Sixth Circuit Reviews FCC Rule on ISP Data‑Breach Notifications

The en banc Sixth Circuit Court of Appeals heard arguments on Wednesday in Cincinnati about the FCC’s 2024 rule that forces internet service providers to report breaches involving personally identifying information (PII). The case pits a coalition of telecom trade groups, including the Ohio Telecom Association and USTelecom‑Broadband Association, against the agency.

Trade groups challenge the rule under the Congressional Review Act

The plaintiffs argue the FCC’s rule is essentially the same as a 2016 proposal that Congress rejected, and therefore the Congressional Review Act (CRA) bars its implementation. Attorney Roman Martinez, representing the trade groups, said the “reissue bar” applies because the new rule is “absolutely the same” as the one Congress turned down.

FCC defends authority, cites substantial differences

FCC counsel Adam Sorensen countered that the 2024 rule contains six “substantial differences,” including new definitions of a data breach, notification triggers, and what counts as PII. He maintained that these changes keep the rule within the FCC’s statutory authority under the Communications Act.

Judges probe the limits of agency power

Senior Judge Jane Branstetter Stranch wrote that the FCC can impose reporting requirements because they relate directly to a carrier’s duty to protect consumer data. Other judges, such as Karen Nelson Moore and Chad Readler, asked whether the CRA creates a categorical bar or merely a procedural hurdle, and whether Congress would need to act before the agency could impose similar rules.

What this means for consumers and providers

If the Sixth Circuit ultimately upholds the FCC rule, internet providers will have to notify the agency of any breach that exposes customer PII. Consumers could see more timely disclosures about data breaches affecting their personal information. Providers, meanwhile, must adjust compliance programs to meet the new reporting standards, though the court has not set a decision timetable.

Anyone who receives a breach notice from their ISP should keep the notice, monitor their accounts for suspicious activity, and consider credit monitoring services. While the case is pending, providers are likely to continue reporting under the current rule to avoid potential penalties.

Consulting a lawyer may be helpful if you receive a breach notice and need assistance understanding your rights or navigating any follow‑up actions.

This article is general information based on Courthouse News Service and court or agency records available at publication time. It is not legal advice; laws and deadlines differ by state and by case. Published October 22, 2026.