> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-11.md). # Telecommunications compliance Telecom compliance combines **federal communications law + carrier-specific privacy law (CPNI) + lawful-intercept obligations + state PUC oversight + general consumer-protection regimes**. ## Regulatory frame | Regime | Applies when | Evaluation-evidence shape | | ------------------------------------------------ | ---------------------------------------- | ----------------------------------------------------------- | | **FCC Section 201(b) "just and reasonable"** | Common-carrier services | Rate / practice fairness; audit trail | | **CPNI rules (47 USC § 222, 47 CFR § 64.2001+)** | Customer Proprietary Network Information | Authentication; authorized disclosure; annual certification | | **TCPA (47 USC § 227)** | Calls / texts to consumers | Consent capture; DNC scrub; STIR/SHAKEN attestation | | **CALEA** | Wireline / wireless / broadband | Lawful-intercept capability; capacity reporting | | **ECPA (Title III, SCA, Pen Register)** | Disclosure to LE | Order-type classification; scope | | **STIR/SHAKEN** | Originating / terminating IP voice | Attestation level (A/B/C); robocall mitigation database | | **Network Outage Reporting System (NORS)** | Reportable outages | Threshold-trigger detection; 30-min PSAP notice for 911 | | **Public Safety / 911** | Carriers serving 911 calls | Reliability standards; outage notification | | **State PUC / PSC rules** | Per-state regulated services | Service quality; rate filings | | **Privacy laws (CCPA, GDPR, etc.)** | Per-jurisdiction | DSR, consent, retention | | **FTC UDAP authority** | Practices outside FCC scope | Negative-option, dark patterns | | **Cable Privacy Act** | Cable operators | Subscriber-info handling; opt-in for PII sharing | ## CPNI (47 USC § 222) Customer Proprietary Network Information is one of the strictest customer-data regimes in any US sector: * Authentication required for CPNI access (specific FCC rules) * Customer authorization required for many disclosures * Annual CPNI certification filing * Notification of CPNI breaches to law enforcement and (often) customers * Penalties: $200,000+ per day per violation under recent FCC enforcement **Stratix evaluation evidence:** * Hard authentication rule before any CPNI surfaces in customer-service traces * Audit log of every CPNI access * Tenant isolation; no cross-customer CPNI bleed ## TCPA For calls and texts to consumers: * Prior express consent for autodialed/prerecorded calls * Prior express written consent for marketing calls/texts to wireless * DNC list scrubbing * Per-violation damages; class actions common * AI-driven outbound contact governed identically **Stratix evaluation evidence:** * Consent-state rule on every outbound contact recommendation * DNC-scrub rule ## CALEA Communications Assistance for Law Enforcement Act: * Carriers must have lawful-intercept capability * Capacity reporting to FBI * Specific technical-assistance obligations **Stratix is not in CALEA scope** as a SaaS evaluation platform; carrier evidence systems remain the carrier's responsibility. Stratix can support compliance-team workflows around order intake and response (see scenario 5). ## ECPA / SCA / Pen Register / Title III * **Title III** — wiretap; warrant required * **SCA (Stored Communications Act)** — requires varying levels of process for content vs. record * **Pen Register / Trap & Trace** — court order on a lower standard for non-content * **Subpoena** — covers basic subscriber info under § 2703(c)(2) Misclassification triggers either contempt (under-production) or civil exposure (over-production). **Stratix evaluation evidence:** * Order-type classification rule with attorney gate * Scope-limitation rule * Audit log ## STIR/SHAKEN Caller-ID attestation framework: * A-level attestation: caller authenticated and authorized to use number * B-level: caller authenticated, number not verified * C-level: gateway-only signing * Robocall Mitigation Database participation * FCC enforcement of robocall rules **Stratix evaluation evidence:** * Per-call attestation level surfaced and logged ## NORS Network Outage Reporting System: * Reportable outages to FCC within tight timelines * 30-minute PSAP notification for 911-affecting outages * Detailed final reports * Public-safety notification carries criminal-exposure tail **Stratix evaluation evidence:** * Hard NORS-trigger detection rule on every NOC AI output * Audit log of detection / non-detection decisions ## State PUC / PSC rules Most states regulate aspects of telecom service quality, retail rates (where applicable), and consumer complaints. AI-driven tools must meet state service-quality and complaint-resolution rules. ## Cable Privacy Act 47 USC § 551. For cable operators: * Written notice of personally identifiable information practices at subscription * Opt-in for sharing PII for purposes other than rendering service * Limited retention ## Privacy laws CCPA / state privacy / GDPR — same framework as [retail compliance](/more-in-this-section-2/compliance-10.md). ## Recommended setup 1. Pro tier minimum; Enterprise for major carriers and ISPs 2. SSO + RBAC for CSR / NOC / compliance / lawful-intercept roles 3. Hard rules: CPNI authentication, TCPA consent, advisory-only on network changes, lawful-intercept attorney gate, NORS-trigger detection 4. Group-fairness scorers on customer-affecting AI 5. Audit retention matching the longest applicable FCC / state / privacy requirement (default 7 years; 10 for CPNI) 6. Annual CPNI certification documentation pulls from Stratix audit trail 7. STIR/SHAKEN attestation logged per outbound call 8. DPA executed; tenant data residency where contracted ## See also * [Telecom scenarios](/more-in-this-section-2/scenarios-11.md) * [Telecom eval patterns](/more-in-this-section-2/eval-patterns-11.md) * [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md) * [Enterprise](/4.2-industry-use-cases/telecommunications.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.layerlens.ai/more-in-this-section-2/compliance-11.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.