CPNI (customer proprietary network information)

CPNI is the information a US telecommunications carrier obtains by virtue of providing service to a customer, including the quantity, technical configuration, type, destination, location and amount of use of the service and the related billing, which federal law restricts the carrier from using or disclosing for purposes other than providing the service without the customer's approval.

The definition and the duty are in 47 U.S.C. § 222, which requires carriers to protect the confidentiality of CPNI and permits its use for marketing only within the service the customer already receives or with approval (Cornell LII, 47 U.S.C. § 222). The FCC's implementing rules are at 47 CFR Part 64, Subpart U, and set opt-in and opt-out approval mechanisms and breach-notification duties (eCFR, 47 CFR Part 64 Subpart U).

CPNI is why a carrier's media network is built differently from a retailer's. Call records, location and usage are CPNI; a carrier cannot sell segments derived from them to advertisers without approval, and the FCC has fined carriers for sharing location data. The carriers that run advertising businesses, listed in the commerce media networks directory, rely on consent flows, on data that is not CPNI (app and web behavior on owned properties), and on pseudonymised identity products such as Utiq in Europe, which is governed by GDPR rather than CPNI.

Example: a carrier wants to target cardholders of a bank with an offer based on the subscribers' travel patterns derived from cell-site location; that is CPNI and requires customer approval under § 222; targeting the same subscribers on the carrier's own streaming app using the app's viewing history is not.

Related: GLBA, commerce media network, consent string, data residency.

Source: 47 U.S.C. § 222; 47 CFR Part 64, Subpart U.

1. Cornell LII, 47 U.S.C. § 222
2. eCFR, 47 CFR Part 64 Subpart U