FCC data breach reporting rules face renewed scrutiny as court unpauses challenge

The unpausing of this challenge places immediate pressure on the FCC to provide regulatory clarity for streaming and broadband carriers regarding data governance. For the broader ecosystem, the outcome will define the boundaries of agency authority under the Congressional Review Act—specifically whether the FCC can reinstate portions of previously nullified privacy frameworks. If industry groups prevail, it could strip the agency of its ability to enforce expanded reporting for PII, potentially returning oversight to a fragmented state-by-state patchwork. Watch for whether Chairman Brendan Carr, an original dissenter of the 2023 rules, moves to voluntarily repeal the order before a full 16-judge panel ruling occurs.

The legal conflict centers on the interpretation of the Congressional Review Act (CRA), which prohibits agencies from reissuing rules that are 'substantially the same' as those struck down by Congress. Per Mayer Brown in September 2025, a three-judge panel of the Sixth Circuit initially upheld the 2023 rules, ruling that the CRA does not prevent the FCC from adopting portions of a larger nullified package if the new rule is narrower in scope. However, industry groups have petitioned for an en banc rehearing, arguing that this interpretation allows agencies to bypass Congressional disapproval by simply repackaging regulations.

The 2023 rules were a significant departure from previous standards, expanding the definition of a 'breach' to include both intentional and inadvertent disclosures. According to Akin Gump in August 2025, the order also removed a mandatory waiting period for customer notification, requiring carriers to inform users without unreasonable delay. While then-Commissioner Brendan Carr argued at the time that the rules 'plainly violate the law,' the current FCC leadership under the Biden administration has defended the expansion as necessary to address modern cybersecurity threats that go beyond traditional phone records.

This regulatory tug-of-war occurs as the FCC also navigates broader authority issues following its 2024 effort to reclassify broadband as a Title II telecommunications service. Per Reuters in early 2025, the Sixth Circuit had already signaled skepticism toward the FCC’s general authority over broadband providers. The outcome of the data breach challenge could further restrict the agency's ability to mandate uniform privacy and security practices across the ISP landscape, which acts as the underlying delivery infrastructure for the entire streaming video market.