AI Customer Experience for Telecom: CPNI-Compliant Agents for Care & Retention

Carriers can deploy AI customer care without CPNI violations by enforcing authentication before disclosure — an AI agent reveals nothing covered by 47 U.S.C. § 222 until the caller has cleared the same password, PIN, or verified-identity gate a human agent would require — and by loading each account's consent and opt-out elections into the agent's context as hard policy, so personalization, retention offers, and billing detail are scoped to what that specific customer has actually authorized.

That one architectural commitment — authentication and consent as gates in the agent's control flow, not guidelines in its prompt — is what separates AI care programs that clear legal review from the ones that die in it. Care and digital leaders are squeezed from both sides: contact-center economics demand deflection, while FCC enforcement history prices mishandled customer data in eight and nine figures. This article lays out the compliance-aware architecture: what CPNI law permits an agent to disclose and when, how consent state and SIM-swap defenses shape agent design, the four care use cases that reach production, log redaction under CPNI and PCI DSS, and the eval and escalation design that keeps retention agents on the right side of both regulators and customers.

What CPNI Law Allows an AI Agent to Disclose — and to Whom, After What Authentication

Customer Proprietary Network Information is defined in 47 U.S.C. § 222: information that relates to the quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service, made available to the carrier solely by virtue of the carrier-customer relationship — plus billing information for those services. In practice that means call and text detail, data usage, plan and feature configuration, and location. Section 222 imposes a duty to protect it; the FCC's implementing rules (47 C.F.R. Part 64, Subpart U) specify how.

The rules that matter most for a conversational AI agent came out of the FCC's 2007 pretexting order, written precisely because fraudsters were talking call-center agents into disclosing records. They translate to AI directly:

• Call detail information requested by phone may only be disclosed after the customer provides a pre-established password — or via callback to the telephone number of record, or by mailing the records to the address of record. If the caller can't authenticate, the agent may still act on call detail the caller supplies ("I see a $40 charge on the 12th") without volunteering more.
• Passwords cannot be based on readily available biographical information — Social Security numbers, birthdates, mother's maiden name — or on account information itself. An AI agent that "verifies" a caller by asking for the last four of their SSN is non-compliant by design.
• Online access to CPNI requires password authentication; in-store disclosure requires a valid government-issued photo ID.
• Carriers must notify customers (via the address or number of record) whenever a password, address of record, or other account-security element changes — a rule the FCC significantly strengthened in its November 2023 SIM-swap order.

The design consequence: authentication is a state machine, not a vibe. The agent's orchestration layer should expose an explicit auth_level — unauthenticated, account-verified, call-detail-authorized — set by deterministic backend checks, never by the model's own judgment of whether the caller "sounds legitimate." Every tool that returns CPNI checks that state server-side. A model that can be sweet-talked into skipping verification is a pretexting vulnerability with infinite patience, which is why prompt-injection and tool-permission hardening from the agentic AI security playbook is table stakes here, not an enhancement.

Consent State, Opt-Outs, and SIM-Swap Defenses as First-Class Agent Context

Authentication governs disclosure; consent governs use. The FCC's framework distinguishes uses of CPNI within the existing service relationship (generally permitted), marketing of communications-related services by the carrier and its agents (permitted under opt-out approval), and sharing with unrelated third parties or for unrelated purposes (opt-in). A churn-model-driven agent that mines usage patterns to pitch new services to a customer who has opted out isn't a personalization win — it's an unauthorized use of CPNI.

So consent must be first-class context: a consent service resolves the account's current elections at session start and on every relevant tool call, and the agent runs under one of two policies — full personalization for consenting accounts, or a restricted mode that uses only what the customer volunteers in-conversation. Consent state changes mid-conversation ("actually, stop using my data for offers") must be writable by the agent and take effect immediately. Burying this in the system prompt fails audits; encoding it in the tool layer passes them.

The same context layer is where SIM-swap and social-engineering defense lives. The FCC's SIM-swap and port-out fraud rules, adopted November 2023 and phased in during 2024, require secure authentication before SIM changes and number ports, processes for responding to failed authentication attempts, and immediate customer notification of SIM-change requests. For an AI agent this means:

• SIM changes, port-outs, password resets, and address-of-record changes are never autonomous actions — they route to hardened, step-up-authentication flows with human review, the canonical human-in-the-loop checkpoint in telecom care.
• Repeated failed authentication attempts within a session or across sessions raise a fraud signal and reduce what the agent will do, rather than letting the caller retry indefinitely.
• The agent treats urgency cues, refusal to use the app, and requests to "just make an exception" as social-engineering markers worth flagging, not obstacles to satisfy.

A human agent can be socially engineered a few dozen times a day. An unhardened AI agent can be socially engineered ten thousand times an hour, by scripts, until one jailbreak works. CPNI compliance for AI is therefore an adversarial-robustness problem, not a policy-documentation problem.

Four Telecom Care Use Cases That Clear Legal Review

The use cases below dominate carrier AI roadmaps because they deliver deflection and revenue while mapping cleanly onto the authentication/consent architecture. They sit within the broader transformation agenda we cover in our pillar on AI consulting for telecom and media.

Billing dispute resolution. The highest-volume, highest-frustration contact type. A well-scoped agent authenticates, retrieves the disputed line items, explains proration and one-time charges in plain language, and applies credits within a bounded mandate (dollar caps, frequency caps, category restrictions), escalating anything beyond it. Because everything happens post-authentication inside the service relationship, this is the least consent-sensitive use case — and typically the first one legal approves.

