What Is Carrier Data Retention? (Law & Limits)
Carrier data retention is the period a communications provider keeps particular records, such as billing or connection data. U.S. federal law sets some specific duties, including an 18-month rule for covered toll-call records, but it does not set one retention period for every carrier record. Preservation requests and disclosure demands are separate legal steps.
Retention questions often sound simple: How long does a carrier keep my records? The answer depends on the record type, the provider, the purpose for keeping it, and the laws that apply. A rule for toll-call records does not automatically apply to texts, internet activity, location data, or message content.
I’ll explain the main U.S. rules, how to distinguish routine retention from legal preservation and disclosure, and how to build a documented schedule. The examples below are illustrative, not legal advice. Providers should confirm current requirements with counsel and check for applicable state, federal, and foreign laws.
Planning: Identify Data, Jurisdiction, and Legal Basis
Start by identifying who holds each record, what the record contains, and where the relevant provider and customers are subject to law. “Carrier data” is not one legal category. A useful inventory separates subscriber details, billing records, traffic or connection logs, location information, and communications content.
The first step is to map records to systems and purposes. A mobile provider, internet service provider, and phone reseller may hold different records and face different duties. A provider’s contract or privacy notice may describe its business practices, but it does not replace applicable legal requirements.
What the main U.S. rules require
Under 47 C.F.R. § 42.6, covered carriers must retain records of toll telephone calls for 18 months. This is a defined rule for specified records, not a blanket instruction to keep all customer or internet data for 18 months. It does not, by itself, establish a universal period for call content, location records, or every kind of call detail.
Under 18 U.S.C. § 2703(f), when a governmental entity makes a qualifying preservation request, a covered provider must preserve specified records and evidence in its possession for 90 days. The government may request one additional 90-day period. This is a temporary preservation duty, not a routine retention schedule.
Other laws address access and privacy rather than setting a universal retention term. Section 2703(c)(2) of Title 18 allows government access to specified basic subscriber and transactional records through the legal process described in the statute. Section 222 of Title 47 restricts the use and disclosure of customer proprietary network information (CPNI), subject to the law and its rules. Neither provision creates one general retention duration.
Check jurisdiction, including outside the United States
A provider serving customers in more than one country may have to meet different rules for different data and activities. For example, GDPR Article 5(1)(e) says personal data should be kept no longer than necessary for the purpose for which it is processed, subject to applicable legal obligations. It does not set a universal carrier-data period.
Other laws may apply based on the service, the record, or the location of the provider or customer. Do not assume that a U.S. rule answers every question about an international service. Have counsel confirm which requirements apply before setting or changing a schedule.
Access and Limits: Separate Retention, Preservation, and Disclosure
Retention means keeping records under a routine business or legal schedule. Preservation means temporarily protecting specified records from deletion after a qualifying request or legal hold. Disclosure means providing records to another party. Each action has a different purpose and legal basis, so one should not be treated as automatic permission for another.
| Action | What it means | Example or limit |
|---|---|---|
| Routine retention | Keeping records for a stated operational or legal purpose | A covered toll-call record retained under 47 C.F.R. § 42.6 for 18 months |
| Preservation | Preventing specified records from being deleted for a limited period | A qualifying request under 18 U.S.C. § 2703(f): 90 days, renewable once for another 90 days |
| Disclosure | Producing records under applicable legal authority | A preservation request alone does not authorize disclosure |
A preservation request is not permission to disclose. It calls for preserving the specified records; disclosure requires its own lawful process. Likewise, the 90-day preservation period is not a default retention term for all provider records.
The type of record also matters. A request for basic subscriber information is not necessarily a request for communication content. Different categories can be subject to different legal procedures. Providers should route each demand for legal review rather than treating every request as interchangeable.
Execution: Apply Category-Specific Schedules and Holds
A workable schedule connects each record category to a purpose, a retention period, an owner, and a deletion method. The schedule should also show what changes when a valid preservation request or legal hold applies. This makes it easier to retain what is required without keeping unrelated records indefinitely.
Build the schedule in four steps
- Inventory the data. List the systems that hold subscriber, billing, traffic, location, and content records. Note who controls each system, including vendors.
- Assign a basis and period. Record the applicable legal rule, operational need, or other approved basis for each category. If no fixed period is specified by a law you have identified, document how the period was chosen and have counsel review it.
