Device‑Location Data Is CPNI Under § 222: Second Circuit Upholds FCC Forfeiture and Clarifies Seventh Amendment Path via § 504(a)

Introduction

This commentary analyzes the Second Circuit’s decision in Verizon Communications Inc. v. Federal Communications Commission, No. 24‑1733 (2d Cir. Sept. 10, 2025) (opinion by Judge Nathan, joined by Judges Lynch and Lee), which denied Verizon’s petition for review of a $46.9 million FCC forfeiture order. The decision squarely holds that device‑location data qualifies as “customer proprietary network information” (CPNI) under 47 U.S.C. § 222, affirms the FCC’s reasonableness findings under the Administrative Procedure Act, upholds the penalty structure and methodology under 47 U.S.C. § 503(b), and concludes that Verizon waived any Seventh Amendment jury‑trial right by paying the forfeiture rather than proceeding to a de novo collection action under 47 U.S.C. § 504(a).

The case arises from a widely reported misuse of carriers’ location-based services (LBS) by Securus Technologies and a Missouri sheriff (Cory Hutcheson), who obtained wireless customers’ location data without lawful process or consent by uploading irrelevant documents. Verizon terminated Securus and an intermediary the day after the New York Times report, announced its plan to shutter the program, but continued providing access to dozens of entities for months while relying on vendor-provided “consent” records and limited anomaly detection. The FCC concluded that Verizon violated § 222 and 47 C.F.R. § 64.2010 by failing to reasonably safeguard CPNI, and calculated 63 continuing violations—one for each ongoing counterparty relationship that persisted beyond a 30‑day “grace period” after the disclosures—plus a 50% upward adjustment.

On appeal, Verizon argued: (1) device‑location data is not CPNI; (2) the liability finding was arbitrary and capricious; (3) the penalty exceeded the § 503(b)(2)(B) cap; and (4) the forfeiture—imposed without a jury—violated the Seventh Amendment. The Second Circuit rejected each argument and denied the petition.

Summary of the Opinion

CPNI Coverage: Device‑location data qualifies as CPNI under § 222(h)(1)(A). It “relates to the … location … of a telecommunications service” because carriers must know device location continuously to deliver voice service; and it is obtained “solely by virtue of the carrier‑customer relationship,” which is not confined to common‑carrier services.
Reasonableness of Safeguards: The FCC reasonably found (both pre‑ and post‑disclosure) that Verizon’s LBS safeguards were inadequate, given its heavy reliance on vendor‑created “consent” records, inability to detect lack of consent, and insufficient remedial steps after the Securus/Hutcheson episode.
Penalty Cap and Unit of Violation: Applying Loper Bright’s independent‑judgment approach, the court held the Communications Act delegates discretion to the FCC to select a reasonable “unit of violation.” Treating each ongoing third‑party relationship as a separate, continuing violation was within statutory bounds and served deterrent and punitive goals; the roughly $47 million forfeiture did not exceed § 503(b)’s cap.
Upward Adjustment: Verizon forfeited any challenge to the 50% upward adjustment by not raising it in its opening briefs.
Seventh Amendment: Assuming arguendo the Seventh Amendment applies, Verizon waived any jury‑trial right by paying the forfeiture. Section 504(a) affords a de novo jury trial in a government collection action; “trial de novo” encompasses law and fact. The court disagreed with contrary Fifth Circuit dicta in Stevens and noted the Supreme Court’s intervening clarification in McLaughlin regarding Hobbs Act review in enforcement cases.
Appellate Jurisdiction: In a first published statement for the Second Circuit, the court confirmed it has jurisdiction to review § 503(b)(4) forfeiture orders when the carrier pays the forfeiture and petitions under § 402(a), adopting the D.C. Circuit’s reasoning in AT&T Corp. v. FCC (2003).

