Where Does Subscriber Data Go When an ISP Uses AI?

One of your software vendors ships an AI feature. You ask what happens to subscriber data when it passes through, and the answer comes back fast: enterprise tier, SOC 2, private. That is close to what all of them say right now, and it does not tell you much. It is also a software company answering for a model provider it does not control, so you are two steps from the thing you wanted to know.

That is worth pushing on, and it comes up in nearly every conversation we have now. But the version that matters more is the one waiting when you stand up AI on your own data, because then every answer is yours to choose rather than accept. And the way most people ask it, whether their data gets trained into a public model, is not the part carrying the most risk.

We are a Databricks partner, and we spent two days on the keynotes at Databricks Data + AI Summit this month. Three things they have shipped this year land on problems that show up the moment an operator builds this for themselves. Here is the problem each one is aimed at.

What Actually Leaves Your Building

The worry usually bundles three separate questions:

• Training is whether the model provider uses your inputs to improve their model. On business tiers this is generally off, and it is contractual, so it belongs in your agreement, not on a marketing page.
• Retention is how long they keep those inputs regardless of training. Zero data retention, where nothing is stored once the response comes back, is available from some providers and is worth asking for by name. We have operators running it.
• Retrieval is what your own systems handed the model to begin with, and almost nobody asks about it.

That last one is where the exposure sits. A language model does not know anything about your subscribers. Your retrieval layer hands them over, politely and completely, every time somebody asks a question.

What that creates is a trace: the prompt, the rows pulled to answer it, the tool calls, the reasoning along the way. It exists whether or not anyone trains on it, and it lives in the model provider’s logs, in your application logs, and in whatever harness the agent runs inside. Satya Nadella made the point in his Summit conversation with Ali Ghodsi, that organizations are running frontier models against their own context and leaking the traces without meaning to.

Databricks’ answer is Unity AI Gateway, which logs every input, output and step in between into a Unity Catalog table inside your own account, governed like any other sensitive table. That reframes what to ask: not whether anyone trains on your data, but where the trace lands, who reads it, and how long it stays. SOC 2 is a real audit of real controls, and it answers none of those three.

The strongest version is not sending the data out at all. For operators with their own GPU hardware, the high volume work can run on their own network, with frontier models kept as a deliberate and itemized exception.

Is a Service Address CPNI?

Most writing about AI privacy stops at PII, which is where broadband picks up a problem of its own. If you sell voice alongside internet, part of your customer data sits under a stricter federal regime than the rest.

Customer proprietary network information is what the customer revealed to you through their use of the service. Who they called, when, for how long, how much they used. CPNI carries real restrictions on what you are allowed to do with it.

Subscriber list information is who the subscriber is: name, number, address, the directory-style material. That is PII under your normal controls, and the definition of CPNI explicitly leaves it out.

So a service address is not CPNI, while the record of who that subscriber called last Tuesday is. A Calix alarm on their ONT is neither, because your own network raised it and the customer revealed nothing by using the line. The regime follows your telephone service, so broadband traffic data currently sits outside it, though that classification has flipped more than once and is worth watching.

This matters because the classification is what your permissions key off. Governed tags, ABAC column masking and data classification are now generally available in Unity Catalog, so one policy can mask every column tagged sensitive without a rule per table. The built-in classifiers cover GDPR and HIPAA patterns, not telecom, so that part stays yours to define. Tagging everything customer-related as CPNI feels careful, and it quietly breaks analytics while teaching your team to ignore the tag. If everything is CPNI, nothing is.

Everyone Can Ask Now

The third problem arrives once the tool works. Give two hundred people a question box and the model was never the hard part. The hard part is that a manager in one market can now ask about another, and a CSR can ask about margin.

Genie One ships with automatic identity management, so an employee logs in, gets a question box and nothing else, while catalog grants decide which rows come back. One identity model for the dashboard, the agent and the chat box.

Where to Start

• Ask where the trace lands before you ask who trains on what.
• Classify before you connect. Tagging is the prerequisite, not the cleanup.
• Decide what runs on your own hardware, and write that list down instead of deciding case by case.

None of this needs a compliance department. It needs you to decide, once, which columns are sensitive and who sees them, before you point anything clever at them.

If you would rather not work that out alone, that is what we do. At BBI we build and run lakehouses and ETL pipelines for fiber operators, and Databricks is our preferred data platform. Reach out to us!