The FCC's 2026 CIPA Review: What FCC 26-41 Asks Schools and Libraries

FCC 26-41 at a glance

FCC 26-41 is two documents in one. The Notice of Proposed Rulemaking (NPRM) asks open questions about E-Rate, screen time and CIPA. The Further Notice of Proposed Rulemaking (FNPRM) proposes specific rule text, mostly about E-Rate consultants and program forms. These are the official details, checked against the FCC's document server, the Federal Register and the FCC's filing system.

Chairman Carr and Commissioners Gomez and Trusty each issued a separate statement with the item. The full text, with footnotes and the proposed rules in Appendix A, is on the FCC's document server as FCC-26-41A1.pdf. The Federal Register version carries the deadlines.

What the FCC asks about CIPA

Section C of the NPRM, paragraphs 34 to 48, is titled "Re-examining the Children's Internet Protection Act." It asks questions. It does not propose new text for the CIPA rule. These are the main topics, in the order the FCC raises them.

1. Which devices CIPA covers

CIPA requires a school or library to filter "its computers" with internet access. The FCC currently reads that to mean devices the school or library owns. Paragraph 35 asks whether that is the best reading of the statute now that students and patrons bring their own phones, tablets and laptops onto school and library networks.

The FCC asks whether Congress meant a school-owned device to be protected while a personal device on the same E-Rate network is not. It asks whether parents are responsible for protecting personal devices, whether schools and libraries should keep personal devices off E-Rate networks, whether they can tell owned devices from personal ones, whether they can tell an adult user from a minor, and what that would cost.

Paragraph 36 sets out the other reading: CIPA would cover any device that reaches the internet through a school or library that receives E-Rate support for internet access, internet service or internal connections, no matter who owns the device. The FCC asks how schools and libraries could comply for devices they do not control, and whether it should amend its CIPA rules to match.

2. Filtering at the network level, and screen time

Paragraph 37 asks whether a technology protection measure should have to filter at the network level, so that every device that connects to the network is protected. It also asks whether filtering should include limits on screen time, who sets those limits today, how much network-level filtering would cost, and whether the burden differs by the size and resources of the school or library.

3. Monitoring, unauthorized access and the word "computer"

A school's internet safety policy must include monitoring the online activities of minors. Paragraph 38 asks what "monitoring" should mean and asks commenters to address privacy. It asks whether "unauthorized access" in the statute could cover use with no educational purpose, such as scrolling social media instead of doing research, or use beyond a set number of hours. It also asks whether the FCC should define "computer" and other terms in CIPA.

4. Social media and "harmful to minors"

In 2011 the FCC decided that social networking websites are not harmful to minors as such, so CIPA does not require schools and libraries to block them to receive E-Rate. Paragraph 39 asks whether the FCC should revisit that conclusion, given changes in social media since 2011 and newer research on its effects on children.

5. Teaching appropriate online behavior

Schools certify that their policy provides for educating minors about appropriate online behavior, including social networking, chat rooms and cyberbullying awareness and response. Paragraph 40 asks whether the FCC should define what that education requires, whether it should include limiting one's own screen time, whether courses should be required before or alongside use of E-Rate networks, who should set the content, and whether schools should document attendance, for example as a percentage to protect student privacy.

6. Who counts as a minor

The CIPA rule defines a minor as anyone under 17. Paragraph 41 asks whether to add a definition of "child", for example the under-13 definition used in the Children's Online Privacy Protection Act, so that protections could vary by age. It asks whether younger children need stronger requirements and whether schools and libraries should be treated differently.

7. Screen time and local decisions

CIPA leaves the decision about what is inappropriate for minors to the school board, library or other local authority, and the rule bars federal agencies from setting criteria for that decision. Paragraph 42 asks whether limits on screen time are allowed under CIPA, how schools and libraries measure screen time today, what filtering options can restrict use to approved educational activities, and what they cost.

It also asks whether excessive screen time could itself be "inappropriate for minors" under CIPA, consistent with the statute and the First Amendment, whether parents have input into local decisions, and whether the FCC can give guidance without setting criteria.

