FCC Data Breach Rules Still Under Review, Agency Says
Telecom industry groups still want to overturn a court decision upholding the rules, fearing the precedent would make it harder to ax rules with Congress’s help
WASHINGTON, July 6, 2026 – The Federal Communications Commission is still mulling whether or how to reverse expanded data breach rules the agency adopted during the Biden administration.
That internal review has been going on since September 2025, so long that a federal judge recently unpaused an industry-led legal challenge to the order that had been on hold for eight months.
“The Commission’s review of the challenged rule remains ongoing,” FCC attorney Adam Sorensen told the U.S. Court of Appeals for the Sixth Circuit last month. “However, the agency will be unable to finalize its review by June 17.”
That was the deadline the court gave before it would reopen the case, which had been paused because of the FCC’s review since October 2025.
The rules, adopted in December 2023, expanded the definition of a data breach that telecoms would have to report and expanded the kinds of customer information the companies would have to protect.
The Sixth Circuit already upheld the rules in August 2025. Several broadband industry groups, like CTIA, USTelecom, and NCTA, had challenged them as being too similar to FCC data breach rules that Congress nullified with the Congressional Review Act in 2017.
Industry groups asked the court to rehear the case with a full panel of sixteen judges rather than three. That’s the process that was paused when the FCC told the court it was reviewing the rules.
The FCC told another court it was reviewing rules around its E-Rate program before voting to overturn them, and FCC Chairman Brendan Carr, a commissioner at the time, dissented from the data breach rules when they were adopted.
While they acknowledge the agency is likely considering axing the data breach rules too, the trade groups wouldn’t be satisfied with that outcome.
The Sixth Circuit held that agencies could reinstate smaller parts of rule packages that Congress reversed with the CRA, and the trade groups want that precedent overturned. They said last year the current ruling would make a Congressional reversal a less effective means of quashing disfavored regulations.
“Since January 2025, Congress has successfully used the CRA 16 times to strike down agency orders issued during President Biden’s administration,” the industry groups wrote last year. “Yet under the panel majority’s approach, agencies could easily circumvent every one of those disapprovals.”
FCC: rehearing not necessary
In a July 2 filing, the FCC said industry concerns were overblown and that the court didn’t need to rehear the case.
“Petitioners’ policy concerns are exaggerated,” Sorensen and Justice Department attorneys wrote. “Congress remains free to disapprove under the CRA any subsequent rule issued by an agency. And even outside the CRA process, Congress is always free through legislation to strip a federal agency of authority to act in a given area.”
The government argued the court found the 2023 rules were different from the nixed 2017 rules, and thus agencies couldn’t easily make a small change and re-adopt nullified rules as companies feared.
Carr had shared the industry’s same concerns when the order was adopted. In a statement at the time he said the order “plainly violates the law” and that he worries agencies would try to insulate rules from the CRA “simply by packaging that one rule together with other rules in a single document.”
