CPNI (FCC U.S. Telecommunications)

Customer Proprietary Network Information (CPNI) is the data a telecommunications provider collects while delivering service — call detail records, line usage patterns, and customer-billing information. The FCC’s CPNI rules (47 CFR §64.2001–§64.2011) control how that data may be used for marketing, approved by customers, and certified annually. If you use Orbit’s US voice or SMS surfaces and your organization acts as a telecommunications carrier toward your downstream customers, these rules apply to you. Orbit gives you the register to record the consent decisions and certifications the rules call for. All endpoints below are rooted at https://api.orbit.devotel.io/api/v1/compliance/cpni.

Orbit records and attests compliance evidence — it does not by itself make your use of CPNI lawful, and this page is not legal advice. You remain responsible for delivering customer notices and for any filings you certify.

Orbit’s role: tenant-owned record-keeping

CPNI compliance is a control you own. Orbit maintains the auditable register — the §64.2007/§64.2008 marketing-use consent decisions and the §64.2009(e) annual certification wheel — but it does not mandate or enforce those steps. You decide when notices go out and whether you adopt opt-in (§64.2007(c)) or opt-out (§64.2007(b)(1)) approval; Orbit records whatever you decide and computes which customers currently permit marketing use. Two things Orbit deliberately never does:

Customer notices. The §64.2008 notice-and-approval notices are sent between you and your customer, out-of-band. Orbit attests that a notice was given — it never sends a notice for you.
Direct law-enforcement notification. On a CPNI breach, the §64.2011 USSS/FBI notification duty falls to you outside Orbit; the count of those notifications belongs on your annual certification.
Out-of-band filings. Filing with the FCC (EB Docket 06-36) is a step you take with the Commission; Orbit records the filing reference and timestamp.

That boundary keeps the register accurate: it attests what happened, and it never pretends to deliver what it cannot.

Reading the register — RBAC

RBAC: reads are open to any authenticated tenant member; writes require an owner or admin role (same pattern as other regulatory controls on the compliance surface, e.g. breach incidents). GET /compliance/cpni returns the combined posture — the consent summary plus the certification summary — in one call. Use it for a dashboard tile or a pre-audit snapshot.

curl https://api.orbit.devotel.io/api/v1/compliance/cpni \
  -H "Authorization: Bearer $ORBIT_API_KEY"

{
  "consent": {
    "summary": {
      "total": 3,
      "opted_in": 1,
      "opted_out": 1,
      "pending": 1,
      "not_asked": 0,
      "marketing_permitted": 1
    }
  },
  "certifications": {
    "summary": {
      "draft": 1,
      "certified": 0,
      "filed": 1,
      "overdue": 0
    }
  }
}

POST /compliance/cpni/consent (admin) records one customer’s current decision. Records upsert by customer_ref — a customer has one current decision at a time. Opt-in approval (express affirmative consent, §64.2007(c)):

curl -X POST https://api.orbit.devotel.io/api/v1/compliance/cpni/consent \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "customer_ref": "acct-1092",
    "status": "opted_in",
    "method": "opt_in",
    "purpose": "marketing_use",
    "channel": "web_form",
    "captured_at": "2026-08-01T14:20:00Z",
    "notes": "Customer approved marketing use of usage data at signup."
  }'

Opt-out notice (§64.2007(b)(1), with the 30-day §64.2008(d)(1) window): record status: "pending" with the instant the notice was sent. Once 30 days elapse without an objection, the summary counts the customer as permitting marketing use.

curl -X POST https://api.orbit.devotel.io/api/v1/compliance/cpni/consent \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "customer_ref": "acct-1093",
    "status": "pending",
    "method": "opt_out",
    "purpose": "marketing_use",
    "channel": "email",
    "notice_sent_at": "2026-08-01T09:00:00Z",
    "notes": "Opt-out CPNI notice emailed; 30-day window closes 2026-08-31."
  }'

Field	Type	Notes
`customer_ref`	string	Your own customer identifier (account number, contact id, or label). Required.
`status`	enum	`not_asked`, `opted_in`, `opted_out`, or `pending`. Required.
`method`	enum	`opt_in` (express approval) or `opt_out` (notice-based). Required.
`purpose`	string	What the decision covers, e.g. `marketing_use`.
`channel`	string	How the decision was captured (`web_form`, `email`, `paper`, `csr` …).
`notice_sent_at`	string (ISO-8601 UTC)	When the §64.2008 notice was given. Starts the 30-day window for a `pending` opt-out decision.
`captured_at`	string (ISO-8601 UTC)	Instant of the customer’s choice (defaults to now).
`notes`	string	Free text, up to 2000 characters.

Returns 201 Created with the stored record. A missing customer_ref or an unknown enum returns 422 VALIDATION_ERROR with per-field messages. GET /compliance/cpni/consent lists the register with the summary counts; GET /compliance/cpni/consent/{id} fetches a single record.

