Ohio Telecom Association v. FCC — 6th Cir. (Oct 21, 2026)

Telecommunications industry groups challenge federal rules governing what companies must do when customers' private information is exposed. This is a challenge to a regulation, not a damages suit over one particular hack. Earlier breach rules focused on customer proprietary network information, or C P N I: information about a customer's telephone service, such as call destinations and usage. The disputed order, adopted in December twenty twenty-three and published in twenty twenty-four, also covers personally identifiable information, or P I I, such as a name combined with a government identification number. It expands the definition of a breach to include inadvertent disclosures, with a good-faith employee exception, and changes notification requirements for customers and federal authorities. The history matters. In twenty sixteen, the F C C adopted a broader privacy order that included breach reporting. In twenty seventeen, Congress passed, and the President signed, a resolution disapproving that order. Under the Congressional Review Act, section eight-oh-one, subsection b, paragraph two, a disapproved rule cannot be reissued in substantially the same form. A new rule that is substantially the same is also barred, unless Congress later specifically authorizes it. The question is whether this newer order crosses that line. The industry associations, joined by a relay-service provider, asked the Sixth Circuit to set the new rules aside. A three-judge panel rejected the challenge in twenty twenty-five. In July twenty twenty-six, the court agreed to rehear the case en banc, before the full court, and vacated that panel decision. This is the October twenty-first rehearing. Roman Martinez will argue for the challengers that the new breach-reporting rules are substantially the same as the ones Congress rejected. Adam Sorensen will defend the F C C, arguing that changes to the covered information, breach definition and reporting obligations make the rules sufficiently different. There is also a dispute over statutory authority. Section two-oh-one, subsection b, addresses just and reasonable carrier practices; section two-twenty-two specifically addresses customer privacy. Section two-twenty-five concerns telecommunications relay services, which help people with hearing or speech disabilities communicate by telephone. The lawyers disagree about how these provisions authorize, or limit, the expanded protections.
Ohio Telecom Association v. FCC (No. 24-3133) — U.S. Court of Appeals for the Sixth Circuit, argued October 21, 2026.
Sources:
Argument audio — official Sixth Circuit recording, consolidated Nos. 24-3133, 24-3206 and 24-3252:
https://www.opn.ca6.uscourts.gov/internet/court_audio/audio/10-21-2026%20-%20Wednesday/24-3133%20Ohio%20Telecom%20Association%20v%20FCC%2024-3206%20Texas%20Association%20of%20Business%20v%20FCC%2024-3252%20CTIA%20The%20Wireless%20Association%20v%20FCC%20et%20al%20.mp3
Argument date and consolidated cases — official Sixth Circuit audio archive:
https://www.opn.ca6.uscourts.gov/internet/court_audio/aud1.php
En banc rehearing, vacatur and counsel — Sixth Circuit order, July 31, 2026:
https://www.opn.ca6.uscourts.gov/opinions.pdf/26a0211p-06.pdf
Challenged breach-reporting order and final rule text — FCC 23-111:
https://docs.fcc.gov/public/attachments/FCC-23-111A1.pdf
Current government position — supplemental respondents brief, September 30, 2026:
https://docs.fcc.gov/public/attachments/DOC-425593A1.pdf
Congressional disapproval of the 2016 privacy order — Public Law 115-22:
https://www.congress.gov/115/plaws/publ22/PLAW-115publ22.pdf
Congressional Review Act reissuance bar — 5 U.S.C. 801(b)(2):
https://www.law.cornell.edu/uscode/text/5/801
Carrier practices — 47 U.S.C. 201(b):
https://www.law.cornell.edu/uscode/text/47/201
Customer privacy and CPNI — 47 U.S.C. 222:
https://www.law.cornell.edu/uscode/text/47/222
Telecommunications relay services — 47 U.S.C. 225:
https://www.law.cornell.edu/uscode/text/47/225