Analysis

Precedents Cited and Their Influence

Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024): The court applied Loper Bright to interpret § 503(b) without Chevron deference, but recognized Congress may delegate discretionary authority. Here, the Act delegates to the FCC the discretion to determine violations and penalty amounts within statutory bounds; the court’s role is to ensure reasoned decisionmaking within those boundaries.
Lockhart v. United States, 577 U.S. 347 (2016) (rule of the last antecedent) and Perez v. Westchester County Dep’t of Correction, 587 F.3d 143 (2d Cir. 2009) (anti‑surplusage): Guided the reading of § 222(h)(1)(A): the phrase “of use” modifies only “amount,” not each enumerated term. This avoided rendering “quantity” and “amount of use” duplicative and resolved CTIA’s amicus argument.
Russello v. United States, 464 U.S. 16 (1983) and Lindh v. Murphy, 521 U.S. 320 (1997): Negative‑implication canon supported treating Congress’s use of “call location information” in § 222(d)(4) and § 222(f) as intentionally narrower than the broader “location” added to § 222(h)(1)(A) in 1999.
Mizrahi v. Gonzales, 492 F.3d 156 (2d Cir. 2007): “Relating to” signals breadth; the court relied on this to conclude that device‑location data collected via the same network infrastructure for LBS still “relates to” the location of voice service.
Brand X, 545 U.S. 967 (2005); 47 U.S.C. §§ 153(51), 332; FTC v. AT&T Mobility, 883 F.3d 848 (9th Cir. 2018): In discussing the “carrier‑customer relationship,” the court emphasized that common‑carrier status is service‑specific, but the § 222(h)(1)(A) relationship is not confined to common‑carrier services, particularly where services are bundled.
FCC v. Prometheus Radio Project, 592 U.S. 414 (2021) and Environmental Defense v. EPA, 369 F.3d 193 (2d Cir. 2004): Set the APA review framework; the court found the FCC examined relevant factors and articulated a rational connection between facts and conclusions.
United States v. WIYN Radio, Inc., 614 F.2d 495 (5th Cir. 1980): Distinguished; WIYN addressed when a duty admits only a single dereliction for continuing‑violation purposes. Here, each ongoing third‑party relationship, post‑notice, involved separate failures.
AT&T Corp. v. FCC, 323 F.3d 1081 (D.C. Cir. 2003): Confirmed the dual‑track forfeiture regime; the Second Circuit adopted its view that payment preserves appellate review under § 402(a).
SEC v. Jarkesy, 603 U.S. 109 (2024): Established that legal claims seeking civil penalties require a jury trial. The court reconciled Jarkesy by pointing to § 504(a)’s trial‑de‑novo path in district court and held Verizon waived that path.
Capital Traction Co. v. Hof, 174 U.S. 1 (1899), and Westchester Day School v. Village of Mamaroneck, 504 F.3d 338 (2d Cir. 2007): Support the principle that a party can waive a jury‑trial right and that an initial nonjury proceeding may be followed by a jury trial de novo.
United States v. Stevens, 691 F.3d 620 (5th Cir. 2012): The Second Circuit disagreed with Stevens’ reading that district courts in § 504(a) actions lack authority to consider legal challenges, both textually and in light of McLaughlin Chiropractic Associates, Inc. v. McKesson Corp., 606 U.S. 146 (2025), which clarified that the Hobbs Act does not bar district courts in enforcement actions from independently assessing statutory interpretation.
Sprint Corp. v. FCC, No. 24‑1224, 2025 WL 2371009 (D.C. Cir. Aug. 15, 2025): Not binding, but noted as rejecting similar penalty challenges raised by other carriers.

