Customer Data Platform for Telecom: Residency, Scale, Consent

A customer data platform (CDP) for telecom unifies subscriber identity, plan and usage context, consent and channel data across billing, CRM, network and digital systems, at a scale of tens of millions of subscribers. What sets telecom apart is regulation: traffic and location data have their own consent rules in EU ePrivacy law, US customer proprietary network information (CPNI) rules limit marketing uses, and national rules often require data to stay in-country.

Who this is for: CTOs, customer-value-management leads, data protection officers and architects at mobile and fixed operators. It belongs to the high-load commerce and telecom hub.

What is different about telecom data

Telecom combines retail-scale marketing with data that is a regulated by-product of providing the network. Keep the classes apart.

The design rule that follows: the marketing data layer should receive derived, purpose-limited attributes (for example "high data usage band, consented to offers") from network and billing systems, not the raw records that carry the strictest rules.

Consent and sector rules, by region

This is a map to check with local counsel; telecom regulation varies by country and several items need verification for your market.

| UK | PECR regulations 19 and 22 34 | Opt-in for direct-marketing email, with a soft opt-in for existing customers; automated calling needs prior consent. The Data (Use and Access) Act raised PECR fines to up to £17.5 million or 4% of global turnover 5 | | US | 47 U.S.C. § 222; 47 CFR 64.2005 16 | Carriers must protect customer proprietary information and may use CPNI only as required by law or with approval, apart from providing the service and related uses. Without approval, a carrier may use CPNI to market offerings within the category of service the customer already takes, but not to market other categories, with listed exceptions. It may not use CPNI to identify customers who call competitors |

| US states | Comprehensive privacy laws | About 23 states by 2026; see US state privacy laws |

| Saudi Arabia | PDPL, fully enforceable from 14 Sep 2024 | Transfers abroad via approved mechanisms or exceptions; see Saudi PDPL |

Service messages versus offers

Operators send many messages that are part of the service: usage alerts, bill reminders, outage notices. Those rest on the contract and are different from offers. The CPNI rules and ePrivacy Article 6(3) make the boundary matter: using usage or traffic data to target an upsell is marketing, and it needs the consent or approval that applies in your market. Model the purpose of each message in the consent ledger so an opt-out from offers never suppresses a safety or billing notice, and an offer is never sent under a service-message exemption. The ledger design is covered in consent withdrawal across channels.

Residency and sovereignty for operators

Operators are often treated as critical infrastructure and subscriber data is politically sensitive, so residency questions are frequent and strict. The drivers are:

A common pattern is in-country cells: a platform instance per country or region holds personal data locally, and only aggregated or pseudonymised data flows to a group-level analytics layer. The data residency by country article lists rules by jurisdiction, and the self-hosting guide explains the deployment options.

Architecture at subscriber scale

A worked example, with assumptions stated (illustrative, not benchmarks): an operator with 30 million subscribers where billing, care and digital channels together generate 20 events per subscriber per day produces 600 million events a day, about 6,900 per second on average; with a 5x peak (a launch or an outage-recovery wave) that is roughly 35,000 per second. The peak-testing method is in the peak-load test plan.

Telecom adds identity problems retail rarely has:

• Number recycling. Phone numbers are reassigned. If a CDP keys identity on the MSISDN, a new owner can inherit the previous owner's consent or opt-out. Key identity on a subscriber or account ID, record the validity period of each number-to-person link, and handle reassignment events from the billing system. This is an architecture recommendation; it does not establish availability of a reassignment database in every market.
• Households and shared plans. One account holder, many users; consent belongs to the person, not the plan.
• Prepaid and anonymous subscribers. Identity is thin; avoid forcing false matches.
• Multiple identifiers. MSISDN, account, device, email and app IDs; see identity resolution explained and single customer view.

The pricing problem

Subscriber counts are large and sticky, so per-profile pricing behaves as a fixed charge on the customer base. At published list rates, 30 million profiles would be $7.2 million a year on Salesforce's Profiles price ($240 per 1,000 per year), and about $3.6 million a year if Segment's Team rate were extended to 30 million monthly tracked users; both are arithmetic from price pages, not quotes. See why per-profile pricing breaks at scale for the method and assumptions.

Vendor landscape with telecom pages

We checked vendor sites on 17 October 2026 for telecom-specific pages. Treat this as a starting list.

| Treasure AI (formerly Treasure Data) | No telecom industry page found 12 | SaaS | |

| PrivyCDP | Customer-owned platform deployable on-premise, in private cloud, hybrid or sovereign/air-gapped; per-country cells; no per-profile or per-event billing | Customer-operated | Not a BSS replacement |

BSS and CRM suites run the commercial and billing core. A customer data platform is the governed data layer beside them, not a replacement. SaaS can be the right answer for an operator with modest scale, no strict residency rule and a team that prefers a managed service; the metered cost curve and the residency rules are what push large operators toward customer-owned deployments.

Checklist

1. Classify every data source: subscriber, billing, CDR and traffic, location, digital, care.
2. Decide which classes may enter the marketing platform and bring only derived attributes from network and billing systems.
3. Record the purpose and legal basis or approval for each message type, separating service messages from offers.
4. Make location features opt-in with documented information to users.
5. Key identity on account or subscriber ID; model number recycling explicitly.
6. Set up in-country cells where residency rules or licences require it.
7. Keep marketing data outside retention and interception scopes, with a documented boundary.
8. Test consent withdrawal propagation to SMS, push and email under peak load.
9. Size for the launch or outage-recovery peak and run the test plan.
10. Model per-profile cost at your subscriber count before shortlisting vendors.
11. Require customer-held keys and export in open formats.
12. Re-check regional rules at each regulatory milestone (ePrivacy status, FCC enforcement, DPDP dates).

---

Telecom and privacy rules vary by country and change; confirm with local counsel.