- Define the hold process. Identify who receives requests, checks their scope and authority, records the affected accounts and data, and pauses deletion only for the records covered.
- Set release and deletion steps. Track the end date for each hold. When it expires, confirm whether another legal or operational basis remains before returning data to the normal schedule or securely deleting it.
Do not combine distinct data types into a single “customer records” bucket. For example, a retention rule for a call record should not be applied automatically to a customer’s location history. Narrow categories help staff apply the right rule and avoid retaining more than needed.
Illustrative case studies
Routine toll-call schedule: A provider identifies records covered by 47 C.F.R. § 42.6 and configures a schedule that preserves those records for the required 18 months. It documents which system contains them and tests that the deletion process does not remove them early. This does not establish an 18-month schedule for every other data type.
Preservation request received: A provider receives a qualifying government request identifying specified records. Staff verify the request, preserve the records in scope, log the start and end dates, and calendar the possible additional 90-day period. They do not produce the data solely because it has been preserved; any disclosure is reviewed under its separate legal process.
These examples illustrate process, not a legal conclusion about a particular provider or request. The governing facts and law must be checked in each case.
Verification: Audit, Expire Holds, and Document Deletion
Verification checks whether the written schedule matches what systems actually do. A schedule is not effective if routine deletion removes records too soon, or if expired holds leave data frozen without a continuing basis. Keep records of decisions so staff can explain what was retained, why, and when it was released or deleted.
A practical audit can test a sample from each record category:
- Confirm the category, applicable rule, and approved retention period.
- Check that routine deletion follows the documented schedule.
- Verify that preservation requests are limited to specified records and have tracked deadlines.
- Confirm that disclosure approvals are separate from preservation actions.
- Review expired holds and document whether each was released, renewed, or replaced by another legal basis.
- Record deletion results, exceptions, and corrective actions.
Use access controls so only authorized staff can view or alter retained records. Log preservation and disclosure actions, including the decision-maker, the authority reviewed, the data covered, and relevant dates. These controls support accountability; they do not create a legal basis to keep data longer.
For deletion, follow the provider’s approved process and consider copies in backups, vendor systems, and other repositories. If data cannot be removed from a backup immediately, document the system limitation and prevent routine access or restoration from defeating the deletion schedule. Ask counsel or a qualified compliance lead to review unresolved exceptions.
Conclusion and FAQ
Carrier data retention is category-specific. The 18-month toll-call rule and the 90-day preservation process address different duties, while other laws govern access, privacy, or data-minimization principles without setting one universal period. The practical next step is to map each record type to its jurisdiction, legal basis, schedule, and hold process, then audit how the rules work in real systems.
How long do U.S. carriers keep customer data?
There is no single federal retention period for all carrier data. The answer depends on the record type, provider, purpose, and applicable law.
Do carriers have to keep all call records for 18 months?
No. Under 47 C.F.R. § 42.6, covered carriers must retain records of toll telephone calls for 18 months. That rule is not a blanket requirement for every call-related or customer record.
Does the 90-day rule mean carriers routinely store data for 90 days?
No. Section 2703(f) concerns preservation after a qualifying government request. It does not set a standard routine retention period.
Can a preservation request be renewed?
Yes. Under 18 U.S.C. § 2703(f), the initial preservation period is 90 days and may be extended once for an additional 90 days.
Does a preservation request let the government see the data?
Not by itself. Preservation protects specified records from deletion. Disclosure requires its own applicable legal authority and process.
Does Section 2703(c)(2) set how long records must be kept?
No. It addresses government access to specified basic subscriber and transactional records through prescribed legal process. It does not establish a general retention duration.
Does U.S. law require carriers to keep location data for a fixed period?
The rules described here do not set one universal retention period for location data. Other laws or circumstances may apply, so providers should seek legal review for the relevant service and jurisdiction.
Does GDPR require deletion after a fixed number of days?
No. GDPR Article 5(1)(e) requires personal data to be kept no longer than necessary for its stated purpose, subject to applicable legal obligations. It gives no universal carrier-data duration.
What should a provider do when a legal hold expires?
Review whether another legal, operational, or litigation basis still applies. If none does, release the hold and follow the documented retention and deletion schedule.
(This article was written by one of our staff writers, Garrett Vance. Visit our Meet the Team page.)
