PII Detection for Telecommunications

Carriers Hold the Most Revealing Metadata in Existence

A telecommunications provider doesn't just know who its subscribers are — it knows who they call, when, from where, for how long, on which device, and over which cell. Call detail records, location data, browsing metadata and device identifiers together form a behavioral portrait more intimate than the content of most conversations. That is why U.S. law singles this data out as Customer Proprietary Network Information (CPNI) and why the FCC polices its handling with escalating enforcement.

The operational reality makes protection hard. CDRs stream out of switches by the billions. Network elements — routers, RADIUS servers, DHCP, firewalls, 5G core functions — emit logs stuffed with IP assignments, IMEIs, IMSIs and MAC addresses. Contact centers transcribe millions of calls in which subscribers recite account numbers, PINs and addresses. All of that data is copied into billing systems, analytics platforms, fraud engines, vendor tools and troubleshooting tickets, usually without anyone tracking which copies contain what.

The PII Detection API gives carriers a uniform detection layer over this sprawl. Any text — a CDR export, a syslog line, a chat transcript — is scanned by context-aware AI models that return each detected entity with its type, character offsets and confidence score, plus an optional masked rendering. One integration covers billing disputes, log pipelines, transcript archives and everything in between. The API overview describes the full platform.

What counts as CPNI? Under 47 U.S.C. § 222, CPNI includes information about the quantity, technical configuration, type, destination, location and amount of use of a telecommunications service — plus billing information about that service. Numbers dialed, call timestamps, service plans and location data all qualify. Subscriber name, address and phone number are treated separately as "subscriber list information", but leak just as often and matter just as much in a breach.

CPNI, FCC and Privacy Obligations

Telecom privacy is regulated sector-specifically — and the FCC has sharpened its teeth

Section 222 CPNI Rules

Carriers have a statutory duty to protect the confidentiality of CPNI and may use it without approval only to provide the service itself. Marketing across service categories requires customer approval; sharing with third parties is tightly restricted. Knowing precisely where CPNI appears in free text — transcripts, tickets, exports — is a precondition for honoring any of these limits, and detection provides that inventory automatically.

FCC Breach Notification

The FCC's updated breach rules (effective 2024) broadened "breach" to cover inadvertent access, use or disclosure of CPNI and other PII, and require carriers to notify the Commission, the FBI and the Secret Service within seven business days of determining a breach occurred, with customer notification obligations alongside. Determining what leaked is the first bottleneck — scanning the exposed dataset for entities answers it with numbers instead of guesses.

Authentication & SIM-Swap Fraud

FCC rules require secure customer authentication before disclosing call-detail information, and its SIM-swap/port-out rules push carriers to harden account changes. Contact-center transcripts are where authentication data — PINs, passwords, security answers — gets spoken aloud and persisted. Detecting PASSWORD and AUTH_TOKEN entities in transcripts, then masking them at rest, closes a favorite path for social-engineering attackers.

GDPR, CCPA & ePrivacy

General privacy law applies on top of sector rules: European operations face GDPR and the ePrivacy regime for traffic and location metadata, while U.S. state laws grant access and deletion rights over subscriber records. IP addresses and device identifiers are personal data under GDPR — which puts ordinary network logs squarely in scope. Our GDPR detection guide and CCPA/CPRA guide map the requirements.

Enforcement Is No Longer Theoretical

In 2024 the FCC proposed and levied fines totaling nearly $200 million against the major U.S. wireless carriers for sharing customer location data with third parties without adequate safeguards, and telecom breach settlements now routinely reach nine figures when subscriber databases are exfiltrated. The pattern in these cases is consistent: the sensitive data wasn't lost from the billing core, but from secondary systems — vendor integrations, cloud workspaces, logs and support tooling — where nobody had inventoried it.

Continuous detection is the countermeasure regulators implicitly demand: a mechanized answer to "where does CPNI live outside its system of record?" When each pipeline, transcript store and export path scans its own traffic, the carrier gains both prevention (masking before exposure) and the audit evidence that due diligence was systematic rather than aspirational.

