Internet Filtering for a Small or Rural Library With No IT Staff

Does CIPA apply to your library?

The Children's Internet Protection Act (CIPA) is a condition attached to federal money. It is not a rule for every library. For most libraries the trigger is E-Rate, the federal program that discounts internet service and in-building network equipment.

• E-Rate for internet access or internal connections. If your library receives E-Rate discounts for Category One internet access, or for any Category Two service such as Wi-Fi equipment, managed internal broadband or basic maintenance, CIPA applies. That is how USAC, the company that runs E-Rate for the FCC, describes it on its CIPA page.
• E-Rate for telecommunications only. A library that receives discounts only for telecommunications services is not subject to the CIPA conditions, but it still certifies that this is the case.
• LSTA grant money. Under 20 U.S.C. 9134(f), a public library that does not receive E-Rate discounts for internet access may not use federal Library Services and Technology Act (LSTA) funds to buy computers that access the internet, or to pay direct costs of internet access, unless it has a filtering policy in place. If you receive any LSTA money, ask the agency that awarded it how it handles this.

If none of these apply, federal law does not require a filter. Your state may still have its own rules, and your board can choose to filter anyway. The rest of this guide assumes CIPA applies.

What CIPA asks of a library

1. A filter. The law calls it a technology protection measure. On the library's computers with internet access, it must protect against visual depictions that are obscene or child pornography for every user, and against visual depictions that are harmful to minors when minors use them. A minor is anyone under 17.
2. An internet safety policy. It must address the five topics in 47 U.S.C. 254(l): minors' access to inappropriate matter online, minors' safety in email, chat and other direct communication, hacking and other unlawful activity by minors, unauthorized disclosure of minors' personal information, and measures to restrict minors' access to harmful material.
3. Public notice and a hearing or meeting. The library gives reasonable public notice and holds at least one public hearing or meeting on the proposed policy.

The law also lets an administrator, supervisor or other authorized person disable the filter for an adult, for bona fide research or other lawful purpose. In a small library, decide in writing who that is. If one person often works the desk alone, that person needs to be on the list. Policy wording you can adapt is in our public library internet filtering policy template.

What has to be covered in a small library

CIPA speaks of "any of its computers with Internet access." In a small building more things are connected than you might expect. Walk through the library with a notepad and list every device and every network. Most small libraries end up with a list like this one.

Patron Wi-Fi needs a decision. When it runs over the connection E-Rate helps pay for, the safest course is to filter it the same way as the public computers. Ask your E-Rate adviser or state library agency how your library should treat it, and write the answer into your policy. Our guide to library Wi-Fi and patron devices covers the details.

One connection, one set of rules, with one exception

Most small libraries have one internet line and one public address. The filter knows your library by that address, so every device behind the router gets the same rules. For public PCs, staff and Wi-Fi that is usually what you want.

The children's area is the exception. Set the children's link on those PCs once, through a browser policy, a Windows setting or an Apple profile, and they follow the stricter rules wherever they are. This matters for a second reason. When staff use the PIN to open adult content for an adult patron, the bypass opens the whole network for 15, 30 or 60 minutes. PCs on the children's link have their own settings, so a bypass on the main network does not open them. If you would rather lift the filter on one adult PC at a time, a per-PC bypass can be set up on request. More on zones is in children's area internet filtering.

Setting it up on a consumer or ISP router

Small libraries rarely have a firewall or a server. They have the box the internet provider installed, and sometimes a store-bought Wi-Fi router behind it. That is enough for a DNS filter, because the whole setup is one setting: the DNS servers your router hands to every device.

Find out what you have

• Who installed the equipment, and does the provider manage it remotely?
• Where is the admin password? It is often on a label on the box, or with whoever set it up.
• Is there one box, or a provider box with your own Wi-Fi router behind it? The change goes on the box that hands out addresses to your devices.
• Do you have separate network names for staff or guests?
• Is your public internet address fixed, or does it change? Your provider can tell you.

