47 U.S.C. § 227b — Call authentication

This section requires phone companies to verify caller identity using authentication technology, and sets rules for how the FCC manages that rollout. (a) Definitions. The "STIR/SHAKEN authentication framework" is the industry-developed technical standard for verifying that caller ID information is genuine. A "voice service" is any service connected to the regular phone network that carries voice calls using standard phone numbers; it includes fax-machine transmissions and any service enabling real-time two-way voice calls, including internet-based calling services, whether one-way or two-way. (b) Authentication frameworks. Paragraph (1): Within 18 months after December 30, 2019, the FCC must require voice service providers to use STIR/SHAKEN on their internet-based networks, and to take reasonable steps toward an effective authentication system on their non-internet-based networks. Paragraph (2): The FCC will skip that requirement for a provider if, within 12 months after December 30, 2019, it finds the provider has already adopted or begun adopting STIR/SHAKEN (or agreed to participate with others) on its internet networks and will finish within 18 months, and has taken reasonable steps toward — and will finish within 18 months — an authentication system on its non-internet networks. Paragraph (3): Within 12 months after December 30, 2019, the FCC must report to two congressional committees on how far providers have implemented these frameworks, including whether equipment availability affected progress, and how well the frameworks actually work. Paragraph (4): Starting 3 years after December 30, 2019, and every 3 years after that, the FCC must — after public notice and comment — assess how well the authentication technology is working, revise or replace it if that serves the public interest, and report its findings and any changes to Congress. Paragraph (5): The FCC can delay a provider's deadline. Within 12 months after December 30, 2019 (and later as needed), the FCC must study any burdens to compliance — including for providers using older network technology, small or rural providers, and providers unable to get the needed equipment — and may delay a provider's 18-month deadline if it publicly finds compliance would be an undue hardship. For any provider that mainly relies on non-internet-based networks, the FCC must grant a delay until an authentication method exists for those networks and is reasonably available. During any such delay, the FCC must require the provider to run a robocall mitigation program preventing unlawful robocalls from originating on its network; if a registered consortium flags a delayed provider as a repeat source of large-scale illegal robocalls, the FCC must make that provider fix the problem, while trying to keep the burden of any required fix reasonable. The FCC must also work to resolve compliance issues so all types of providers can reach full participation and the highest trust level as soon as reasonably possible, including limiting or ending a provider's delay if that provider isn't making reasonable progress. The FCC must consult small and rural providers to identify other ways to protect their customers from unauthenticated calls during any delay. At least once a year after the first delay is granted, the FCC must consider revising or extending delays, may revise them, and must publicly explain why any delay is still needed and when it expects full participation. Paragraph (6): The FCC must prohibit providers from charging consumers or small business customers any extra fee for this required call authentication technology. Paragraph (7): Within 12 months after December 30, 2019, the FCC must publish best practices providers can use, as part of implementing authentication, to help make sure the calling party is accurately identified. (c) Safe harbor and other regulations. Paragraph (1): Within 1 year after December 30, 2019, and consistent with the robocall-blocking rules in section 227(j), the FCC must issue rules that: say when a provider may block a call based on the authentication information, without an extra charge; create a safe harbor protecting a provider from liability for accidentally blocking a call or misjudging a call's trust level based on that information; create a way for a caller who was wrongly flagged to prove their calls are legitimate; and make sure calls from a provider that has a compliance delay aren't unfairly blocked just because they can't yet be authenticated. Paragraph (2): In setting up that safe harbor, the FCC must consider limiting a provider's liability based on how much the provider relied on the authentication information to block or flag calls, how it implemented related procedures, and whether it used reasonable care — including trying not to block emergency public-safety calls. (d) Rule of construction. Nothing in this section stops the FCC from starting a separate rulemaking under its other existing legal authority.