A customer can revoke oral approval at any time. Re-posting a new decision for the same customer_ref replaces the current one and returns 200 OK instead of 201.

Running the annual certification

§64.2009(e) requires carriers to certify annually — with an officer’s signature — that their operating procedures ensure CPNI rule compliance. The certification is due with the FCC by March 1 of the following year, and EB Docket 06-36 tracks the filing. The lifecycle has three states: draft → certified → filed. 1. Open the certification (admin):

curl -X POST https://api.orbit.devotel.io/api/v1/compliance/cpni/certifications \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "year": 2026,
    "officer_name": "Maya Chen",
    "officer_title": "Chief Compliance Officer",
    "statement": "Our operating procedures comply with the CPNI rules established by the FCC (47 CFR §64.2001–§64.2011).",
    "complaint_summary": {
      "total": 4,
      "improper_access": 1,
      "improper_disclosure": 0,
      "other": 3
    },
    "law_enforcement_notifications": 0,
    "actions_taken": "Two data-broker attempts investigated and terminated."
  }'

One certification per calendar year. Duplicate years return 409. Returns 201 with the record in draft. 2. Certify (admin) — moving to certified requires the signing officer, their title, the compliance statement, and compliant: true:

curl -X PATCH https://api.orbit.devotel.io/api/v1/compliance/cpni/certifications/{id} \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "certified",
    "officer_name": "Maya Chen",
    "officer_title": "Chief Compliance Officer",
    "compliant": true,
    "statement": "I certify that our operating procedures ensure CPNI compliance for calendar year 2026."
  }'

3. File (admin) — once you have filed with the FCC yourself, record the filing reference:

curl -X PATCH https://api.orbit.devotel.io/api/v1/compliance/cpni/certifications/{id} \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "filed",
    "filing_reference": "ECFS-2026-67877"
  }'

Moving straight to filed skips a required certified state and is rejected; an empty patch returns 422. GET /compliance/cpni/certifications lists the certifications with a draft / certified / filed / overdue summary. GET /compliance/cpni/certifications/{id} fetches one.

Exporting the attestation

GET /compliance/cpni/certifications/{id}/attestation produces a self-contained, signed attestation of the certification and its FCC filing timeline — the row you export to your compliance binder.

curl https://api.orbit.devotel.io/api/v1/compliance/cpni/certifications/{id}/attestation \
  -H "Authorization: Bearer $ORBIT_API_KEY"

{
  "certification_id": "ccp_…",
  "year": 2026,
  "status": "filed",
  "eb_docket": "EB Docket 06-36",
  "due_at": "2027-03-01T00:00:00.000Z",
  "officer_name": "Maya Chen",
  "officer_title": "Chief Compliance Officer",
  "compliant": true,
  "complaint_summary": {
    "total": 4,
    "improper_access": 1,
    "improper_disclosure": 0,
    "other": 3
  },
  "law_enforcement_notifications": 0,
  "certified_at": "2027-02-10T17:44:00.000Z",
  "filed_at": "2027-02-22T09:15:00.000Z",
  "filing_reference": "ECFS-2026-67877",
  "filed_within_window": true,
  "statement": "The CPNI §64.2009(e) certification for calendar year 2026 was filed with the FCC (EB Docket 06-36) on 2027-02-22T09:15:00.000Z, on or before the March-1 deadline of 2027-03-01T00:00:00.000Z."
}

The filed_within_window flag tells you whether the filing landed before the March-1 deadline; an unfiled certification past the deadline shows in the summary as overdue.

Where CPNI fits in the rest of the compliance surface

SOC 2 Controls — the complementary control framework pages on this compliance surface.
Consent Management — per-channel messaging consent for contacts (a different register from CPNI’s customer-marketing decisions).
Country Requirements — the carrier-registry and sender rules CPNI sits alongside for US traffic.
API Reference → Compliance — full request/response schemas (regenerated from the live API).

Getting Started

Channels

AI Agents

Flows

Numbers & Verify

Concepts

Features

Billing

Webhooks

Security & SSO

Compliance

Legal

Changelog

CPNI (FCC U.S. Telecommunications)

CPNI (FCC U.S. Telecommunications)

Orbit’s role: tenant-owned record-keeping

Reading the register — RBAC

Running the annual certification

Exporting the attestation

Where CPNI fits in the rest of the compliance surface

​CPNI (FCC U.S. Telecommunications)

​Orbit’s role: tenant-owned record-keeping

​Reading the register — RBAC

​Recording a consent decision

​Running the annual certification

​Exporting the attestation

​Where CPNI fits in the rest of the compliance surface

CPNI (FCC U.S. Telecommunications)

Orbit’s role: tenant-owned record-keeping

Reading the register — RBAC

Recording a consent decision

Running the annual certification

Exporting the attestation

Where CPNI fits in the rest of the compliance surface