A bipartisan-adjacent group of federal lawmakers has thrown its weight behind an appeal challenging the Federal Communications Commission's expanded data breach notification rules. In practice, "support" came through amicus briefs from roughly 24 members of Congress and earlier letters from senior senators, not a formal act of chamber leadership, urging the Sixth Circuit to reconsider a ruling that upheld the FCC's authority. The stakes are concrete for telecom carriers and their customers. The rules require faster, broader notice after a breach, and the legal fight will decide whether those obligations survive a challenge rooted in the Congressional Review Act.
Table of Contents
- What the FCC rules actually require
- Who is challenging the rules, and why
- How the congressional support was expressed
- Where the case stands now
- What this means for carriers and customers
- Frequently Asked Questions
What the FCC rules actually require
The FCC is the federal agency that regulates U.S. phone, cable, and broadband providers. In December 2023, it adopted an order expanding telecom breach-notification rules, effective in 2024. The updated rules go well beyond the old standard.
They cover all customer personally identifiable information (PII), not just call-detail records, and they now reach inadvertent breaches, not only malicious ones. Timing is the biggest practical change. Carriers must notify affected customers within seven business days when a breach hits at least 500 customers or creates a risk of harm. Despite the "new rules" framing, this order dates to late 2023, so it is not brand-new as of 2026.
Who is challenging the rules, and why
The petitioners are industry trade groups: the Ohio Telecom Association, Texas Association of Business, CTIA, NCTA, and USTelecom. According to the EPIC case docket, they argue the FCC exceeded its authority and violated the congressional Review Act (CRA).
The CRA lets Congress nullify an agency rule and bars the agency from later issuing one that is "substantially the same." The challengers point to a 2016–2017 FCC privacy rule that Congress disapproved, arguing the 2024 order revives what lawmakers already killed. The FCC counters that its 2024 order rests on a different legal footing and is not a rerun of the disapproved rule. That distinction sits at the heart of the case.
How the congressional support was expressed
This is where the headline needs nuance. Around October 6, 2025, a coalition of 24 members of Congress — led by Sen. Eric Schmitt (R-MO) and Rep. Scott Fitzgerald (R-WI) — filed an amicus brief backing rehearing. They argue the CRA bars agencies from re-adopting the characteristic parts of a disapproved rule.
The signers are mostly Republicans, and the lead names are not top party leaders. Separately and earlier, Sen. Ted Cruz and Sen. Mitch McConnell led a letter opposing the FCC order, saying the agency defied "clear and specific direction" not to reissue similar requirements. Lawmakers were not alone. Twenty-one state attorneys general filed a separate amicus brief supporting the challengers' rehearing request in the same period, according to Broadband Breakfast.
Where the case stands now
The litigation has swung more than once. On August 13, 2025, a 2-1 Sixth Circuit panel upheld the rule, finding FCC authority under Section 201(b), which bars "unjust or unreasonable" practices, and holding the order was not substantially the same as the CRA-disapproved rule. Petitioners then sought en banc rehearing — review by the full appeals court rather than a three-judge panel — on September 29, 2025.
On or around July 31, 2026, the Sixth Circuit granted en banc rehearing and vacated the panel decision, restoring the appeal as pending. That vacatur matters. The earlier win for the FCC no longer stands as binding precedent, and the full court will now revisit both the Section 201(b) and CRA questions.
What this means for carriers and customers
For now, carriers should not assume the rules are going away. The order remains on the books, and the outcome of the en banc rehearing is unsettled.
Practical steps for compliance teams while the case is pending: For customers, the case decides how quickly you learn that your telecom data was exposed. If the rules survive, expect faster notice and coverage of more data types; if the challenge wins, notification timelines could loosen. Readers who want the underlying legal reasoning can review the Sixth Circuit panel opinion.
- Keep treating the seven-business-day notice window as active for breaches affecting 500 or more customers or posing a risk of harm.
- Extend breach-response plans to cover all customer PII and inadvertent exposures, not just malicious CPNI leaks.
- Track the Sixth Circuit's en banc schedule, since a ruling could narrow or uphold these obligations.
Frequently Asked Questions
Are the FCC data breach rules currently in effect?
Yes. The December 2023 order took effect in 2024 and remains on the books, even though the Sixth Circuit vacated the panel ruling and will rehear the case.
What is the Congressional Review Act argument?
The CRA lets Congress nullify a rule and blocks agencies from reissuing a "substantially the same" one. Challengers say the 2024 order revives a 2016–2017 rule Congress disapproved.
Did Congress formally vote to oppose the rules?
No. Support for the challenge came through amicus briefs from about 24 members and earlier letters from senior senators, not a formal chamber leadership action or vote.