## Facts

- Federal law imposed on telecommunications carriers a duty to protect the confidentiality of customer proprietary network information (CPNI) and generally barred its use or disclosure without customer approval, subject to limited exceptions.
- CPNI included sensitive information about customers’ telecommunications services, including service plans and features, pricing and contract terms, and details about calls.
- Carriers used CPNI for targeted marketing of communications-related services; some relied on unaffiliated joint venturers or independent contractors to conduct such marketing.
- After publicized abuses involving “pretexting” and data brokers obtaining customer information, the FCC revised its CPNI rules in 2007.
- The FCC’s 2007 order required carriers to obtain express opt-in consent before disclosing CPNI to unaffiliated joint venturers or independent contractors for marketing communications-related services, while maintaining less restrictive rules for certain intra-corporate uses and non-marketing uses.
- A cable industry trade association petitioned for review, arguing the opt-in rule violated the First Amendment and was arbitrary and capricious.

## Issues

1. What First Amendment standard applies to an FCC rule conditioning disclosure of CPNI for marketing purposes: strict scrutiny or intermediate scrutiny for commercial speech under *Central Hudson*?
2. Whether the opt-in consent requirement for disclosure of CPNI to unaffiliated joint venturers and independent contractors for marketing violates the First Amendment.
3. Whether the FCC’s choice of an opt-in default was arbitrary or capricious under the Administrative Procedure Act due to an inadequate evidentiary basis or an unreasonable means-end fit.

## Decision

- The court denied the petition for review and upheld the FCC’s opt-in rule.
- The court treated the regulated activity as commercial speech and applied *Central Hudson* intermediate scrutiny rather than strict scrutiny.
- The court held the government’s interest in protecting the privacy of sensitive CPNI was substantial, including in light of the statutory privacy mandate.
- The court concluded the opt-in requirement directly advanced the privacy interest by giving customers meaningful control over sharing and reducing risks associated with third-party access.
- The court found the rule reasonably tailored because it applied only to disclosures to unaffiliated entities for marketing and did not ban marketing or broader internal uses of CPNI.
- The court rejected claims that the affiliated/unaffiliated distinction was impermissible speaker discrimination, viewing it as a proxy for differing privacy risks and carrier control.

## Legal Principles

- Restrictions or conditions on the use of customer data to facilitate marketing may be evaluated as regulation of commercial speech and reviewed under *Central Hudson*.
- Protecting consumer privacy in sensitive communications records is a substantial governmental interest that can justify meaningful limits on commercial use and disclosure.
- Under *Central Hudson*, the government must show a substantial interest, direct advancement of that interest, and a reasonable fit; it need not adopt the least restrictive alternative.
- An agency may select an opt-in consent default for privacy protection when supported by record evidence of misuse and when the rule is limited to contexts presenting heightened disclosure risks.
- Under APA review, a rule is not arbitrary or capricious when the agency identifies the problem, considers alternatives, and reasonably explains why the chosen mechanism better addresses documented risks.

## Conclusion

The D.C. Circuit sustained the FCC’s opt-in consent requirement for carrier disclosure of CPNI to unaffiliated marketing partners, holding that it permissibly regulated commercial speech under *Central Hudson* and was reasonably justified and explained under the APA in light of serious privacy risks.


Nat'l Cable & Telecomms. Ass'n v. FCC, 555 F.3d 996 (D.C. Cir. 2009)