Federal Communications Commission DA 25-973 Before the Federal Communications Commission Washington, D.C. 20554 ) ) In the Matter of ) File No.: EB-IHD-24-00037307 ) NAL/CD Acct. No.: 202632080001 Comcast Cable Communications, LLC ) FRN: 0003768165 ) ) ORDER Adopted: November 24, 2025 Released: November 24, 2025 By the Chief, Enforcement Bureau: 1. The Enforcement Bureau (Bureau) of the Federal Communications Commission has entered into a Consent Decree to resolve its investigation into whether Comcast Cable Communications, LLC (Comcast or Company) violated section 631(c) and (e) of the Cable Communications Policy Act of 1984 (Cable Act) in connection with a vendor breach that compromised the personally identifiable information of {[ ]} Comcast cable subscribers. To resolve this matter, Comcast agrees to (i) pay a $1,500,000 voluntary contribution and (ii) implement a compliance plan that includes, among other things, certain Vendor oversight practices related to customer privacy and information protection. 2. After reviewing the terms of the Consent Decree and evaluating the facts before us, we find that the public interest would be served by adopting the Consent Decree and terminating the referenced investigation regarding Comcast’s compliance with section 631(c) and (e) of the Cable Act.1 3. In the absence of material new evidence relating to this matter, we do not set for hearing the question of Comcast’s basic qualifications to hold or obtain any Commission license or authorization.2 4. Accordingly, IT IS ORDERED that, pursuant to section 4 of the Communications Act of 1934, as amended, 47 U.S.C. § 154, and the authority delegated by sections 0.111 and 0.311 of the Commission’s rules, 47 CFR §§ 0.111, 0.311, the attached Consent Decree IS ADOPTED and its terms incorporated by reference. 5. IT IS FURTHER ORDERED that the above-captioned matter IS TERMINATED. 1 Pub. L. 98-549, 98 Stat. 2779, codified at 47 U.S.C. § 521 et seq. 2 See 47 CFR § 1.93(b). Federal Communications Commission DA 25-973 6. IT IS FURTHER ORDERED that a copy of this Order and Consent Decree shall be sent by first class mail and certified mail, return receipt requested, to Frank M. Buono, Comcast Corporation, Executive Vice President, Legal Regulatory Affairs & Senior Deputy General Counsel, and Joseph Clark, Comcast Corporation, Senior Vice President and Senior Deputy General Counsel, Government Investigations, 300 New Jersey Avenue NW, Washington, DC 20001. FEDERAL COMMUNICATIONS COMMISSION Patrick Webre Acting Chief Enforcement Bureau 2 Federal Communications Commission DA 25-973 Before the Federal Communications Commission Washington, D.C. 20554 ) ) In the Matter of ) File Nos.: EB-IHD-24-00037307 ) CD Acct. No.: 202632080001 Comcast Cable Communications, LLC ) FRN: 0003768165 ) ) CONSENT DECREE 1. The Enforcement Bureau (Bureau) of the Federal Communications Commission (FCC or Commission) and Comcast Cable Communications, LLC (Comcast or Company), by their authorized representatives, hereby enter into this Consent Decree for the purpose of terminating the Bureau’s investigation into whether Comcast violated section 631(c) and (e) of the Cable Communications Policy Act of 1984 (Cable Act) in connection with a vendor breach that compromised the personally identifiable information of {[ ]} Comcast cable subscribers. To resolve this matter, Comcast agrees to (i) pay a $1,500,000 voluntary contribution and (ii) implement a compliance plan that includes, among other things, certain Vendor oversight practices related to customer privacy and information protection. I. DEFINITIONS 2. For the purposes of this Consent Decree, the following definitions shall apply: (a) “Act” or “Cable Act” means the Cable Communications Policy Act of 1984.1 (b) “Adopting Order” means an order of the Bureau adopting the terms of this Consent Decree without change, addition, deletion, or modification. (c) “Aggregate” or “Aggregated” when used in reference to Personally Identifiable Information or Sensitive Personal Information means collective information from multiple individuals or sources from which individual Subscriber identities have been removed and that is not linked or reasonably linkable to any Subscriber. (d) “Anonymize” or “Anonymized” when used in reference to Personally Identifiable Information or Sensitive Personal Information means information that is not linked or reasonably linkable to any Subscriber. (e) “Breach” means unauthorized access to or acquisition of unencrypted Subscriber SPI that materially compromises the security or confidentiality of that Subscriber SPI. A Breach shall