Where the setting lives

On most routers the DNS servers sit under a heading such as Internet, WAN, LAN or DHCP. Enter the two filter addresses from your welcome email as the only DNS servers, the main filter first and the backup second. Then remove every other DNS server, including any your provider put in. A device that can still reach another DNS server can go around the filter. If the router has separate DNS fields for IPv6, check those too.

If the provider's box will not let you change it

Some provider equipment hides or locks the DNS setting. You have three ways forward.

1. Ask the provider whether they can enter the two filter addresses for you.
2. Put your own router behind the provider's box, connect the library's devices and Wi-Fi to it, and set the DNS there.
3. Set the private encrypted link on each library PC instead. This covers library computers but not visitors' phones, so treat it as a stopgap.

Register your public address first

The filter answers only the network addresses registered for your library and refuses lookups from anywhere else. Sign in to the dashboard from a computer at the library, open Networks and click Add my current address. Then change the router.

If your provider changes your public address from time to time, the filter will not answer the new address until it is registered, and websites stop loading. Ask the provider whether a fixed address is available, and tell us about it before you switch, so we can talk through the options.

Test before anyone notices

Start on one staff computer. Put the private test link from your welcome email into one browser's secure DNS setting. Only that browser is filtered. Try a few sites that should open, a few that should not, and the staff PIN. When it all behaves, change the router. Going back is one setting: put the old DNS values back and filtering stops at once. The hosted filter setup guide walks through each step with screenshots.

When the director is also the IT person

In a library with one or two paid staff, every job lands on the same few people. The aim is simple: the filter must never depend on one person being in the building.

• Name a second admin. A staff member, a trustee or the city or county IT office, if you have one. Give that person a dashboard login of their own.
• Write the steps down. One page: where the router is, how to sign in, the two filter addresses and how to undo the change. Keep the router password somewhere safe that a second person can reach.
• Decide who can lift the filter for adults. The board authorizes the roles. Include everyone who opens or closes the library alone.
• Keep our contact by the desk phone. Setup help covers the router setting, importing any old block lists and adjusting your rules in the first weeks.

Handling unblock requests without an IT department

Requests come in three kinds. Treat them differently and none of them needs an IT person.

An adult needs a blocked site now

The law lets an authorized person disable the filter for an adult for bona fide research or other lawful purpose. With the hosted filter, staff open the staff page on any phone or desk computer, type the PIN and choose 15, 30 or 60 minutes. Adult content opens for that network and the filter switches back on by itself. VPN and proxy sites and your own block list stay blocked. Each use is logged with its time and length, not with what the adult read.

Two practical points. Ask the patron to close the browser when done, because a browser can keep using a site it already opened until it restarts. And if you would rather adults did not have to ask at all, patron self-unblock lets them open a site themselves on the block page, on adult computers only. The legal background is in CIPA adult unblocking in libraries.

A site is wrongly blocked for everyone

Look the site up with our website category check to see why it was blocked. If it should be open, add it to the always-allow list in the dashboard. The change is live within seconds, although some browsers keep the old answer for about a minute. Tell us about it too, so we can look at the category.

A minor or a parent asks about a blocked site

This one is a review, not an on-the-spot decision. Write down the site and pass it to the director, who checks it against the policy and replies within the time the policy sets.

Wi-Fi users after hours

People using the Wi-Fi from the parking lot cannot walk up to the desk. Put your library's name and an email address on the block page and on the Wi-Fi sign, so they know where to ask. Desk scripts and a privacy-safe request log are in the library staff guide to filter requests.

E-Rate for a small library

E-Rate can pay a large share of a small library's internet service and in-building network equipment. The rules are the same for a one-room library as for a large system, and a few of them were written with small applicants in mind. The figures below come from USAC and the FCC. Check them on usac.org before you budget, because they change.

Eligibility

USAC's eligibility page says a library must meet the definition of library in the Library Services and Technology Act and be eligible for assistance from a state library administrative agency under that Act. Its budget must be completely separate from any school, college or university. Libraries run as for-profit businesses are not eligible.