Legal Reasoning

1) Device‑location data is CPNI under § 222(h)(1)(A)

Textual fit—“relates to the … location … of a telecommunications service”: The court emphasized that wireless carriers must continuously exchange location information with customer devices (network “pinging”) so that customers can receive and place calls. Therefore, device‑location data “relates to” the location of voice service even when a customer is not in an active call, and even when a carrier triggers a special location ping for LBS. The phrase “relating to” is intentionally broad.
Grammatical construction—“of use” reaches only “amount”: Applying the last‑antecedent rule, the court rejected an amicus argument that § 222(h)(1)(A) covers only information relating to the “location of use.” Reading “of use” to modify every enumerated noun creates anomalies and surplusage; the better reading is that “of use” modifies only “amount.”
1999 amendments and negative implication: Congress added “location” to the definition of CPNI and separately used the narrower phrase “call location information” in creating emergency disclosure exceptions and defining consent for that specific subset. If Congress had intended to limit the entire definition to call‑location information, it could have done so expressly.
“Solely by virtue of the carrier‑customer relationship” is not limited to common‑carrier services: The court rejected Verizon’s attempt to confine the relationship to Title II/common‑carrier services. Section 222(h)(1)(A) references the carrier‑customer relationship as such; it may encompass multiple services (e.g., bundled voice and data). For voice customers, the location data is plainly provided solely by virtue of the relationship because the network requires it to function. The court also rejected, to the extent Verizon raised it, the notion that data‑only customers’ device‑location information is categorically excluded, stressing the breadth of “relating to” and the unified network infrastructure.
Absurd‑results avoidance: The court noted it would be perverse to confer stronger privacy protections on device‑location data collected solely for internal network operations than on the same data collected for third‑party disclosure. Statutes should be read to avoid such illogical outcomes.

2) The FCC’s liability finding was not arbitrary or capricious

Pre‑disclosure deficiencies: The FCC reasonably concluded Verizon’s safeguards were inadequate: it relied “mainly” on an auditor (Aegis) who compared provider‑supplied location requests with provider‑supplied “consent” records; the system could not detect fabricated or non‑existent consent; and internal reports warned of this vulnerability.
Inability to detect lack of consent: The Securus/Hutcheson requests explicitly sought access without customer approval. A consent‑monitoring system that cannot flag the absence of consent presents a “significant loophole,” regardless of the number of confirmed victims.
Post‑disclosure response was insufficient: Although Verizon terminated Securus and an intermediary, stopped approving new entrants, and asked Aegis to add anomaly detection (e.g., rate spikes), the FCC found those measures did not address the core vulnerability—validating consent. It identified reasonable alternative steps (e.g., suspending the aggregator LocationSmart; verifying consent directly; or, if necessary, terminating the program).
No strict liability, no fair‑notice problem: The FCC offered a 30‑day grace period and did not require immediate program termination as the only reasonable response. The order applied the rule’s “reasonable measures” standard, not strict liability.

3) Forfeiture cap and the “unit of violation”

Statutory framework: Section 503(b)(2)(B) caps penalties at approximately $200,000 per violation per day, not to exceed approximately $2 million for any single “continuing violation,” as adjusted for inflation. The FCC must also consider factors such as gravity, culpability, prior offenses, ability to pay, and other justice concerns.
Delegated discretion post‑Loper Bright: While courts independently interpret statutes, Congress may delegate discretion. Here, the Act vests the FCC with authority to determine violations and penalty amounts within caps. Selecting a reasonable “unit of violation” is part of that discretion.
Reasonableness of “per relationship” unit: Verizon’s flawed policies were implemented through 63 distinct relationships (with aggregators or providers) that persisted post‑notice. Each presented an independent risk and required a separate approval and termination decision. Treating each relationship as a separate, continuing violation was within the agency’s delegated discretion and consistent with the statute’s deterrent and punitive aims.
Practical deterrence and ability to pay: Reading the cap to limit systemic failures to a single $2 million penalty would under‑deter large carriers. Congress directed the FCC to account for “ability to pay.” The court declined to opine on extreme counting theories (e.g., per‑subscriber) but upheld the “per relationship” approach.
Upward adjustment forfeited: Verizon did not challenge the 50% upward adjustment in its opening briefs; the court declined to reach the issue.