8. What a policy must contain, and who sees it

Paragraph 43 asks what an internet safety policy must contain, whether there is minimum content, and whether the FCC can require a policy to be replaced. It asks whether the FCC should collect and keep every school's and library's policy, whether policies should be public, and whether the public notice and hearing duties already require them to be public in some form.

Paragraph 44 asks whether the template policies many schools and libraries use meet the statute, how acceptable use policies differ from internet safety policies, and whether policies contain confidential or personal information that would need to be removed before publication.

9. Public notice, hearings and penalties

CIPA requires reasonable public notice and at least one public hearing or meeting on the proposed internet safety policy. Paragraph 45 asks whether local bodies actually hold them, what "reasonable" notice means, how far in advance notice and the meeting should happen, and how parents are told.

Paragraph 46 asks whether USAC should reduce commitments or recover funding when notice or a meeting was missed, instead of letting the applicant fix the error, and whether funding should be at risk for the whole period of non-compliance. Paragraph 47 asks whether more meetings should be required, for example each time the policy changes or once a year, with an exception for small changes, and whether the FCC should prescribe how notice is published.

10. If E-Rate shrinks

Paragraph 48 notes an argument in the record that without E-Rate funding, the CIPA duties to keep an internet safety policy and a filter would no longer apply. The FCC asks whether schools and libraries would keep those protections without CIPA, what else they use to keep students safe, and what authority it has outside CIPA.

Other parts of FCC 26-41 that touch online safety

CIPA is one section of the NPRM. Other sections matter to the same school and library staff.

• Screen time and educational purpose (paragraphs 29 to 32). Whether uses such as screen time to calm or reward students count as "educational purposes", whether E-Rate funding should depend on screen time limits, whether schools should give parents a meaningful way to opt their children out of screen-based instruction, and whether adult supervision or a way to report inappropriate content should be required, and whether that should differ for schools and libraries.
• Head Start and pre-kindergarten (paragraph 33). Whether these students and facilities should keep E-Rate support, be cost-allocated out of funding requests, or be limited to those that are part of a public school or district.
• Authority beyond CIPA (paragraphs 49 to 53). Whether the FCC has any power outside CIPA to limit screen time, including per-day hour limits on E-Rate networks, limits by age, and a split between educational and recreational screen time, and who is best placed to protect children online: the FCC, parents, teachers or all of them.
• The future of E-Rate (paragraphs 12 to 28). Whether E-Rate has met its connectivity goal and should be limited or sunset, whether the FCC has authority to do that, whether the discount matrix should change, whether support for special construction should be limited or ended, and whether the presumption that activities on school or library property are educational should be reversed or changed.

These are questions, not proposals with rule text. What the FCC adopts, if anything, will depend on the record.

The FNPRM: consultants, forms and Form 479

The further notice proposes rule text in Appendix A. Most of it is about program integrity rather than filtering.

• A definition of "consultant" for E-Rate: any non-employee who helps an applicant or service provider with any part of the program, paid or not.
• A new annual consultant certification and disclosure form, FCC Form 5654, collected by applicants and service providers. Those that use no consultant would certify that instead.
• A consultant registration database that gives each individual consultant a registration number, with annual training.
• A ban on consultant fees based on a percentage of E-Rate contracts or funding, and record keeping for letters of agency, consulting and fee agreements and payment records.
• An end to relying on existing contracts that were not competitively bid, written and certified service substitutions, and a June 30 deadline for the service provider's Form 473.
• Changes to Form 479: consortium members would certify to the same program rules as other applicants, and would submit Form 479 in EPC before the consortium leader certifies Form 471.
• Writing the certifications on Forms 470, 471, 472, 473 and 474 into the rules. The proposed Form 471 text includes a CIPA certification that, as of the start of discounted services, the recipients have complied with CIPA, are undertaking actions to comply, or receive telecommunications services only.
• Questions on cost-effectiveness when one or no bids arrive, on managed internal broadband services and on the lowest corresponding price rule, and a proposal to delete most Emergency Connectivity Fund rules.

What could change for libraries and schools

No one knows yet what the FCC will adopt. Based on what it asked, these are the areas where rules could move. Plan around them as possibilities, not as decisions.