Your discount

A library's discount comes from the share of students eligible for the National School Lunch Program in the public school district where the library, or the main branch of a system, is located. Urban or rural status counts too. USAC treats a library as urban if it sits in a Census urban area of 25,000 people or more, and rural otherwise, using 2020 Census data from funding year 2024.

At the lower poverty levels a rural library gets 5 to 10 points more than an urban one. From 50 percent eligibility upward the discounts are the same. The top discount is 90 percent for Category One and 85 percent for Category Two, or 90 percent for Tribal libraries. The full matrix is in our guide to E-Rate for public libraries.

The Category Two budget for a small building

Category Two covers the network inside the building. Each library gets a five-year budget, before the discount, based on its square footage. For funding years 2026 to 2030 the multiplier is $5.43 per square foot and the minimum budget, called the funding floor, is $30,175. A library under 5,558 square feet gets the floor.

Count the total area of all floors inside the outer walls, including staff-only spaces. Outdoor space used for programs does not count. You validate the figure in the first year you ask for Category Two support in the cycle. At an 80 percent discount, the floor means E-Rate could pay up to $24,140 of $30,175 in eligible equipment and services over the five years.

Two exemptions that save paperwork

Normally you post FCC Form 470 and wait 28 days for bids before you sign a contract. Two exemptions skip that step for small purchases.

• Low-cost business internet. A commercially available business-class internet service is exempt from Form 470 if its total yearly cost before discount, including one-time charges, is $3,600 or less per library, and its speed is at least 100 Mbps down and 10 Mbps up.
• Low-cost Category Two for libraries. Since funding year 2024, a library asking for Category Two equipment and services of $3,600 or less before discount in one funding year is exempt from Form 470. The amount is per library and cannot be averaged across branches. The FCC created this exemption in 2023 with small, rural and Tribal libraries in mind, and it still expects purchases to be cost-effective.

Forms and dates

• The E-Rate funding year runs from July 1 to June 30.
• The FCC Form 471 application window is generally open between mid-January and mid-March, before the funding year starts. Check USAC for the exact dates each year.
• Through funding year 2027, a library certifies CIPA on FCC Form 486 after funding is approved, or on Form 479 to its consortium lead. From funding year 2028 the FCC has moved the CIPA certification to Form 471 and eliminated Form 486, so the policy and the filter need to be in order earlier in the year.
• In the first funding year a library applies for, it may certify that it is undertaking actions to comply. From the next year it must comply, with a waiver only in narrow cases.

What E-Rate will not pay for

The filter itself. USAC states that costs for the technology used to meet CIPA's protection requirements are not eligible for reimbursement through E-Rate. The 2026 Eligible Services List also says that off-premises use of E-Rate funded services is not eligible. Plan to pay for the filter, and for anything used outside the building, from the library's own budget.

Help from your state library agency or regional system

You do not have to work this out alone. Your state library administrative agency is, in the words of federal law, the official agency of the state charged with the extension and development of public library services throughout the state. Depending on your state, there may also be a regional library system, cooperative or consortium your library belongs to. What each one offers varies a great deal, so ask rather than assume.

Questions worth asking

• Is there a state E-Rate coordinator or E-Rate training for public libraries?
• Does a state network or consortium buy internet access for member libraries? If so, who files the forms, and what does the library sign?
• Is our connection already filtered upstream? Which categories, can we change them, and who can see the logs?
• Does the agency publish a model internet safety policy or a sample board resolution?
• Can a regional system's technology staff help with the router change?
• Does our state have its own law on library internet filtering or on library records?

Two cautions about shared arrangements

First, a consortium cannot be CIPA compliant for you. If a consortium applies on your behalf, your library certifies to the consortium lead on FCC Form 479, and your own board still adopts your own policy after notice and a hearing. See Form 479 for consortium members.

Second, an upstream filter may not let your staff lift it for an adult at the desk. If lifting it means a phone call to someone in another town, adults wait and staff improvise. Check this before you rely on it.

