e2e exchange

Call Us At
888.522.8096

Email Us At
erate@e2eexchange.com

CIPA Filtering Requirements for E-Rate Schools and Libraries

by | Nov 6, 2026 | E-Rate Updates 2026

Abstract forms suggesting filtering and compliance

If your school or library receives E-Rate discounts for internet access or internal connections, the Children’s Internet Protection Act (CIPA) requires you to run a technology protection measure, in practice a content filter, that blocks specific categories of visual depictions. You must also adopt and enforce an internet safety policy and certify compliance every Funding Year. The filter is only one piece. The policy, the public notice, the certification and the records behind them are what an auditor will ask to see.

This guide walks through each requirement in the order an applicant meets it, with the federal source for every rule.

E2eexchange
e2eexchange.com
Simplify E-Rate Compliance
E2e Exchange manages E-Rate compliance for schools and libraries, from filing applications to securing funding reimbursements.

Explore E-Rate support

Key Takeaways

  • CIPA applies to schools and libraries that receive E-Rate discounts, and the FCC states that they must certify compliance to receive that support.
  • The filter must block visual depictions that are obscene, child pornography, or, for computers used by minors, harmful to minors. Filtering is required for adults and minors alike on the first two categories.
  • Filtering must also cover school-owned devices used off campus, according to Wisconsin DPI guidance built on the FCC’s Emergency Connectivity Fund order.
  • Keep the policy, the public notice, hearing minutes, filter documentation and your certification forms for at least 10 years after the later of the Funding Year’s last day or the service delivery deadline.

Table of Contents

Who Has to Comply With CIPA

CIPA is not a blanket mandate on every school. It attaches to federal E-Rate support. FCC guidance explains that the law applies to schools and libraries receiving certain federal funding through the E-Rate program, and that they must certify compliance to receive that support.

The type of service you request determines the scope. Under 47 CFR 54.520, a school or library receiving discounts for internet access and internal connections makes CIPA certifications in each Funding Year. An applicant receiving only telecommunications-service discounts is not subject to certain CIPA requirements, though it must indicate on its certification that it receives only telecommunications discounts.

Two more points matter for planning:

  • Consequences are direct. The same rule states that a school that knowingly fails to submit the required certifications is not eligible for E-Rate discounts until it submits them.
  • ECF follows the same logic. 47 CFR 54.1716 requires CIPA certifications in each funding year, including where Emergency Connectivity Fund connected devices involve internet access or service funded through the program.

If you are unsure which of your funding requests trigger CIPA, that is a question for your E-Rate application manager before you file, not after.

What the Filter Must Block

CIPA’s technology requirement is narrower than many district filtering policies, and it helps to know exactly where the federal line sits. The internet safety policy must include a technology protection measure that, per USAC’s CIPA page, protects against access by adults and minors to visual depictions that are:

  1. Obscene.
  2. Child pornography.
  3. Harmful to minors (for computers with internet access by minors).

USAC defines a “minor” as anyone under age 17.

Two practical consequences follow from this wording.

The standard covers visual depictions. The rule speaks to pictures and images. Many districts filter far more than this, including gaming, social media and streaming, but that is local policy. CIPA does not require it, and your own board’s choices should be documented as such.

Adults are covered too. The first two categories must be blocked for adult users as well as minors. Only the harmful-to-minors category is limited to computers that minors can use. Public library computers and staff workstations on the same network deserve a deliberate decision, not an assumption.

Enforcement, Not Just Installation

47 CFR 54.520 requires the institution to enforce operation of the technology protection measure during minors’ use of computers with internet access. A filter that exists but is bypassed, switched to a monitor-only mode or left unmanaged on part of the network does not satisfy that. Build periodic checks into your technology calendar, and keep a record of them.