Telecom Identifiers the API Detects

Subscriber identity, network and device entities — each returned with offsets and confidence

PHONE_NUMBER

MSISDNs, dialed numbers

IMEI

Device hardware identity

IP_ADDRESS

IPv4/IPv6 assignments

MAC_ADDRESS

CPE & Wi-Fi hardware

DEVICE_ID / SERIAL_NUMBER

ICCIDs, equipment serials

GPS_COORDINATES

Location fixes, cell geodata

PERSON_NAME

Subscribers, account holders

ADDRESS

Service & billing addresses

FINANCIAL_ACCOUNT_NUMBER

Billing & autopay details

PASSWORD / AUTH_TOKEN

Account PINs, port-out codes

SSN / NATIONAL_ID

Credit checks, activations

CREDIT_CARD_NUMBER

Payments read out on calls

Machine Data Needs More Than Patterns

Telecom text is dense with fifteen-digit numbers, and telling them apart is the whole game: an IMEI, an IMSI, an ICCID prefix and a card number can look nearly identical to a regex. The API's models use structure and context — Luhn check digits for IMEIs and payment cards, field labels in log lines, conversational cues in transcripts — to classify each number correctly and attach a confidence score you can act on.

Format variance is handled too: IPv6 in compressed notation, MAC addresses with dots or dashes, phone numbers spoken as "oh-four-one-five" in transcripts, and addresses embedded in trouble-ticket prose. Because every detection includes exact offsets, you can mask a single token inside a pipe-delimited CDR without corrupting the record layout — essential when downstream parsers expect fixed field positions.

Coverage spans 60+ languages, which matters for multinational carrier groups and outsourced support centers alike. The full taxonomy is on the entities page, and our NER vs regex comparison shows why context wins on machine data.

Where Subscriber Data Lives Across a Carrier

Data stores, the identifiers they carry, and the regulation that bites when they leak

Data Store	Identifiers Present	Governing Rules	Recommended `entities` Filter
Call detail records (CDRs)	Calling/called numbers, timestamps, durations, cell IDs, IMEI/IMSI	CPNI (§222), FCC breach rules, ePrivacy	`PHONE_NUMBER`, `IMEI`, `DEVICE_ID`, `GPS_COORDINATES`
Support call transcripts & chats	Names, addresses, account numbers, PINs, card numbers read aloud	CPNI authentication rules, PCI DSS, state privacy laws	`PERSON_NAME`, `ADDRESS`, `PASSWORD`, `CREDIT_CARD_NUMBER`, `PHONE_NUMBER`, `SSN`
Network element logs (RADIUS, DHCP, firewall, 5G core)	IP assignments, MACs, IMEIs, usernames, GPS fixes	GDPR (IPs are personal data), security policy	`IP_ADDRESS`, `MAC_ADDRESS`, `IMEI`, `PERSON_NAME`, `DEVICE_ID`
Billing & collections systems	Full identity, SSNs from credit checks, bank/card details, usage totals	CPNI billing provisions, GLBA-adjacent, PCI DSS	`SSN`, `FINANCIAL_ACCOUNT_NUMBER`, `CREDIT_CARD_NUMBER`, `ADDRESS`, `DATE_OF_BIRTH`
Fraud & SIM-swap case files	Port-out PINs, device IDs, victim identity, attacker phone numbers	FCC SIM-swap rules, evidence handling	`PASSWORD`, `PHONE_NUMBER`, `IMEI`, `PERSON_NAME`, `EMAIL_ADDRESS`
Analytics & vendor exports	Aggregated CDR extracts, location trails, churn datasets	§222 third-party limits, GDPR minimization	Default (all entities) with `mask_mode: "hash"` for joins

Location data is the new enforcement magnet. Cell-site trails and GPS fixes can reconstruct a subscriber's daily life, and the FCC's location-data fines against major carriers show regulators treat it as CPNI of the highest sensitivity. Scan analytics extracts for GPS_COORDINATES and address entities before any dataset leaves the controlled environment — aggregation alone is not anonymization.

Telecommunications Use Cases

How carriers, MVNOs and ISPs deploy PII detection across their operations

CDR Sharing for Analytics & Fraud

Churn models, network planning and interconnect-fraud detection all want CDR data — but §222 restricts who may see raw CPNI. Hash subscriber numbers and device IDs consistently so analysts can trace calling patterns without ever holding a real MSISDN.

