A Federal Communications Commission proposal that would require prepaid wireless providers and other voice service companies to collect and retain extensive personal information from their customers is drawing mounting opposition from privacy advocates, domestic violence organizations and some telecommunications providers.
The proposal, which is currently open for public comment, would expand “Know Your Customer” (KYC) obligations for providers by requiring them to obtain and retain, at a minimum, each customer’s name, physical address, government-issued identification number and an alternate telephone number before activating or renewing service. The FCC says the requirements are intended to make it more difficult for robocall operators and other fraudsters to gain access to U.S. telecommunications networks.
FCC Chairman Brendan Carr has argued that some voice providers have failed to adequately vet customers, allowing bad actors to exploit the nation’s phone system. According to the agency, stronger customer verification requirements would both deter scammers from obtaining service and make it easier for law enforcement and regulators to identify those who do.
But critics contend the proposal would effectively eliminate the anonymous purchase and use of prepaid “burner” phones, long relied on by individuals seeking to protect their privacy for legitimate reasons, according to Ars Technica,
Among the most vocal opponents are organizations representing victims of domestic violence. The National Network to End Domestic Violence (NNEDV) warned the FCC that many of the behaviors the agency appears to regard as suspicious are, for abuse survivors, essential safety practices.
In comments filed with the commission, the organization argued that survivors frequently rely on prepaid phones, substitute mailing addresses, post office boxes, mail-forwarding services and address-confidentiality programs to avoid being located by abusive partners. Requiring providers to verify and permanently record identifying information could expose vulnerable individuals to renewed harm, the group said, per Ars.
Read more: FCC Warns NFL Risks Antitrust Trouble as More Games Move to Streaming
Privacy advocates say the implications extend well beyond domestic violence survivors. Under the FCC’s proposal, pre-paid customers using virtual addresses, shared office locations, post office boxes or mail-forwarding services could be subject heightened scrutiny. The commission’s request for comments asks whether companies should verify customer information using public databases, financial institutions, consumer reporting agencies and commercial records, while retaining copies of government-issued identification and related records for up to four years after a customer relationship ends.
Civil liberties organizations argue that assembling and retaining such databases would create significant new privacy and cybersecurity risks.
The Center for Democracy & Technology told 404 Media the proposal would require virtually every wireless subscriber to surrender sensitive personal information before obtaining or renewing phone service, despite legitimate circumstances in which individuals need anonymous communications, including journalists, whistleblowers and victims of domestic abuse.
The Electronic Frontier Foundation similarly warned that centralized collections of personal information create substantial privacy risks. Its representatives questioned whether consumers should trust the government to accumulate additional identifying information that could become vulnerable to misuse or unauthorized access, per CNET.
Industry groups representing smaller Voice over Internet Protocol providers have also challenged the proposal.
The Consumer Access & Choice Coalition argued in a filing that the FCC should focus enforcement on providers that knowingly facilitate illegal robocalling rather than restricting lawful consumer anonymity. Sophisticated robocall operators, the coalition said, are unlikely to be deterred by identification requirements because they can migrate to offshore providers, use stolen or synthetic identities, compromise legitimate accounts or employ other methods to evade detection.
The proceeding has generated voluminous public comments opposing the proposal. Initial comments were due June 25, with reply comments scheduled for July 27. The FCC has not established a timetable for adopting final rules, leaving unresolved the broader policy question at the center of the debate: whether expanding identity verification requirements to combat robocalls justifies the corresponding reduction in anonymous communications and the privacy protections they provide.