The Internet Safety Policy Behind the Filter

The filter is a required component of a written policy, not a substitute for it. FCC guidance says the policy must address:

  • Access by minors to inappropriate matter on the internet.
  • The safety and security of minors when using email, chat rooms and other direct electronic communications.
  • Unauthorized access, including “hacking,” and other unlawful activity by minors online.
  • Unauthorized disclosure, use and dissemination of minors’ personal information.
  • Measures restricting minors’ access to materials harmful to them.

Monitoring and Education for Schools

Schools carry two additional obligations. The FCC states that for schools, the policy must include monitoring the online activities of minors. Under 47 CFR 54.520, beginning July 1, 2012, the policy must also provide for educating minors about appropriate online behavior, including interacting with others on social networking websites and in chat rooms, and cyberbullying awareness and response.

The regulation does not prescribe a specific monitoring product or a curriculum. What an auditor looks for is that your policy addresses each element and that you can show it is carried out. For the education element, that usually means a documented lesson plan or digital citizenship program, with dates and grade levels, that staff can produce on request. Our cyber safety consulting work covers exactly this kind of program implementation.

Teacher guiding a digital citizenship lesson

Do Filtering Requirements Reach Devices Used Off Campus?

This is the question that has changed the most in practice. Wisconsin’s Department of Public Instruction states that, under the FCC’s Emergency Connectivity Fund order, CIPA compliance is triggered by device ownership rather than the location where the device is used. Its guidance is that all school-owned computers must be filtered, whether used on or off campus.

For a district with take-home laptops or Chromebooks, that has real operational weight:

  • Roaming filtering. A filter that only works on the campus network leaves home use uncovered. Confirm that your solution applies policy on the device itself, or through an equivalent method, wherever it connects.
  • Inventory accuracy. If you cannot list which devices are school-owned and which filtering profile each runs, you cannot demonstrate coverage.
  • Mixed fleets. Staff laptops, library loaner devices and lab machines fall under the same logic when they can reach the internet.

Because this interpretation reaches into how devices are managed, ask your E-Rate advisor how it applies to your specific funding requests before the next filing window.

Disabling the Filter for Adults

CIPA does not require that adults be treated like children. USAC states that an administrator, supervisor or other authorized person may disable the blocking or filtering measure during adult use to enable access for bona fide research or another lawful purpose. USAC’s page gives a sign-in page for adult requests as one example of how to handle it.

Libraries in particular should write this process down. The American Library Association’s CIPA legal FAQ describes the government’s interpretation of the provision as not requiring a patron to explain why they want unfiltered access. It also stresses unblocking without significant delay when an adult asks, and warns that slow or overly restrictive handling creates litigation risk. Its FAQ dates from 2003, so treat it as the library community’s reading of the provision and confirm current procedures with your counsel and your E-Rate advisor.

A workable procedure has four parts:

  1. A named role authorized to disable the filter.
  2. A simple request method, such as a sign-in page or a desk request.
  3. A target turnaround, ideally immediate.
  4. A short log entry, kept with your compliance records.

Public Notice and the Hearing or Meeting

Before you adopt the policy, the FCC states that you must provide reasonable public notice and hold at least one public hearing or meeting to address the proposed internet safety policy. A regularly scheduled board meeting can serve as that meeting, provided the agenda item is properly noticed.

USAC’s 2021 reminders, reproduced by the NC School Connectivity Initiative, add that additional hearings are not needed when you later amend the policy, unless state or local rules or the policy itself require them. Check your own board’s procedures, because many states and districts impose stricter requirements than the federal minimum.

Keep three items from this step: the published notice, proof of when and where it ran, and the meeting minutes showing the policy was addressed and adopted.

How You Certify: Forms and Timing

Certification happens through the E-Rate forms. According to 47 CFR 54.520, applicants receiving discounts for internet access or internal connections make CIPA certifications each Funding Year, generally on FCC Form 471, or on Form 479 for eligible consortium members. USAC’s records guidance also lists Forms 479 and 486 as applicable CIPA documents.

On USAC’s CIPA page, the administrative authority certifies that it is enforcing an internet safety policy with measures to block or filter internet access for both minors and adults to the visual depictions described above.

