad  invasive  databases  that  exist  in  our  digital  world,  to  create  a  profile  on  each  of  us. 
 Companies  can  use  this  information,  known  as  CPNI,  for  a  variety  of  purposes.  They  rely  heavily  on  this  information  for  marketing.  Sometimes  these  marketing  practices  are  merely 
 annoying,  such  as  telemarketing  calls  and  junk  mail.  But  when  this  marketing  is  based  on  in-depth  personal  information,  it  can  become  dangerous.  CPNI  could  potentially  be  used  to  allow  a 
 company  to  market  healthcare  services  to  people  who  call  certain  doctors  or  specialists;  insurance  companies  to  know  who  calls  AIDS  hotlines;  fundraisers  to  identify  an  individuals 
 political  affiliation  based  on  who  calls  the  offices  of  candidates  or  political  parties;  or  landlords  to  monitor  the  behavior  of  their  tenants.  When  the  stakes  for  misuse  of  our  personal  information 
 are  so  high  the  Commission  should  be  extraordinarily  vigilant. 

 Section  222  and  the  FCC  Opt-  in  Decision 
 Congress  recognized  this  and  instructed  the  Commission  to  protect  the  privacy  of  telephone  consumers  in  section  222  of  the  Telecommunications  Act.  Congress  recognized  that 

 information  about  individual  communications  use  requires  special  privacy  safeguards.  In  particular,  section  222  limits  the  use  and  disclosure  of  personal  customer  information  unless  a 
 carrier  first  obtains  the  approval  of  the  customer.  1 
 In  1998,  the  Commission  adopted  rules  to  implement  Congress  privacy  directive.  The  Commission  correctly  understood  Congresss  insistence  on  a  company  acquiring  the  approval 
 of  the  customer  to  require  express  approval,  also  known  as  opt-  in,  for  use  and  disclosure  of  this  sensitive  personal  information.  Approval  is  clearly  an  active  rather  than  a  passive 
 requirement.  Opt-  out,  which  would  require  a  customer  to  take  affirmative  action  to  protect  his  or  her  personal  information,  is  a  failure  to  object,  and  not  approval.  These  concepts  are 
 founded  on  fundamentally  different  premises.  Opt-  out  strikes  me  as  based  on  the  notion  that  the  company  owns  the  information  and  can  use  that  information  as  it  chooses  unless  there  is 
 objection  from  the  consumer.  Opt-  in  is  premised  on  the  consumer  being  in  control  of  this  information  and  grants  to  each  of  us  the  ability  to  authorize  a  company  to  share  it  with  somebody 
 else  should  we  so  choose. 
 On  policy  grounds,  the  Commission  explained  why  Congresss  insistence  on  approval  had  been  correct,  by  determining  that  even  assuming  that  an  opt-  out  approach  can  be 
 appropriate  for  less  sensitive  customer  information,  such  an  approach  would  not  be  appropriate  for  the  disclosure  of  personal  CPNI.  2  The  Commission  concluded  that  an  express  approval 
 requirement  was  necessary  for  both  privacy  and  competitive  concerns.  It  reasoned  that  an  express  approval  requirement  provides  superior  protection  for  privacy  interests  because,  unlike 

 1  47  U.  S.  C.    222. 
 2  Implementation  of  the  Telecommunications  Act  of  1996;  Telecommunications  Carriers  Use  of  Customer 
 Proprietary  Network  Information  and  Other  Customer  Information;  Implementation  of  the  Non-  Accounting  Safeguards  of  Sections  271  and  272  of  the  Communications  Act  of  1934,  As  Amended,  Second  Report  and  Order  and 