4) Seventh Amendment and the § 504(a) safety valve

Jarkesy distinguished by statutory design: Unlike the SEC’s in‑house penalties addressed in Jarkesy, the Communications Act channels unpaid forfeitures to a government collection action providing a “trial de novo” in district court. A party that wants a jury can refuse to pay and litigate de novo.
Waiver by payment: Verizon chose to pay and seek immediate appellate review, thereby waiving any jury‑trial right. The Seventh Amendment guarantees a jury in suits at common law seeking penalties, but parties may waive that right.
Scope of the de novo trial: The court read “trial de novo” to include both factual and legal issues. It disagreed with the Fifth Circuit’s Stevens decision and emphasized the Supreme Court’s clarification in McLaughlin that the Hobbs Act does not bar district courts in enforcement actions from independently assessing statutory interpretation. Parties can raise legal questions through jury instructions, and adverse legal rulings are reviewable de novo on appeal.
Collateral harms do not trigger the Seventh Amendment: Concerns about reputational or regulatory consequences during the limitations period do not implicate the jury‑trial right, which attaches to the collection of monetary penalties, not to the antecedent administrative process.

5) Appellate jurisdiction after payment

The court adopted the D.C. Circuit’s AT&T Corp. framework and, in a first published holding for the Second Circuit, confirmed that payment of a § 503(b)(4) forfeiture permits judicial review in the courts of appeals under § 402(a) and the Hobbs Act.

Impact

Regulatory scope of CPNI solidified for location data: The ruling cements device‑location data as CPNI in the Second Circuit and gives the FCC a strong textual and structural foundation nationwide. It rejects attempts to limit § 222’s “location” to “call location” and narrows room for carriers to argue that device‑location data is exempt.
Broader reach of the “carrier‑customer relationship” prong: By decoupling the relationship from common‑carrier status, the court’s reasoning makes it harder for carriers to exclude data gleaned in mixed service contexts (bundled voice and data) from CPNI protections.
Compliance expectations: Delegation of consent and vetting to aggregators, without robust, independent verification and the ability to detect the absence of consent, is legally risky. After notice of a systemic vulnerability, carriers must take decisive steps—suspension, independent verification, or program termination if necessary.
Penalty exposure and counting theory: Agencies may count “per relationship” as separate continuing violations, significantly increasing exposure. The court left open more aggressive counting (e.g., per customer), but validated a counting method that will matter in future privacy or data‑security forfeiture actions.
Litigation strategy post‑Jarkesy: The decision maps a constitutionally adequate path to a jury via § 504(a) and signals that paying to obtain expedited appellate review forfeits the jury‑trial issue. Companies must weigh the benefits of immediate appellate review against the preservation of a jury trial and the ability to build a full factual record de novo.
Post‑Chevron landscape: Loper Bright does not bar agencies from exercising congressionally delegated discretion; courts will verify that the agency stayed within statutory bounds and engaged in reasoned decisionmaking. Expect more explicit agency explanations of unit‑of‑violation choices and penalty rationales.
Emergency exceptions unchanged: The distinct statutory carveouts for “call location information” disclosures to emergency services remain, but they do not narrow the baseline scope of CPNI for device‑location data. Providers should maintain processes that distinguish emergency disclosures from commercial LBS use.

