Updates
EPIC and CDT Urge FCC to Reconsider Invasive Know Your Customer Rulemaking Proposal
July 27, 2026
In comments filed Monday, EPIC and the Center for Democracy & Technology urged the FCC to reconsider a proposed rule to expand Know Your Customer (KYC) requirements for originating voice service providers.
The proposal would mandate that the government collect more personal data from and about individual customers in an effort tocombat illegal robocalls and scam traffic. While EPIC and CDT support this goal, the FCC’s strategy to achieve it is misguided.
The potential expansion of the agency’s KYC requirements would require the FCC to “obtain, at a minimum, the name, physical address, government-issued identification number, and an alternate telephone number of any new and renewing customer,” and retain that data for four years beyond the end of the customer-carrier relationship.
This kind of mandatory collection of identification documents from every phone subscriber would seriously harm anonymous access to phones, burden freedom of expression, and put every subscriber at risk. The FCC did not demonstrate that this data collection could achieve its goal of limiting robocalls as most robocalls originate oversees and this data collection would not affect foreign actors. EPIC and CDT urge the FCC to significantly narrow its proposal or rescind it altogether.
“The Commission should not impose such a sweeping identity documentation requirement on individuals seeking access to voice services, as it would impose severe privacy harms on all phone subscribers and cut off vulnerable populations that lack these documents from an essential service that has become a lifeline for most Americans,” EPIC and CDT’s comments read. “A significant loss of privacy and equitable access to communications, in exchange for a proposal with unclear and likely limited benefits, is not a tradeoff the Commission should impose on Americans.”
EPIC routinely files comments with federal agencies in response to requests for comment on proposed rules that would have privacy ramifications. EPIC has also long advocated for the inclusion of data minimization in privacy laws and regulations.
Support Our Work
EPIC's work is funded by the support of individuals like you, who allow us to continue to protect privacy, open government, and democratic values in the information age.
Donate
Facts Only
* EPIC and the Center for Democracy & Technology urged the FCC to reconsider a proposed Know Your Customer (KYC) rulemaking proposal.
* The proposal sought to expand KYC requirements for originating voice service providers.
* The rule would mandate the collection of the name, physical address, government-issued identification number, and an alternate telephone number of any new and renewing customer.
* The collected data would be retained for four years beyond the end of the customer-carrier relationship.
* Supporters aim to combat illegal robocalls and scam traffic.
* EPIC and CDT argued that mandatory collection of identification documents would harm anonymous access to phones and freedom of expression.
* Critics contended that the data collection would not affect foreign actors attempting to initiate robocalls.
Executive Summary
EPIC and the Center for Democracy & Technology urged the Federal Communications Commission (FCC) to reconsider a proposed rule that would expand Know Your Customer (KYC) requirements for voice service providers. The proposal sought to mandate that the government collect specific personal data, including names, physical addresses, government-issued identification numbers, and alternate telephone numbers from new and renewing customers, retaining this data for four years after the customer-carrier relationship ends. Supporters of the rule aim to combat illegal robocalls and scam traffic by requiring more detailed customer information.
However, EPIC and CDT argued that this expansion would cause severe privacy harms by harming anonymous access to phones, burdening freedom of expression, and exposing subscribers to risk. They contended that the data collection would not effectively limit robocalls since many originate overseas, and they expressed concern that the proposed trade-off between privacy and perceived benefits was unfair to Americans seeking essential services. EPIC has previously advocated for data minimization in privacy laws, and its work is supported by donors concerned with privacy and democratic values.
Full Take
The debate centers on the tension between security measures—specifically combating telecom fraud—and fundamental rights to privacy and anonymity in communications. The argument pivots on whether enhanced data collection, even for a public safety goal like blocking scams, can be implemented without imposing undue burdens on the general populace. The core structural conflict lies in defining the acceptable boundary for government surveillance over personal communications data.
The critique suggests that the proposed mechanism—mandating identity documentation from all subscribers—is disproportionate to the stated goal when considering the potential collateral damage to privacy and equitable access, particularly for vulnerable populations lacking formal identification. This echoes a larger pattern where measures intended to secure public interest goals (like stopping fraud) risk infringing upon civil liberties if data collection mechanisms are not strictly necessary or minimally intrusive. The failure of the proposal, according to critics, lies in the assumption that comprehensive identity tracking is an effective means of curtailing internationally sourced malicious activity without creating significant privacy externalities for all users.
What assumptions underlie the prioritization of broad data collection over privacy safeguards in this context? Who determines which populations are afforded the benefit of anonymity versus those subjected to heightened scrutiny? If the goal is legitimate security, what specific, verifiable methods exist that achieve that goal while maintaining the principle of minimal necessary intrusion?
Sentinel — Human
The text reads like a compilation of public advocacy commentary from specific interest groups regarding a regulatory proposal, exhibiting the typical structure and tone of stakeholder input.