Before Detection

CDR|2026-08-12 14:02:11|from 415-555-0132|to 212-555-0177|314s|IMEI 490154203237518

After Hashing

CDR|2026-08-12 14:02:11|from [p_7c31f2]|to [p_e904ab]|314s|IMEI [d_55a0c9]

Support Transcript Redaction

Voice analytics and agent QA need transcripts; compliance needs the PINs, card numbers and SSNs spoken during authentication gone. Scan each transcript on creation, mask sensitive spans, and keep the analytics value of the remaining text. See support ticket PII detection for the broader pattern.

Before Detection

"my account PIN is 4821, card on file 5417 8022 3391 0044, I want to port to..."

After Masking

"my account PIN is [PASSWORD], card on file [CREDIT_CARD_NUMBER], I want to port to..."

Network Log Pipeline Scrubbing

Syslog streams from RADIUS, DHCP and firewalls carry IP-to-subscriber mappings straight into observability platforms and third-party SaaS. Scrub identifiers in the log-forwarder so engineers keep full troubleshooting context minus the personal data. Our log scanning guide covers the architecture.

Before Detection

Aug 12 14:02:13 bras-04 radius: user [email protected] assigned 100.64.22.7 mac 3C:52:82:1A:9F:D0

After Masking

Aug 12 14:02:13 bras-04 radius: user [EMAIL] assigned [IP_ADDRESS] mac [MAC_ADDRESS]

Breach Assessment & FCC Reporting

When a dataset is exposed, the seven-business-day FCC clock starts at determination — and determination requires knowing whether CPNI or PII was in the data. Batch-scan the exposed corpus to produce entity counts per type, the factual core of Commission, law-enforcement and customer notices.

Before Detection

Exposed S3 bucket: 1.4M mixed text files, contents unknown, scope unquantified

After Detection

Scan report: 312k PHONE_NUMBER, 88k ADDRESS, 41k IMEI, 9k SSN — notification scope defined

Vendor & Offshore Support Enablement

BPO partners and offshore NOCs need enough data to work a ticket, not the subscriber's identity kit. Auto-mask tickets before they sync to external queues, so partners see the fault description while identity fields stay home — simplifying §222 third-party analysis and DPAs alike.

Before Detection

Ticket 88231: Maria Ruiz, 22 Foxglove Rd — no dial tone since Tue, acct 4471-9920, cb 415-555-0132

After Masking

Ticket 88231: [NAME], [ADDRESS] — no dial tone since Tue, acct [ACCOUNT], cb [PHONE]

<200ms

Typical latency per scan

50k

Characters per request — batch CDRs

150+

Entity types incl. IMEI, MAC, GPS

7 days

FCC breach-report window you must meet

Network Logs: Personal Data Hiding in Machine Data

Engineers think of syslog as machine exhaust, but regulators read it differently: a DHCP lease line binds a subscriber's identity to an IP address; a RADIUS accounting record binds it to a device and a timestamp; a firewall log binds the same IP to every site visited. Under GDPR, each of those lines is personal data, and under §222 many of them are CPNI. Yet logs are precisely the data that gets shipped wholesale to cloud observability vendors, retained for years, and granted to every engineer with a dashboard login.

The scalable answer is scrubbing at the forwarding layer. Insert a detection call in your log shipper or streaming pipeline (the pattern generalizes across Kafka, Fluentd and vector-style agents — see PII detection in ETL and streaming pipelines): each batch of lines is scanned in a single 50,000-character request, identifier spans are replaced or hashed, and the cleaned stream continues to the SIEM. Hashing preserves the property engineers actually need — the ability to correlate one subscriber's sessions across systems — while removing the identity itself.

Keep an unscrubbed short-retention tier under strict access control for lawful-intercept and abuse cases, and let the long-retention, widely-accessible tier be the masked one. That split satisfies both the NOC and the DPO, and it turns a subpoena-sized log lake from a breach liability into an engineering asset.

Offsets make surgical masking possible. Because the API returns start/end character positions for every entity, you can replace only the identifier tokens inside a structured log line or pipe-delimited CDR — field counts, delimiters and parsers remain untouched downstream.