 Further  Notice  of  Proposed  Rulemaking,  13  FCC  Rcd  8061,  8133  (1998)  (CPNI  Order). 
107
 Federal  Communications  Commission  FCC  02-  214 
 3 
 under  an  opt-  out  approach,  when  customers  must  affirmatively  act  before  their  CPNI  is  used  or  disclosed,  the  confidentiality  of  CPNI  is  preserved  until  the  customer  is  actually  informed  of  its 
 statutory  protections.  This  ensures  that  customers  privacy  rights  are  protected  against  unknowing  and  unintended  CPNI  disclosure.  3  In  addition,  the  Commission  recognized  that  the 
 limitations  were  designed  to  eliminate  restraints  on  competition,  by  limiting  the  ability  of  incumbent  carriers  to  leverage  their  control  over  monopoly-  derived  CPNI  into  emerging 
 telecommunications  markets.  4 
 On  appeal,  the  Tenth  Circuit  struck  down  the  express  approval  requirement  because  the  Commission  had  not  built  an  adequate  record  to  demonstrate  that  the  regulations  would 
 materially  and  directly  alleviate  privacy  harms  and  that  the  regulations  were  narrowly  tailored  so  as  to  avoid  a  First  Amendment  violation.  In  particular,  the  court  determined  that  the 
 Commission  had  failed  adequately  to  consider  the  less  restrictive  opt-  out  alternative.  Importantly,  the  court  did  not  hold  that  the  express  approval  requirement  could  not  be  justified  or 
 that  opt-  out  was  the  only  way  to  read  section  222.  It  held  only  that  the  Commission  had  failed  to  adequately  justify  its  decision.  So  I  think  we  are  being  overly  cautious  here. 

 The  Legal  and  Policy  Inadequacy  of  Todays  Order 
 In  response  to  the  Tenth  Circuits  decision,  the  Commission  today  requires  approval  only  for  disclosure  to  third  parties  and  non-  communications-  related  affiliates.  Contrary  to  law,  and 
 without  policy  justification,  the  Commission  allows  mere  notice  and  opt-  out,  an  absence  of  complaint  rather  than  the  statutorily  required  approval,  for  a  company  to  use,  disclose,  and 
 permit  access  to  sensitive  personal  information  within  a  company,  to  communications-  related  affiliates,  to  third  party  agents,  and  to  joint  venture  partners.  These  activities  represent  the 
 most  common  of  all  uses  of  CPNI. 
 The  majority  does  not  adequately  narrow  the  definition  of  communications  related,  affiliates,  third  party  agents,  or  joint  venture  partners.  Without  careful  definitions  the 
 restrictions  leave  dangerous  loopholes.  I  appreciate  the  majoritys  willingness  to  respond  to  some  of  my  concerns  by  stating  that  a  carrier  cannot  sell  such  information  to  a  pure  content 
 provider  such  as  the  operator  of  a  Web  site,  a  telemarketer,  or  a  junk  e-  mailer.  The  definitions,  however,  remain  unreasonably  imprecise.  According  to  my  understanding,  a  carrier  could  still 
 market  personal  consumer  information  to,  for  example,  an  ISP  who  also  happens  to  provide  content  over  its  Internet  system.  Thus  a  telephone  company  could,  without  the  permission  of  its 
 customers,  sell  CPNI  to  any  company  that  owns  an  ISP.  I  say  this  is  my  understanding  because,  even  as  late  as  this  morning,  the  definitions  and  explanations  are  in  flux.  Trying  to  administer  a 
 regime  whose  exact  parameters  we,  its  designers,  cannot  pin-  point  creates  problems.  Thats  not  good  for  privacy. 

 The  majority  seems  to  believe  that  they  can  go  no  further  than  opt-  out  for  fear  of 
 3  Id. 
 4  Id.  at  8145. 
108
 Federal  Communications  Commission  FCC  02-  214 
 4 
 litigation.  We  can  be  certain  there  will  be  challenges  to  this  order  no  matter  what  decision  is  made.  The  fear  of  litigation  should  not  unduly  constrain  us    we  will  be  in  court  on  this  matter. 
 I  prefer  to  go  there  with  our  best  foot  forward,  with  a  Commission  decision  that  is  more  securely  grounded  in  statute  and  one  that  accomplishes  the  will  of  Congress. 

