See the FCC's description of CPNI and the rules applicable to it.
Marketing rules. The FCC has categorized consumer CPNI into three "buckets": local, long distance, and wireless service. The CPNI that a carrier can use to market its services to its customers without their approval depends on what service buckets the customer already buys from. Carriers are permitted to use CPNI for marketing similar products within a service bucket (if a customer buys only one service) or buckets (if a customer buys out of more than one bucket). In addition, only those companies that sell CenturyLink services, including our agents and authorized sales representatives, will use this information.
For example, if you subscribe to our local service, we are allowed to use that local service information to sell you additional local service products and services. And if you have services from two buckets from us - such as local and long distance services - we are permitted to use information about either service to offer you additional products from either bucket. But, for example, if you have only local service from us, we are not permitted to use that CPNI to target you for interstate long distance service marketing.
Approval rules. We obtain customer approval to use CPNI across service buckets in two different ways. In some circumstances, we ask for customer consent. In other circumstances, we inform customers that CPNI will be used unless they instruct us not to. We can ask for long-term approval (that lasts until it is withdrawn) or we can ask for approval each time we interact with a customer (short-term approval).
Rules on non-marketing uses of CPNI. Service providers (or their agents) are allowed to use consumer CPNI for various non-marketing purposes without specific customer approval. These activities include installing, providing, billing for, and collecting for services. We may also use CPNI without specific approval to protect our rights or property or those of our customers or other carriers and to address fraud, abuse or unlawful subscriptions to or use of our services.
Access rules. Before speaking with a caller about account information, we take steps to authenticate the identity of the caller and confirm that he or she is authorized to have access to information on the account. Per FCC rules, we will not discuss call detail information with customers over the telephone unless the customer provides specific information about the calls in question, such as in the context of a billing inquiry. And we will not release CPNI in a retail store unless our customer presents a valid photo ID, such as a driver's license or a state identity card. Additionally, our customers cannot access online account information using only account information or generally known information. Rather, online account access is restricted through security code and password requirement.