Cybersecurity Policy Report, Strengthened Robocall Detection Rules Proposed by FCC, (May 21, 2026)

By Lynn Stanton

The FCC yesterday unanimously proposed boosting know-your-upstream-provider (KYUP) requirements with the aim of enhancing the STIR/SHAKEN caller ID authentication framework used to combat illegal robocalls.

The further notice of proposed rulemaking (FNPRM) adopted in WC docket 17-97 and CG docket 17-59 also proposed improving KYUP oversight, raising standards for STIR/SHAKEN attestations, and closing implementation loopholes.

“Today, voice service providers have a general obligation to know the providers that send them voice traffic, but some providers evade or ignore this obligation, permitting bad actors to use their network or services to transmit illegal calls that defraud consumers. The proposal seeks to raise the bar to ensure that all voice service providers in a call path are vetted. Under the proposal, providers would be required to collect information about upstream providers, verify that information, monitor their upstream providers’ traffic and practices, and refuse or discontinue service when the evidence shows an upstream provider is a bad actor,” the FCC said in a press release.

“The further notice would also seek to strengthen the STIR/SHAKEN ecosystem by proposing stricter policies for granting STIR/SHAKEN authorizations and increasing enforcement of those policies. The further notice would propose to address improper STIR/SHAKEN attestation practices by codifying standards, setting out requirements to satisfy the attestation-level criteria, and codifying prohibitions on improper attestations that are implicit in the STIR/SHAKEN standards,” Mason Shefa, an attorney adviser in the Wireline Competition Bureau’s Competition Policy Division, said in presenting the item at the FCC meeting.

“Additionally, the further notice would propose to close STIR/SHAKEN implementation loopholes by clarifying definitions that govern providers’ implementation obligations, repealing at least one of the two remaining undue hardship extensions [which apply to classes of providers and types of calls], and advancing steps to preserve authentication information throughout the call path. In addition to these proposed measures, the further notice would seek comment on how the proposals would serve to deter illegal calls that enter the United States from abroad and would propose other changes to streamline the Commission’s existing STIR/SHAKEN Caller ID authentication rules,” Mr. Shefa said.

He explained that the proposed baseline KYUP measures would include requiring providers to refuse or discontinue service “when a holistic evaluation shows an upstream provider is not a legitimate entity or is likely to be the source of illegal calls.”

In her separate statement, Commissioner Anna Gomez said, “With this action, we are sending a clear message that every carrier in the call chain bears responsibility for the traffic it touches. But as we strengthen these rules, we must also be clear about who they’re aimed at. After we voted on the Know Your Customer robocall NPRM last month, I noticed growing concern online about what these new vetting requirements would mean for the privacy of everyday consumers.

“People wanted to know whether buying a prepaid phone or activating a prepaid line would require, for the first time, government-issued ID. That concern is understandable and it deserves a clear answer,” Commissioner Gomez continued.

“As the Commission’s robocall enforcement efforts expand across authentication, numbering, and provider accountability, we have an obligation to be clear that these rules target the business relationships between carriers and do not erode consumer privacy. That is why I worked with the Chairman’s office to incorporate language in today’s item making that crucial clarification more explicit, and I will be watching closely as implementation proceeds on these robocall items to make sure that remains the case,” she added.

During a post-meeting press conference, Commissioner Gomez responded to a question about balancing consumer privacy with the possibility that devices with prepaid plans or other devices or services not registered to a named consumer could be used to forward robocalls.

“I think there has been a misinterpretation of the action that the Commission took on know-your-customer. When we’re looking at know-your-customer, we’re looking at these massive robocall entities, not individuals. So we wanted to make sure that we look at individual’s privacy as we go forward,” Ms. Gomez said.

Commissioner Olivia Trusty noted that the 2019 Pallone-Thune TRACED Act “required ‘the speedy implementation’ of STIR/SHAKEN caller ID authentication technologies to ‘protect consumers.’”

“The record to date makes clear that, despite substantial efforts by both industry and the Commission, continued vigilance is required to prevent scammers from exploiting weaknesses in our communications ecosystem. Adherence to the STIR/SHAKEN framework has at times been inconsistent, producing uneven results that undermine consumer trust in verified calls and give scammers the space to continue their unlawful operations. Strengthening implementation of these authentication measures is important in its own right. But it is especially important as the Commission considers how best to build upon this framework to combat illegal robocalls at every stage of the call path,” Commissioner Trusty added.

FCC Chairman Brendan Carr said this most recent effort by the FCC to combat illegal robocalls, by “seeking comment on ways to ensure providers are taking reasonable steps to know their customers and upstream providers … will help prevent many bad actors from accessing the network in the first place,” while the proposal “that carriers respond much more quickly to traceback requests … will prevent many bad actors from staying on the network once they get there in the first place.”

He noted that the FNPRM also sought comment “on requiring carriers to cooperate fully with law enforcement and industry efforts to stop illegal robocalls before they ever reach a consumer’s phone. Taken together, these steps would strengthen our robocall mitigation framework by driving greater transparency and more meaningful accountability from providers.”

News: FederalLegislation DataPrivacy