 Let  us  be  clear:  the  court  did  not  require  opt-  out  nor  did  it  invalidate  opt-  in.  It  demanded  better  justification  for  what  the  previous  Commission  did.  I  do  not  wish  to  minimize 
 the  showing  we  would  have  to  make  to  the  court,  but  neither  do  I  want  it  to  become  an  obstacle  for  moving  proactively  ahead.  My  understanding  is  that  to  satisfy  court  review,  the  Commission 
 would  need  to  provide  more  empirical  explanation  and  justification  for  the  governments  asserted  interest;  to  demonstrate  that  opt-  in  materially  advances  that  interest;  and  that  opt-  in 
 is  narrowly  tailored  and  balanced  as  to  its  costs  and  benefits.  I  believe  the  Commission  can  effectively  and  convincingly  meet  these  tests.  There  is  an  abundance  of  contemporary  empirical 
 data,  including  consumer  surveys  demonstrating  consumer  preferences,  a  state  referendum  in  North  Dakota  with  easy-  to-  understand  results,  and  at  least  one  companys  unhappy  experiences 
 with  an  opt-  out  program.  There  is  new  case-  law  altogether  relevant  to  and  supportive  of  opt-in.  And,  as  explained  below,  opt-  in  is  both  narrowly  tailored  and  balanced. 

 We  must  always  be  at  pains  to  ensure  that  our  decisions  do  not  violate  the  First  Amendment.  Part  of  our  responsibility  in  this  instance  involves  adequately  explaining  how  our 
 rule  is  necessary  to  protect  privacy,  as  well  as  investigating  whether  less  restrictive  alternatives  exist.  Some,  including  the  dissenting  judge  in  U  S  WEST,  take  issue  with  whether  the 
 Commissions  previous  order  implicated  constitutionally  protected  speech;  whether  it  violated  the  First  Amendment;  and  whether  the  Commissions  statutory  construction  was  reasonable  and 
 thereby  entitled  to  deference.  But,  even  under  the  test  applied  by  the  Tenth  Circuit,  I  believe  that  express  approval  is  justified,  necessary,  and  most  clearly  comports  with  the  statute. 

 Section  222  limits  the  use  of  sensitive  individual  information  without  approval  of  the  customer.  I  agree  with  the  Commissions  previous  order  that  express  approval  is  guided  by  the 
 natural,  common  sense  understanding  of  the  term  approval,    which  we  believe  generally  connotes  an  informed  and  deliberate  response.  5  As  the  Commission  pointed  out,  it  is  difficult 
 to  construe  a  customers  failure  to  respond  to  a  notice  as  constituting  an  informed  approval  of  its  contents.  6 

 Since  the  Tenth  Circuits  decision,  other  courts  have  addressed  express  approval  provisions  and,  using  the  same  analysis,  found  them  not  to  infringe  upon  First  Amendment 
 rights.  In  Trans  Union  Corp.  v.  FTC,  the  DC  Circuit  held  that  [  a]  lthough  the  opt-  in  scheme  may  limit  more  Trans  Union  speech  than  would  the  opt-  out  scheme  the  company  prefers, 
 intermediate  scrutiny  does  not  obligate  courts  to  invalidate  a  remedial  scheme  because  some 

 5  Id.  at  8130;  see  also  U.  S.  WEST,  Inc.  v.  FCC,  182  F.  3d  1224,  1241  (10  th  Cir.  1999)  (Briscoe,  J.,  dissenting) 
 (  Although  Congress  did  not  specifically  define  the  term  approval  in  the  statute,  its  ordinary  and  natural  meaning  clearly  implies  knowledge  and  exercise  of  discretion  after  knowledge.  ) 