Personal devices and Wi-Fi

If the FCC adopts the broader reading in paragraph 36, CIPA could cover patron laptops and phones on library Wi-Fi and student or guest devices on school networks, not only owned computers. Libraries would feel this most, because patrons of all ages bring their own devices. A filter installed on each owned computer protects only those computers. A filter that works at the network level applies to every device that uses that network. Our guides to library Wi-Fi and patron devices and BYOD filtering in schools cover the practical side.

Policies and meetings

New rules could set minimum policy content, require policies to be posted or sent to the FCC, set a notice period before the hearing or meeting, or require a new meeting when the policy changes. Today USAC says additional meetings are not necessary, even if the policy is amended, unless state or local rules or the policy itself require them.

Schools: monitoring and online behavior education

Schools could get a definition of "monitoring the online activities of minors", a defined education requirement and possibly a duty to document course completion. Our guide on what student monitoring can see explains the tools schools use today.

Penalties

Missing the public notice or the hearing could lead to a funding reduction or recovery, instead of a chance to fix the error first.

Schools and libraries treated differently

The NPRM asks again and again whether schools and libraries should be treated differently. Libraries serve adults as well as minors, and CIPA already lets an authorized person disable the filter for an adult doing bona fide research or other lawful work. Any new rule for libraries would have to fit with that. See CIPA adult unblocking in libraries.

E-Rate itself

If E-Rate were limited or narrowed, fewer schools and libraries would be bound by CIPA through E-Rate. State filtering laws apply on their own terms, whatever happens to E-Rate. See our guide to state library internet filtering laws.

What stays the same today: 47 CFR 54.520

As of November 2026, the CIPA rule in the electronic Code of Federal Regulations is 47 CFR 54.520 as amended by FCC 26-30. FCC 26-41 does not change its text. If you receive E-Rate discounts for internet access or internal connections, these duties apply now.

• A filter. An internet safety policy that includes a technology protection measure on your computers with internet access. It must protect against visual depictions that are obscene or child pornography for all users, and harmful to minors for users under 17, and you must enforce its operation.
• Adult access. An administrator, supervisor or other authorized person may disable the filter during use by an adult, to enable access for bona fide research or other lawful purposes.
• Five policy topics. The policy addresses access by minors to inappropriate matter online; the safety and security of minors using email, chat rooms and other direct electronic communications; unauthorized access, including hacking, and other unlawful activities by minors online; unauthorized disclosure, use and dissemination of personal information about minors; and measures to restrict minors' access to materials harmful to minors.
• Schools only. The policy also includes monitoring the online activities of minors, and educating minors about appropriate online behavior, including social networking, chat rooms and cyberbullying awareness and response.
• Public notice and a meeting. Reasonable public notice and at least one public hearing or meeting to address the proposed internet safety policy.
• Local decisions. The school board, library or other local authority decides what matter is inappropriate for minors. No federal agency may set the criteria for that decision or review it.
• A certification every funding year. One of three: you have complied; you are undertaking actions to comply (first funding year only); or CIPA does not apply because you receive discounts for telecommunications services only.
• The policy on request. You make your internet safety policy available to the FCC when it asks.

The rule also sets the consequences. A school or library that knowingly fails to submit the certifications is not eligible for discounts until it does. One that knowingly fails to use its computers as certified must repay discounts for the period of non-compliance. Applicants that receive discounts for telecommunications services only are not subject to CIPA, but they must say so on the certification.

The E-Rate discount does not pay for the filter itself. See E-Rate and CIPA funding, and for the policy itself, our CIPA internet safety policy guide.

How this fits with FCC 26-30 and the end of Form 486

FCC 26-41 is the second FCC item of 2026 that matters for CIPA. The first, FCC 26-30, is a Report and Order. Its rules are final and in effect. Our Form 486 and CIPA certification guide summarizes it. Here is how the two fit together.