Complex Concepts Simplified

CPNI (Customer Proprietary Network Information): Statutorily defined data about a customer’s use of a telecommunications service—including “location”—obtained solely because the customer has a relationship with the carrier. Use or disclosure typically requires opt‑in approval and reasonable safeguards.
Telecommunications vs. Information Services: “Telecommunications service” is subject to common‑carrier duties; “information service” is not. But for § 222’s “carrier‑customer relationship,” the court held the relationship is not limited to common‑carrier services.
Commercial vs. Private Mobile Service: Commercial mobile services are regulated as common carriers; private mobile services are not. This classification does not confine the scope of the “carrier‑customer relationship” under § 222(h)(1)(A).
Notice of Apparent Liability (NAL) and Forfeiture Order: Under § 503(b)(4), the FCC can issue an NAL (a preliminary finding and proposed penalty), consider written responses, and issue a final forfeiture order. Paying the forfeiture enables immediate appellate review; not paying leads to a government collection suit with a trial de novo.
Continuing Violation and Unit of Violation: A violation that persists over time can draw daily penalties, subject to a per‑continuing‑violation cap. The “unit” (e.g., per relationship) is a reasonable choice left to agency discretion within statutory bounds.
Opt‑in Approval: The FCC’s rules generally require “affirmative, express consent” from the customer for use or disclosure of CPNI, after appropriate notice. Delegating consent capture to third parties does not absolve the carrier of its duties to ensure validity.
Trial de novo under § 504(a): If the government sues to collect an unpaid forfeiture, the defendant is entitled to a new proceeding on law and fact in district court—including the right to a jury on legal claims—“as if there had been no trial in the first instance.”
Hobbs Act vs. Enforcement Actions: While courts of appeals have exclusive jurisdiction to review certain final agency orders, McLaughlin clarifies that in an enforcement action, a district court may independently interpret the statute; § 504(a)’s “trial de novo” is a specific exception to the general review scheme.
Canons of Construction applied here:
- Last antecedent: A qualifying phrase usually modifies the nearest term only.
- Anti‑surplusage: Avoid readings that make statutory words redundant.
- Negative implication: Differences in language across subsections are presumed intentional.
- Absurdity avoidance: Prefer interpretations that avoid illogical results.
- Breadth of “relating to”: Signals expansive coverage.

Practical Compliance Takeaways

Treat device‑location data as CPNI. Implement opt‑in processes and retention controls accordingly.
Do not rely solely on aggregator/provider‑generated “consent” logs. Independently validate consent and build capabilities to detect the absence of consent.
Maintain a “kill switch” to suspend counterparties quickly upon credible notice of misuse; investigate and document the scope, methodology, and results.
Post‑incident, promptly implement measures tailored to the identified vulnerability, not just general anomaly detection. If reasonable safeguards cannot be assured, terminate the program.
Expect penalties to be counted per counterparty relationship. Contract, vetting, and oversight structures should be designed with this exposure in mind.
Preserve issues early. Challenges to penalty adjustments and constitutional arguments should be raised in opening appellate briefs or risk forfeiture.
Jury‑trial strategy: To preserve a jury trial, consider withholding payment and forcing a § 504(a) action; be prepared for de novo litigation on facts and law.

Conclusion

The Second Circuit’s decision is a significant post‑Loper Bright administrative‑law and telecom‑privacy precedent. It establishes that device‑location data falls within § 222’s CPNI definition, rejects attempts to cabin “location” to “call location,” and clarifies that the “carrier‑customer relationship” reaches beyond common‑carrier services. The court validates the FCC’s ability to count violations per counterparty relationship and reaffirms the punitive and deterrent character of § 503 forfeitures. On the constitutional front, it reconciles Jarkesy with the Communications Act by highlighting § 504(a)’s de novo jury‑trial pathway and holds that paying the forfeiture waives that right.

For carriers and data brokers, the message is clear: location‑based data sharing requires robust, independently verifiable consent and monitoring systems capable of detecting not just anomalies but the absence of consent. After notice of a systemic vulnerability, incrementalism is perilous. For litigants, strategic choices at the forfeiture stage carry heavy consequences for preserving jury‑trial rights and framing appellate review.

Ultimately, Verizon v. FCC confirms a broad, text‑driven understanding of CPNI protection for location data, endorses pragmatic agency discretion in penalty administration, and provides a roadmap for constitutional compliance in agency enforcement actions.