 6  CPNI  Order  at  8131. 
109
 Federal  Communications  Commission  FCC  02-  214 
 5 
 alternative  solution  is  marginally  less  intrusive  on  a  speakers  First  Amendment  interests.    7 
 We  are  left  with  the  issue  whether  opt-  in  is  narrowly  tailored  and  balanced.  To  decide  this  question,  we  must  examine  the  prongs  of  the  test  applied  by  the  Tenth  Circuit.  If  the  speech 
 concerns  lawful  activity,  we  must  determine  whether  there  is  a  substantial  state  interest  in  regulating  the  speech,  whether  the  regulation  materially  and  directly  advances  that  interest,  and 
 whether  the  regulation  is  no  more  extensive  than  necessary  to  alleviate  the  harm. 
 The  majority  agrees  that  the  first  two  prongs  are  met  for  both  opt-  out  and  opt-  in.  Thus,  the  relevant  question  at  issue  is  whether  opt-  in  is  narrowly  drawn  or  whether  some  lesser 
 alternative  such  as  opt-  out  would  serve  the  governments  interest.  We  have  seen  in  several  contexts  that  opt-  out  does  not  adequately  protect  consumers  privacy  interests.  As  todays 
 order  details,  significant  concerns  have  been  raised  about  the  effectiveness  of  opt-  out  requirements  in  the  banking  and  financial  sectors.  Similarly,  in  the  telecommunications  sector, 
 we  have  seen  one  example  after  another  of  instances  where  notice  and  opt-  out  have  been  ineffective  in  ensuring  that  customers  maintain  control  over  carrier  use  of  sensitive  CPNI,  and 
 that  those  that  wish  to  limit  the  use  and  dissemination  of  their  information  will  know  how,  and  be  able  to  do  so.  8  Attorneys  General  from  39  states  strongly  advocate  an  express  approval 
 requirement  because  opt-  out  has  proven  so  ineffective.  A  number  of  these  Attorneys  General  have  expressed  concern  about  opt-  out  notices  from  telecommunications  companies  that  are 
 unclear  and  confusing  and  may  therefore  have  been  ignored  or  misunderstood  by  consumers. 
 Even  were  I  to  approve  the  use  of  opt-  out,  I  would  dissent  from  the  Commissions  rules  here  because  these  rules  do  not  adequately  address  the  problem  at  hand.  Indeed,  to  develop  an 
 effective  opt-  out  mechanism  would  require  more  detailed  rules  to  ensure  that  consumers  have  a  user-  friendly,  understandable  and  effective  mechanism.  Because  companies  view  personal 
 data  as  so  valuable,  they  do  not  have  an  incentive  to  offer  opt-  out  mechanisms  that  make  it  easy  for  consumers  to  choose  to  protect  their  privacy.  Many  companies  simply  do  not  want  customers 
 to  take  advantage  of  opting-  out.  So  companies  may  reduce  the  likelihood  of  customers  opting-  out  by  providing  notices  that  are  lengthy,  vague,  obscured  by  other  information  or 
 confusing.  Consumers  may  not  understand  the  extent  of  the  use  of  the  information,  for  example,  if  the  company  buries  the  information  about  sharing  with  affiliates  and  joint  venture  partners  in 
 the  middle  of  a  long  disclosure  form. 
 Opt-  in,  on  the  other  hand,  provides  an  incentive  to  companies  to  ensure  that  customers  read,  understand,  and  respond  to  a  notice.  I  fear  that  todays  decision    adopting  opt-  out  and 
 failure  to  provide  adequate  rules  --  will  lead  inevitably  to  consumer  abuses  in  the  marketplace. 
 Todays  decision  puts  the  burden  on  the  competitive  marketplace  to  constrain  use  of  personal  information,  arguing  that  carriers  will  not  want  to  lose  their  customers  due  to  misuse  of 
 information.  But  it  is  this  same  competitive  marketplace  that  will  put  added  pressure  on  carriers 
 7  Trans  Union  Corp.  v.  FTC,  267  F.  3d  1138,  1143  (D.  C.  Cir.  2001) 
 8  CPNI  Order  at  8138. 
110
 Federal  Communications  Commission  FCC  02-  214 
 6 
 to  create  customer  profiles  to  enhance  their  marketing  efforts.  Weve  all  seen  in  recent  weeks  what  havoc  the  pressures  of  the  marketplace  can  cause.  Threats  to  privacy  will  become  even 
 greater  as  data  processing  technology  grows  increasingly  sophisticated  and  carriers  become  even  more  integrated  through  increasing  consolidation.  Moreover,  [  e]  ven  if  market  forces  provide 
 carriers  with  incentives  not  to  abuse  their  customers  privacy  rights  .  .  .  these  forces  would  not  protect  competitors  concerns  that  CPNI  could  be  used  successfully  to  leverage  former  monopoly 
 power  into  other  markets.  9 
 In  light  of  the  grave  privacy  and  competition  harms  that  this  order  could  cause,  I  respectfully  dissent  from  those  parts  of  this  decision  that  allow  carriers  to  use  sensitive  personal 
 information  without  first  obtaining  the  express  approval  of  the  customer. 

