> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-11.md). # Telecommunications compliance Telecom compliance — FCC rules, CPNI, TCPA, CALEA, ECPA, STIR/SHAKEN, NORS, state PUC, privacy laws. Telecom compliance combines **federal communications law + carrier-specific privacy law (CPNI) + lawful-intercept obligations + state PUC oversight + general consumer-protection regimes**. ## Regulatory frame | Regime | Applies when | Evaluation-evidence shape | | ------------------------------------------------ | ---------------------------------------- | ----------------------------------------------------------- | | **FCC Section 201(b) "just and reasonable"** | Common-carrier services | Rate / practice fairness; audit trail | | **CPNI rules (47 USC § 222, 47 CFR § 64.2001+)** | Customer Proprietary Network Information | Authentication; authorized disclosure; annual certification | | **TCPA (47 USC § 227)** | Calls / texts to consumers | Consent capture; DNC scrub; STIR/SHAKEN attestation | | **CALEA** | Wireline / wireless / broadband | Lawful-intercept capability; capacity reporting | | **ECPA (Title III, SCA, Pen Register)** | Disclosure to LE | Order-type classification; scope | | **STIR/SHAKEN** | Originating / terminating IP voice | Attestation level (A/B/C); robocall mitigation database | | **Network Outage Reporting System (NORS)** | Reportable outages | Threshold-trigger detection; 30-min PSAP notice for 911 | | **Public Safety / 911** | Carriers serving 911 calls | Reliability standards; outage notification | | **State PUC / PSC rules** | Per-state regulated services | Service quality; rate filings | | **Privacy laws (CCPA, GDPR, etc.)** | Per-jurisdiction | DSR, consent, retention | | **FTC UDAP authority** | Practices outside FCC scope | Negative-option, dark patterns | | **Cable Privacy Act** | Cable operators | Subscriber-info handling; opt-in for PII sharing | ## CPNI (47 USC § 222) Customer Proprietary Network Information is one of the strictest customer-data regimes in any US sector: * Authentication required for CPNI access (specific FCC rules) * Customer authorization required for many disclosures * Annual CPNI certification filing * Notification of CPNI breaches to law enforcement and (often) customers * Penalties: $200,000+ per day per violation under recent FCC enforcement **Stratix evaluation evidence:** * Hard authentication rule before any CPNI surfaces in customer-service traces * Audit log of every CPNI access * Tenant isolation; no cross-customer CPNI bleed ## TCPA For calls and texts to consumers: * Prior express consent for autodialed/prerecorded calls * Prior express written consent for marketing calls/texts to wireless * DNC list scrubbing * Per-violation damages; class actions common * AI-driven outbound contact governed identically **Stratix evaluation evidence:** * Consent-state rule on every outbound contact recommendation * DNC-scrub rule ## CALEA Communications Assistance for Law Enforcement Act: * Carriers must have lawful-intercept capability * Capacity reporting to FBI * Specific technical-assistance obligations **Stratix is not in CALEA scope** as a SaaS evaluation platform; carrier evidence systems remain the carrier's responsibility. Stratix can support compliance-team workflows around order intake and response (see scenario 5). ## ECPA / SCA / Pen Register / Title III * **Title III** — wiretap; warrant required * **SCA (Stored Communications Act)** — requires varying levels of process for content vs. record * **Pen Register / Trap & Trace** — court order on a lower standard for non-content * **Subpoena** — covers basic subscriber info under § 2703(c)(2) Misclassification triggers either contempt (under-production) or civil exposure (over-production). **Stratix evaluation evidence:** * Order-type classification rule with attorney gate * Scope-limitation rule * Audit log ## STIR/SHAKEN Caller-ID attestation framework: * A-level attestation: caller authenticated and authorized to use number * B-level: caller authenticated, number not verified * C-level: gateway-only signing * Robocall Mitigation Database participation * FCC enforcement of robocall rules **Stratix evaluation evidence:** * Per-call attestation level surfaced and logged ## NORS Network Outage Reporting System: * Reportable outages to FCC within tight timelines * 30-minute PSAP notification for 911-affecting outages * Detailed final reports * Public-safety notification carries criminal-exposure tail **Stratix evaluation evidence:** * Hard NORS-trigger detection rule on every NOC AI output * Audit log of detection / non-detection decisions ## State PUC / PSC rules Most states regulate aspects of telecom service quality, retail rates (where applicable), and consumer complaints. AI-driven tools must meet state service-quality and complaint-resolution rules. ## Cable Privacy Act 47 USC § 551. For cable operators: * Written notice of personally identifiable information practices at subscription * Opt-in for sharing PII for purposes other than rendering service * Limited retention ## Privacy laws CCPA / state privacy / GDPR — same framework as [retail compliance](/more-in-this-section-2/compliance-10.md). ## Recommended setup 1. Pro tier minimum; Enterprise for major carriers and ISPs 2. SSO + RBAC for CSR / NOC / compliance / lawful-intercept roles 3. Hard rules: CPNI authentication, TCPA consent, advisory-only on network changes, lawful-intercept attorney gate, NORS-trigger detection 4. Group-fairness scorers on customer-affecting AI 5. Audit retention matching the longest applicable FCC / state / privacy requirement (default 7 years; 10 for CPNI) 6. Annual CPNI certification documentation pulls from Stratix audit trail 7. STIR/SHAKEN attestation logged per outbound call 8. DPA executed; tenant data residency where contracted ## See also * [Telecom scenarios](/more-in-this-section-2/scenarios-11.md) * [Telecom eval patterns](/more-in-this-section-2/eval-patterns-11.md) * [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md) * [Enterprise](/4.2-industry-use-cases/telecommunications.md)