Integration Examples for Carrier Systems

One JSON endpoint for CDR pipelines, transcript processors and log forwarders

Scan a CDR Batch with cURL

Concatenate CDR lines into one request (up to 50,000 characters) and scan them with a telecom entity list. The response pinpoints every subscriber number, IMEI and coordinate with offsets, and mask_mode: "hash" yields a consistent pseudonym per identifier so analytical joins survive. Full parameters are in the API documentation.

Test your own record formats interactively in the live demo before wiring up the pipeline.

cURL — CDR Scan

# Detect CPNI identifiers in call detail records
curl -X POST https://piidetectionapi.com/api/moderate.php \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_API_KEY",
    "api_type": "pii_detection",
    "text": "CDR|2026-08-12T14:02:11|A=415-555-0132|B=212-555-0177|dur=314|cell=SF-0442|imei=490154203237518\nCDR|2026-08-12T14:06:40|A=415-555-0132|B=+44 20 7946 0958|dur=95|cell=SF-0391|imei=490154203237518",
    "entities": ["PHONE_NUMBER","IMEI","DEVICE_ID","GPS_COORDINATES","PERSON_NAME"],
    "mask_mode": "hash",
    "threshold": 0.6
  }'

Scrub Network Logs in Python

This worker sits in a log pipeline: it batches syslog lines, scans them in one call, and forwards the masked stream to the SIEM. Entity counts per batch feed a metrics gauge, so the privacy team can watch identifier volume by network element and catch a chatty new log source the day it appears.

The joined-batch pattern keeps API call volume proportional to data volume, not line count — important when a BRAS emits thousands of lines a second.

Python — Log Forwarder

import requests

SEP = "\n"

def scrub_batch(lines):
    # join up to ~50k chars of syslog lines into one request
    resp = requests.post(
        "https://piidetectionapi.com/api/moderate.php",
        json={
            "api_key": "YOUR_API_KEY",
            "api_type": "pii_detection",
            "text": SEP.join(lines),
            "entities": ["IP_ADDRESS", "MAC_ADDRESS", "IMEI",
                         "EMAIL_ADDRESS", "PERSON_NAME", "PHONE_NUMBER",
                         "DEVICE_ID", "GPS_COORDINATES"],
            "mask_mode": "hash",   # stable pseudonyms keep correlation
            "threshold": 0.6,
        },
        timeout=30,
    )
    data = resp.json()

    counts = {}
    for e in data["detected_entities"]:
        counts[e["type"]] = counts.get(e["type"], 0) + 1
    metrics.gauge("pii_per_batch", counts)          # privacy observability

    return data["anonymized_text"].split(SEP)      # masked lines to SIEM

for batch in tail_syslog(batch_chars=45000):
    siem.forward(scrub_batch(batch))

Transcript Pipeline in Node.js

Speech-to-text output from the contact center flows through this handler before storage. Authentication secrets are the priority: any PASSWORD or card detection is masked unconditionally and raises an agent-coaching event, while ordinary identifiers are masked for the QA copy but preserved in the restricted system of record.

The same two-tier pattern applies to chat, SMS support and social-media DMs. For throughput planning across millions of monthly contacts, see pricing.

Node.js — Transcript Processor

// Mask authentication data + PII in call transcripts before storage
const SECRET_TYPES = ["PASSWORD", "AUTH_TOKEN", "CREDIT_CARD_NUMBER", "CVV_NUMBER"];

async function processTranscript(callId, transcript) {
  const r = await fetch("https://piidetectionapi.com/api/moderate.php", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      api_key: process.env.PII_API_KEY,
      api_type: "pii_detection",
      text: transcript,
      entities: ["PERSON_NAME", "PHONE_NUMBER", "ADDRESS", "SSN",
                 "PASSWORD", "AUTH_TOKEN", "CREDIT_CARD_NUMBER", "CVV_NUMBER"],
      mask_mode: "replace",
    }),
  });
  const data = await r.json();

  const secrets = data.detected_entities.filter(e => SECRET_TYPES.includes(e.type));
  if (secrets.length) {
    await coaching.flag(callId, secrets.map(e => e.type));  // agent read secrets aloud
  }

  await qaStore.save(callId, data.anonymized_text);          // masked copy for QA/analytics
  return data.entities_detected;
}

Telecommunications PII Detection FAQ

Common questions from carriers, MVNOs, ISPs and their compliance teams

Can the API distinguish an IMEI from other 15-digit numbers?