FCC 26-30 was adopted April 30, 2026 and released May 1, 2026. It was published in the Federal Register on May 19, 2026 and took effect June 18, 2026, except for two amended sections that needed paperwork approval first and took effect September 14, 2026. It removed Form 486 starting with funding year 2028 and moved the CIPA certifications to the Form 471 funding application. The current text of 47 CFR 54.520(g) says it plainly: for funding years 2003 through 2027 the certification goes on Form 486, and for funding year 2028 and later it goes on Form 471.

For funding year 2027, nothing changes. You still certify CIPA on Form 486, or on Form 479 if you are a consortium member, as our FY2027 checklist and calendar and Form 479 guide describe. In FCC 26-30 the FCC also said Form 486 must keep being filed until the CIPA certifications can be made on Form 471 in EPC, and that applicants with open commitments from earlier years keep using Form 486 for those years.

How to file a reply comment in ECFS

Anyone can take part in an FCC rulemaking. A reply comment responds to the comments others filed in the first round (47 CFR 1.415(c)). This is a how-to only. We do not suggest what to say.

1. Read what others filed. In ECFS, search proceeding 26-133 to see the comments filed by the October 13, 2026 deadline. Note the filer and date of any comment you want to answer.
2. Prepare your document. Put "Reply Comments" and the docket numbers in the heading: WC Docket Nos. 26-133, 13-184, 21-93 and 21-455. If no attorney represents you, include your name and mailing address, as 47 CFR 1.419(e) requires for electronic filings. Save it as a searchable PDF or a Word file.
3. Start a standard filing in ECFS. The standard filing lets you upload a document. The express option is for a short comment typed into a box with no attachment.
4. Enter the proceeding. Enter 26-133. The notice asks that filings refer to all four dockets, so add 13-184, 21-93 and 21-455 if the form allows, and keep all four in your heading.
5. Complete the form. Add the filer's name, a contact email and an address, choose the reply comment type, and upload your document.
6. Submit and keep proof. Submit by November 12, 2026 and save the confirmation ECFS shows. Filings are public, so leave out personal details of students, patrons and staff. Screens in ECFS can change; follow its prompts.

Paper filers send an original and one copy, addressed to the Secretary of the FCC. U.S. Postal Service First-Class, Priority and Priority Mail Express go to 45 L Street NE, Washington, DC 20554. Commercial courier deliveries go to 9050 Junction Drive, Annapolis Junction, MD 20701, where hand deliveries are accepted from 8:00 a.m. to 4:00 p.m.

The proceeding is "permit-but-disclose". After the reply deadline, you can still make written or oral presentations to FCC staff, but each one must be disclosed: file the written presentation, or a summary of an oral one, in ECFS within two business days. For accessible formats of the notice, email [email protected] or call 202-418-0530.

What to do now

You do not need to change your filter or policy because of FCC 26-41. These steps keep you compliant today and ready for whatever the FCC adopts.

1. Keep working to today's rules. Run the funding year 2027 cycle as normal: certify CIPA on Form 486 after your commitment, and have the filter running from July 1, 2027.
2. Pull your CIPA folder. Check the current policy, the dated public notice, the minutes of the hearing or meeting and the adoption record. Paragraphs 45 to 47 show the FCC is looking at exactly these records. Our CIPA audit guide lists what reviewers ask for.
3. List every network and device minors use. Count owned computers, school-issued devices, patron and guest Wi-Fi, and any other network. If the device question in paragraphs 35 and 36 is decided the broad way, you will need to know which networks reach which devices.
4. Know how your filter is applied. A filter on each owned computer covers those computers only. A network-level filter covers every device on that network. Write down which you have, and where.
5. Read your policy as a parent would. The FCC asks whether policies should be public. Check that yours contains no personal information, and decide where you would post it.
6. Plan for funding year 2028. CIPA moves to Form 471, which is certified in the filing window, months before July. Consortium leaders can set an earlier Form 479 date for members now.
7. Keep consultant records. If you use an E-Rate consultant, keep the agreement and payment records and note how the fee is set. The FNPRM proposes to require these records.
8. Follow the docket. Watch ECFS proceeding 26-133 and the Federal Register for a Report and Order. Decide by November 12, 2026 whether your school or library wants to file a reply.

Related guides