A free toolkit for small libraries

USAC points small, rural and Tribal libraries with limited IT support to the Toward Gigabit Libraries Toolkit, a free tool funded through a grant from the Institute of Museum and Library Services. It helps staff learn about their broadband connection and work out IT needs that may be eligible for E-Rate.

Budgeting for filtering in a small library

Because E-Rate does not pay for the filter, it is a line in the library's own budget. A flat yearly figure is the easiest for a small board to approve and for a director to defend.

Monthly plans can be cancelled at any time. Yearly plans run for the year you paid for.

Costs that are not on the invoice

• Staff time. Setup takes an afternoon. After that, plan a short monthly check and the occasional unblock review.
• Board time. One agenda item with public notice when the policy is adopted or reviewed.
• Printing. Signs at each public computer, on the Wi-Fi page and in the children's area.

If the budget is tight, ask your state library agency about grant programs, and see our guide to online safety grants for schools and libraries.

A one-afternoon setup plan

The technical part fits in one afternoon. The board part, adopting the policy after notice and a hearing, follows its own calendar. Do a little preparation the week before.

The week before

• Subscribe for one library, or ask for a quote if you have more than one building. Your welcome email has the two filter addresses, the private test link and the staff page.
• Find the router password and the provider's support number.
• List the websites that must always open: your catalog, e-book and database services, the state job portal and local government.
• Decide which PCs are in the children's area.
• Pull out your current internet safety policy, or start from our template.

The afternoon

If one PC behaves differently from the others, the cause is usually a DNS address typed into that PC's network settings, or a browser using its own secure DNS. The setup guide shows how to check both.

In the weeks after

• Put the internet safety policy on a board agenda with public notice, hold the hearing or meeting and adopt it. Our guide to presenting internet filtering to the library board covers the brief, the motion and the records.
• File your CIPA certification on time.
• Once a month, spend 15 minutes on the activity report: the most blocked sites, unblock requests and anything that looks odd.

Records a small library should keep

If USAC audits your CIPA compliance, it asks for a short list of documents. Keep one folder per funding year, paper or digital, where a successor could find it.

• A copy of the internet safety policy.
• The public notice, and a record of the hearing or meeting such as the agenda and minutes.
• The record of adoption, such as the board minutes.
• A description of the filter.
• A report or other record showing that the filter was installed and working during the funding year.
• Copies of your FCC Form 486 or Form 479.

USAC says to keep these for at least 10 years after the later of the last day of the funding year or the service delivery deadline. The hosted filter's printable activity report, policy record and staff bypass log cover the filter part. What auditors look for is explained in CIPA audit: what USAC asks for.

Sources

The legal and funding facts on this page come from these official sources, checked in November 2026. E-Rate figures and forms change, so confirm them with USAC before you file or budget.

• USAC: Children's Internet Protection Act (CIPA), for when CIPA applies, the three requirements, undertaking actions, audit documents and the 10-year retention rule.
• USAC: School and Library Eligibility.
• USAC: Calculating Discounts, Discount Matrix (revised January 2024) and Urban or Rural Status.
• USAC: Category Two Budgets, for the FY2026 to FY2030 multiplier and funding floors (announced in FCC Wireline Competition Bureau Public Notice DA 25-471, June 4, 2025).
• USAC: Competitive Bidding Exemptions.
• USAC: T-LEAP FAQs, question 7, on CIPA technology costs not being eligible, and the Tribal Applicants FAQ, question 5, on the Toward Gigabit Libraries Toolkit.
• FCC: Funding Year 2026 Eligible Services List, DA 25-1069, released December 17, 2025.
• FCC: Report and Order, FCC 23-56, adopted July 20, 2023, paragraphs 19 to 21, on the $3,600 Category Two exemption for libraries.
• FCC: Report and Order, FCC 26-30, adopted April 30, 2026, paragraphs 57 to 60, on moving the CIPA certification to Form 471 from funding year 2028.
• Electronic Code of Federal Regulations: 47 CFR 54.520.
• United States Code: 47 U.S.C. 254, subsections (h)(6) and (l); 20 U.S.C. 9134(f); 20 U.S.C. 9122.