Yes. IMEIs carry a Luhn check digit and appear in characteristic contexts — device fields, equipment registers, "imei=" labels — and the models combine both signals. An IMSI or a random reference number in the same line is classified differently or ignored, and every detection includes a confidence score so your pipeline can set its own bar before masking.

Are dynamic IP addresses really personal data we need to scrub?

For a carrier, yes in practice: you hold the assignment records that link the IP to a subscriber, which is exactly the situation where European case law treats IPs as personal data, and U.S. state laws define personal information broadly enough to include them when linkable. Hashing IPs in widely-accessible log tiers preserves troubleshooting correlation while removing casual linkability.

How does detection help with the FCC's seven-business-day breach report?

The report requires you to characterize what was breached. Batch-scanning the exposed dataset yields entity counts by type — so the filing states "the file set contained approximately 312,000 telephone numbers and 9,000 SSNs" instead of "customer data may have been included". The same scan output scopes customer notification lists and gives your outside counsel a defensible factual record.

Can we scan streaming CDR volumes without adding billing-path latency?

Scan outside the billing path. Mediation typically forks CDR streams anyway — send the analytics/vendor fork through detection while the rating engine consumes the raw feed inside its controlled zone. Batching records into 50,000-character requests keeps API calls proportional to volume, and stateless calls scale horizontally with your stream processors.

Does masking break our transcript analytics and agent QA scoring?

No — sentiment, topic, silence and compliance-phrase analytics operate on the conversational text, which masking preserves. Placeholders like [PHONE_NUMBER] even improve some models by normalizing tokens. Where a workflow genuinely needs the identifier (a callback number), pull it from the CRM system of record rather than the transcript.

Can detection run on-premise for lawful-intercept-adjacent data?

Yes. For data that must not leave carrier premises — intercept-adjacent records, national-security-sensitive logs, or simply policy-restricted CPNI — the platform deploys on-premise, keeping every scan inside your network while exposing the same API contract. Reach out via the contact page to discuss deployment options.

Carriers Hold the Most Revealing Metadata in Existence

CPNI, FCC and Privacy Obligations

Section 222 CPNI Rules

FCC Breach Notification

Authentication & SIM-Swap Fraud

GDPR, CCPA & ePrivacy

Enforcement Is No Longer Theoretical

Telecom Identifiers the API Detects

PHONE_NUMBER

IMEI

IP_ADDRESS

MAC_ADDRESS

DEVICE_ID / SERIAL_NUMBER

GPS_COORDINATES

PERSON_NAME

ADDRESS

FINANCIAL_ACCOUNT_NUMBER

PASSWORD / AUTH_TOKEN

SSN / NATIONAL_ID

CREDIT_CARD_NUMBER

Machine Data Needs More Than Patterns

Where Subscriber Data Lives Across a Carrier

Telecommunications Use Cases

CDR Sharing for Analytics & Fraud

Support Transcript Redaction

Network Log Pipeline Scrubbing

Breach Assessment & FCC Reporting

Vendor & Offshore Support Enablement

Network Logs: Personal Data Hiding in Machine Data

Integration Examples for Carrier Systems

Scan a CDR Batch with cURL

cURL — CDR Scan

Scrub Network Logs in Python

Python — Log Forwarder

Transcript Pipeline in Node.js

Node.js — Transcript Processor

Telecommunications PII Detection FAQ

Can the API distinguish an IMEI from other 15-digit numbers?

Are dynamic IP addresses really personal data we need to scrub?

How does detection help with the FCC's seven-business-day breach report?

Can we scan streaming CDR volumes without adding billing-path latency?

Does masking break our transcript analytics and agent QA scoring?

Can detection run on-premise for lawful-intercept-adjacent data?

Related Resources

Ready to Find CPNI Wherever It Hides?