The First-Year Allowance

New participants get some room. Per USAC’s May 2021 news brief, as republished by NC SCI, in the first year an institution receives E-Rate funding for internet access or Category Two services, it can certify that it is undertaking actions to become compliant for the next Funding Year. In the following year it must certify full compliance, unless state or local procurement rules or competitive bidding prevent certification. If you are in that first year, use it to build the policy and deploy the filter, not to postpone the work.

What Records to Keep, and for How Long

CIPA findings in audits are overwhelmingly documentation findings. USAC’s list of documents to retain gives examples of CIPA records, including:

  • A copy of the internet safety policy.
  • Documentation of public notice and the public hearing or meeting minutes.
  • A description of the filter.
  • Documentation showing the filter was installed and working during the Funding Year.
  • Copies of FCC Forms 479 and 486, as applicable.

The same USAC document states that participants must keep documents demonstrating compliance for at least 10 years after the later of the last day of the applicable Funding Year or the service delivery deadline for the funding request. The 2021 news brief repeats that you should retain CIPA documentation for each Funding Year in which certification was required.

A useful habit is to store one dated CIPA folder per Funding Year, with a short filter status screenshot or report from the middle of the year. When staff change, the evidence stays with the institution.

A Working Checklist

Use this sequence to confirm you are covered before you file the next Form 471:

  1. Confirm scope. Identify whether your requests include internet access or internal connections, which trigger the full certification.
  2. Review the policy. Check that it addresses all five required elements, plus monitoring and online-behavior education if you are a school.
  3. Verify the notice and meeting. Locate the published notice and the minutes for the adoption of the current policy.
  4. Test the filter against the standard. It should block obscene, child pornography and harmful-to-minors depictions as applicable, for the right user groups.
  5. Check device coverage. Confirm school-owned devices are filtered off campus as well as on.
  6. Document the adult-disabling process. Name the authorized roles and the request method.
  7. Certify on the right form. Match the certification to your Form 471 or Form 479 situation.
  8. File and retain. Store the Funding Year’s CIPA file for the full retention period.

Where E-Rate Compliance Services Fit

CIPA sits inside a larger Funding Year cycle of competitive bidding, Form 470 and 471 filings, and invoicing. A missed certification can hold up discounts you have otherwise earned, and the policy, hearing and records work competes with everything else an administrator does.

Our E-Rate Compliance Services manage that cycle from end to end, with proactive deadline management and a dedicated support portal. For this requirement specifically, our CIPA compliance services include policy review, staff training and an online portal, so your documentation is complete before certification, not assembled during an audit.

E2eexchange

If you want a second set of eyes on your policy, certification and records before the next filing window, contact e2e Exchange and tell us your current Funding Year status. You can also read our overview of E-Rate funding for schools and libraries for the broader process.

FAQ

Does CIPA require filtering for every school that has internet access?

No. CIPA attaches to schools and libraries that receive E-Rate discounts, as the FCC explains. An applicant receiving only telecommunications-service discounts is not subject to certain CIPA requirements, but it must indicate that on its certification. State or local laws may add their own filtering rules.

Can a librarian turn off the filter for an adult patron?

Yes. USAC states that an administrator, supervisor or other authorized person may disable the measure during adult use for bona fide research or another lawful purpose. Set a clear, quick request process and record the authorized roles in your policy.

Does CIPA require me to monitor students online?

For schools, yes. The FCC states that the internet safety policy must include monitoring the online activities of minors. The rule does not name a specific tool, so document the method you use and how it is applied.

How long do I keep CIPA records?

USAC’s guidance calls for keeping compliance documents for at least 10 years after the later of the Funding Year’s last day or the service delivery deadline, per its retention list. Keep the policy, notice, minutes and filter documentation for each Funding Year that required certification.

Where do I certify CIPA compliance?

Generally on FCC Form 471, or Form 479 for eligible consortium members, according to 47 CFR 54.520. Certification is made each Funding Year.

Sources