What a Robocall Mitigation Plan Must Contain, With an Example

A robocall mitigation plan is the document, uploaded to your Robocall Mitigation Database filing, that describes what your company does to keep illegal robocalls off its network. The rule lists what it has to describe, and the list depends on what kind of provider you are.

Every provider

• Specific reasonable steps. What you have actually done to avoid originating, carrying or processing illegal robocall traffic. The word in the rule is "specific".
• Analytics. The analytics system or systems you use to identify and block illegal traffic, whether you use any third-party analytics vendor, and the vendor's name. Analytics are not mandatory, but the FCC says a plan should state whether or not they are used. If you rely on your underlying carrier's analytics, name the carrier.
• The traceback commitment. A statement that you will respond within 24 hours to all traceback requests from the Commission, law enforcement and the industry traceback consortium, and cooperate with them in investigating and stopping illegal robocallers.
• STIR/SHAKEN basis, if implementation is less than complete. The extension or exemption you rely on and why it applies, or an explanation of why you lack control of the network infrastructure needed.

Voice service providers also describe

• How you know your customers. How you comply with the know-your-customer obligation in 47 CFR 64.1200(n)(4).
• Any procedures to know your upstream providers.

Gateway providers also describe

• How you know your upstream providers. For gateway providers this is an obligation under 47 CFR 64.1200(n)(5), and the plan must say how it is met.
• The traceback commitment for gateway providers is to respond "fully and within 24 hours".

Non-gateway intermediate providers also describe

• Any procedures in place to know your upstream providers.

An example, marked up

Before service is turned on, a new customer gives us its legal name, address, tax ID and a description of its calling. Our provisioning lead checks the business against the state registry and calls the contact back on a published number.

We monitor our network for suspicious activity and take appropriate action.

We respond to traceback requests as quickly as possible.

What gets a plan flagged

• Promises in place of procedures. "We take robocalls seriously and follow industry best practices" describes nothing.
• A traceback sentence short of the rule. No "24 hours", or only one of the Commission, law enforcement and the traceback consortium.
• No vendor named, and no statement that none is used.
• An expired extension. The small voice service provider extensions ended June 30, 2022 and June 30, 2023.
• Someone else's certificate. A third party may sign your calls, but with your certificate, obtained with your own SPC token.
• "Complete" on a network that is not all IP. A provider with any non-IP portion certifies to partial implementation.
• A STIR/SHAKEN statement and nothing else. Caller ID authentication is one part of the certification. The plan is the rest.
• Template text. Placeholders, or a plan that would be equally true of any carrier.

Only what is true

A plan is a description of your program, certified by an officer. Writing in a practice you don't follow turns a deficient plan into a false one, and the base forfeiture for false or inaccurate information in the database is $10,000. If the rule requires something you don't do, the order is: put it in place, then describe it.

Length and confidentiality

There is no required length or format, apart from PDF for the upload. Where a text box on the form is too short, you may put the information in the plan and point to the section. You may ask for confidential treatment of part of a plan by filing a request in WC Docket No. 17-97 and uploading redacted and unredacted copies; the FCC says not to redact the whole plan or anything the rule specifically requires.