 9  Id.  at  8134. 
111
 Federal  Communications  Commission  FCC  02-  214 
 STATEMENT  OF  COMMISSIONER  KEVIN  J.  MARTIN 

 Re:  Implementation  of  the  Telecommunications  Act  of  1996;  CC  Docket  No.  96-  115 
 Telecommunications  Carriers  Use  of  Customer  Proprietary  Network  Information  and  Other  Customer  Information; 

 Implementation  of  Non-  Accounting  Safeguards  of  Sections  271  and  272  of  the  Communications  Act  of  1934,  as  Amended;  CC  Docket  No.  96-  149 

 2000  Biennial  Regulatory  Review  --  Review  of  Policies  and  Rules  Concerning  Unauthorized  Changes  of  Consumers  Long  Distance  Carriers;  CC  Docket  No.  00-  257 

 I  commend  the  Chairman  and  Bureau  staff  for  their  hard  work  and  effort  to  craft  rules  that  attempt  to  implement  the  customer  proprietary  network  information  (  CPNI)  provisions  of 
 the  Act  and  continue  to  protect  the  privacy  of  consumers  in  the  face  of  court  decisions  that  have  limited  our  previous  privacy  safeguards. 

 I  believe  that  the  Commission  must  remain  vigilant  with  respect  to  protecting  sensitive  personal  information  of  customers  of  telecommunications  carriers.  Indeed,  our  Congressional 
 directive  is  to  empower  consumers  with  the  ability  to  protect  the  confidentiality  of  their  sensitive  personal  information.  Previously,  the  Commission  sought  to  protect  customer  privacy  rights  by 
 requiring  carriers  to  obtain  express  customer  consent  (i.  e.,  an  opt-  in  requirement)  prior  to  obtaining  access  to  CPNI.  The  U.  S.  Court  of  Appeals  for  the  Tenth  Circuit,  however,  struck 
 down  the  Commissions  original  opt-  in  rules,  finding  that  the  rules  impermissibly  regulated  protected  commercial  speech  and  thus  violated  the  First  Amendment.  In  particular,  the  court 
 determined  that  the  opt-  in  rules  failed  constitutional  scrutiny  because  they  were  not  narrowly  tailored  as  a  result  of  the  Commissions  failure  to  adequately  consider  an  opt-  out  regime. 

 Todays  recommendation  seeks  to  find  the  appropriate  balance  between  the  continued  privacy  interests  of  consumers  and  the  First  Amendment  rights  of  carriers  to  communicate  with 
 their  customers.  While  I  generally  support  the  majoritys  dual  opt-  in/  opt-  out  approach  set  forth  in  the  decision,  I  remain  cognizant  of  the  imperfect  science  we  implement  today  to  effectuate  the 
 Courts  mandate. 
 While  I  believe  that  the  notification  requirements  outlined  in  todays  recommendation  to  protect  customers  privacy  interests  are  adequate,  we  may  need  to  do  more  to  empower 
 consumers  to  protect  their  personal  information  and  I  will  not  hesitate  to  revisit  this  decision  if  evidence  in  the  marketplace  indicates  that  these  rules  are  insufficient  to  protect  the  consumers 
 right  to  safeguard  their  personal  information. 
112