Plan optimization offers. Usage-based right-sizing ("you're paying for a hotspot allowance you never touch") is a genuine retention lever, but it markets using CPNI, so it runs only under valid opt-out/opt-in status. Downgrade honesty matters too: an optimizer that only ever recommends upsells gets noticed — by customers and by state attorneys general.

Proactive outage communications. Notifying affected customers about outages and restoration estimates uses network topology plus service address — low CPNI sensitivity, high goodwill, and a natural bridge to the network side of the house covered in AI for telecom network operations. The compliance guardrail is channel consent (TCPA-compliant contact preferences) rather than Section 222.

Churn-save agents. Churn-prediction models flag at-risk accounts; a save agent engages during cancellation or proactively with tailored offers. This is the highest-value and highest-risk use case: it combines CPNI-driven targeting (consent-gated), pricing authority (bounded), and cancellation handling (regulated and reputationally radioactive). It ships last, with the tightest evals — more below.

Redaction and Retention: Handling CPNI and Payment Data in Conversation Logs

AI care generates a new data lake: transcripts, tool traces, and model telemetry, saturated with CPNI and — the moment an agent takes a payment — PCI DSS scope.

PCI DSS requires that sensitive authentication data (CVV, full track data) never persist after authorization and that stored PANs be masked and unreadable. Voice and chat agents need the payment-line-item equivalent of "pause-and-resume" call recording: card entry diverted to a tokenization flow (DTMF capture or a secure payment link) so the raw number never enters the transcript, plus pattern-based interception that catches customers who type or speak card numbers unprompted.

CPNI in logs is still CPNI. Section 222's protection duty follows the data into your observability stack, your analytics warehouse, your eval sets, and any vendor platform that touches transcripts. The FCC's updated breach rules (effective 2024) broadened the definition of reportable breach and require notification to the FCC and federal law enforcement within seven business days of determining a breach occurred — and you cannot report what you cannot inventory. The working pattern:

• Redact at ingestion. PII/CPNI entity detection runs before logs are written, replacing values with typed placeholders that preserve analytic and eval utility.
• Tier retention. Full fidelity briefly for dispute resolution and incident response; redacted transcripts for the longer analytics horizon; aggregates thereafter. T-Mobile's 2024 consent decree obligations — data minimization, deletion procedures, segmentation — are a preview of what the FCC expects everywhere.
• Fence model improvement. Raw customer conversations do not flow into fine-tuning or prompt libraries; only redacted, approved corpora do. Contracts with model vendors must prohibit training on your traffic.
• Instrument access. Every human and system read of conversation data is logged — the same AgentOps observability discipline that debugs agent behavior doubles as your CPNI access-audit trail.

What FCC Enforcement History Implies for AI Rollouts

The enforcement record removes any ambiguity about stakes. In 2015, AT&T paid $25 million — then the FCC's largest data-security enforcement — after call-center employees sold customer data. In April 2024, the FCC fined the major carriers nearly $200 million combined — roughly $57 million (AT&T), $47 million (Verizon), $80 million (T-Mobile), and $12 million (Sprint) — for selling access to customers' location data through aggregators without valid consent; appellate courts upheld the T-Mobile penalty in 2025. In September 2024, T-Mobile entered a $31.5 million consent decree over breaches from 2021-2023, split between a civil penalty and mandated security investment, with obligations including phishing-resistant MFA, segmentation, and board-level security governance.

Three implications for AI programs fall straight out of that record. Carriers own their vendors' conduct — the location-data fines turned on consent processes delegated to third parties, so an AI platform mishandling CPNI is the carrier's violation. Process theater fails — the FCC punished consent frameworks that existed on paper but didn't verify consent before disclosure, exactly the failure mode of a prompt that says "verify the customer" without a hard gate. Scale multiplies exposure — a misconfigured human process leaks by the incident; a misconfigured agent leaks by the million-session month, with every session logged and discoverable.

Eval and Escalation Design: Retention Agents That Help Instead of Trap

The last approval hurdle is usually not privacy but conduct: legal teams have watched the FTC and state regulators attack cancellation-obstruction and negative-option patterns, and they will not sign off on an agent that might hold customers hostage. The answer is measurable behavioral policy:

• Cancellation is a completable path. A clear cancellation request gets processed (or handed to a human who processes it) within a bounded number of turns. Save offers are capped — one, perhaps two — and an explicit refusal ends offers immediately.
• Escalation triggers are explicit: distress or vulnerability cues, repeated failed resolution, fraud signals, any request touching SIM/port/identity, and offer-authority limits all route to humans.
• Adversarial evals run pre-release and continuously: red-team suites of pretexting scripts against the authentication gate, consent-violation probes against restricted mode, "I want to cancel" personas measuring turns-to-completion, and regression packs on credit-limit adherence. The methodology mirrors what we describe in agent evals in production — with disclosure-without-authentication treated as a sev-1 defect, not a quality metric.
• Production monitoring scores samples of live (redacted) sessions for disclosure violations, offer-cap breaches, and escalation misses, feeding a weekly review loop with legal and care leadership.

Ship the retention agent last, gate it hardest, and measure "did the customer get what they asked for?" alongside save rate. A saved customer who felt trapped is a churned customer with a grudge and a regulator's email address.

Building all of this — consent services, authentication state machines, redaction pipelines, adversarial eval harnesses — is a specialized engineering effort that most carrier care organizations can't hire for quickly, and don't need permanently. That's the gap Gain America fills: we staff and deploy the engineers behind regulated-industry AI, embedding forward-deployed engineers with carrier care, IT, and compliance teams to build CPNI-compliant agent architectures the legal team will actually approve, then transfer ownership to internal staff. The carriers getting deflection and a clean audit trail aren't the ones with the flashiest bots — they're the ones that treated Section 222 as an architectural requirement from the first design review.