The Federal Communications Commission is weighing rules that would require carriers and VoIP providers to collect a customer’s name, physical address, government-issued ID number, and an alternate phone number before activating or renewing service. The practical effect, critics warn, would be the end of the anonymous prepaid phone. But the bigger concern they’re raising is what happens to that data once every American’s identity is tied to a phone line: a centralized, government-mandated record that touches domestic violence survivors, journalists, whistleblowers, and anyone who simply doesn’t want their name permanently attached to their number.

The proposal, FCC 26-27, was adopted April 30 under the FCC’s long-running robocall docket and is framed as a “know your customer” standard, modeled on the one banks use to screen account holders. But the agency’s own filing states the collected data could also help investigate “fraud, espionage, or influence operations that undermine national security” and “abuse in text messaging networks,” a scope that reaches well beyond spam calls into a broader identity-verification regime for phone service itself.

That gap between an anti-fraud rule and one that touches every American’s ability to communicate privately is forcing privacy experts to weigh in on the proposal’s implications.

“The FCC’s know-your-customer proposal is misguided and counterproductive,” said Sydney Saubestre, a senior policy analyst on the Privacy and Data Project at the Center for Democracy and Technology. “It would require every American to hand over a government ID just to get phone service, a mandate that would deny access to the most vulnerable, strip anonymity from those who need it most, and do little to stop the sophisticated scam operations it claims to target.”

“The FCC’s own Safe Connections Act recognizes that survivors of domestic violence need a phone without a paper trail,” she told Fortune. “This proposal shreds that principle.”

Much left to be desired

“Americans should not have to sacrifice their privacy because the Commission hasn’t exhausted more targeted alternatives to stop robocalls,” Saubestre said.

The Electronic Frontier Foundation and the ACLU made a similar case in joint comments filed with the FCC, calling the proposal “a data collection regime that harms everyday, law abiding Americans” without meaningfully reducing unwanted calls. Their filing notes the FTC has found a majority of illegal robocalls originate overseas, and that fewer than half of U.S. telecoms have fully implemented the FCC’s existing call-authentication standard, which is a technical fix the groups argue is already available and more targeted than mass ID collection.

“The telecommunications industry has proven time and again to be poor stewards of personal
information. Not only have they been at the center of several large-scale data breaches in recent
years, but their data practices also leave much to be desired,” the filing read.

It’s a larger issue for those without resources. The joint filing estimates roughly 15 million adult U.S. citizens lack a driver’s license and 2.6 million have no government-issued photo ID at all, with Black and Hispanic Americans, people with disabilities, and lower-income Americans disproportionately less likely to have a current one. The FCC’s draft definition of “physical address” would also exclude P.O. boxes, mail-forwarding services, and shared office space—arrangements unhoused people and domestic violence survivors often rely on precisely because they don’t reveal a home location.

“This proposal would also prevent people from getting an anonymous phone line for safety reasons, such as a person in a domestic violence situation who does not have control over her personal phone line and needs to call a shelter, or a teenager being coerced by human traffickers who just wants to call for help,” the filing continued.

“Put plainly this could prevent honest citizens from getting a job and feeding their families, or from escaping domestic violence, human trafficking, or other dangerous situations.”

And then there’s the question of custody: Who holds this data once it’s collected? The filing points to the industry’s track record: AT&T disclosed in 2024 that hackers downloaded call and text records from 109 million customer accounts, on top of a separate breach exposing tens of millions of current and former customers’ information. Comcast’s Xfinity division disclosed a similar breach in 2023, exposing nearly 36 million account holders’ data. Centralizing government IDs and home addresses inside that same industry, privacy groups argue, creates a single high-value target rather than solving the underlying fraud problem.

Not every public comment opposes the rule. Banking industry groups, filing through the Bank Policy Institute, have expressed support, citing fraud and scam losses that totaled nearly $200 billion in 2024 and arguing the financial sector already spends billions annually fighting it. The FCC has not yet responded to Fortune’s request for comment.

“Americans should not have to sacrifice their privacy because the Commission hasn’t exhausted more targeted alternatives to stop robocalls,” Saubestre said.