not include any good-faith access to or acquisition of Subscriber SPI by a Vendor, employee, or agent of Comcast where such information is not used improperly, or any unauthorized access to or acquisition of encrypted Subscriber SPI that does not also involve access to the encryption key. 1 Pub. L. 98-549, 98 Stat. 2779, codified at 47 U.S.C. § 521 et seq. Federal Communications Commission DA 25-973 (f) “Bureau” means the Enforcement Bureau of the Federal Communications Commission. (g) “CD Acct No.” means account number 202632080001, associated with payment obligations described in paragraph 18 of this Consent Decree. (h) “Comcast” and “Company” means Comcast Cable Communications, LLC, any successors-in-interest, and any wholly or partially owned subsidiaries thereof that own and operate cable systems. (i) “Commission” or “FCC” means the Federal Communications Commission and all of its bureaus and offices. (j) “Compliance Plan” means the compliance obligations, program, and procedures described in this Consent Decree at paragraph 13. (k) “Covered Employees” means all employees of Comcast who perform, supervise, oversee, or manage the performance of duties that relate to Comcast’s responsibilities under the Subscriber Privacy Requirements. (l) “De-identify” or “De-identified” when used in reference to Personally Identifiable Information or Sensitive Personal Information means information for which identifying data has been removed such that the information is not linked or reasonably linkable to a Subscriber. (m) “Effective Date” means the date by which both the Bureau and Comcast have signed the Consent Decree and the Bureau has released an Adopting Order. (n) “Encrypt” or “Encrypted” when used in reference to Personally Identifiable Information or Sensitive Personal Information means information rendered unusable, unreadable, or indecipherable to an unauthorized person through a security technology or methodology generally accepted in the field of information security. (o) “Investigation” means the investigation commenced by the Bureau in EB- IHD-24-00037307. (p) “Mask” or “Masked” when used in reference to Personally Identifiable Information or Sensitive Personal Information means information that has been subjected to a process that removed a field or replaced it with a value in a way that does not preserve the analytic utility of the value, such as replacing a phone number with asterisks or a randomly generated pseudonym. (q) “Parties” means Comcast and the Bureau, each of which is a “Party.” (r) “Personally Identifiable Information” or “PII” means individually identifiable information regarding Subscribers collected by Comcast over its cable systems in the course of providing a cable service to its Subscribers, and includes specific information about an identified or reasonably identifiable Subscriber and a list of names and addresses on which the 2 Federal Communications Commission DA 25-973 Subscriber is included.2 This term does not include any record of Aggregate, Anonymized, De-identified, Encrypted, Masked, or Tokenized data which does not identify particular persons.3 (s) “Rules” means the Commission’s regulations found in Title 47 of the Code of Federal Regulations. (t) “Sensitive Personal Information” or “SPI” means the following categories of PII: Date of birth, social security number, driver’s license, state identification card, or passport number; account log-in, financial account number, debit card number, or credit card number, in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; racial or ethnic origin, religious or philosophical beliefs, or union membership; genetic data and biometric information; information collected and analyzed concerning a consumer’s health; or information collected and analyzed concerning a consumer’s sex life or sexual orientation. This term does not include any record of Aggregate, Anonymized, De-identified, Encrypted, Masked, or Tokenized data which does not identify particular persons. (u) “Subscriber” means a current or former Comcast customer who subscribed to the Company’s cable services. (v) “Subscriber Privacy Requirements” means the privacy protection requirements set forth in sections 631(c) and (e) of the Cable Act4 as applicable to PII. (w) “Tokenized” when used in reference to Personally Identifiable Information or Sensitive Personal Information means such information that has been converted into nonsensitive, randomized replacements (i.e., tokens). (x) “Vendor” means any entity that accesses, collects, processes, or stores Subscriber PII and/or SPI on behalf of Comcast as a processor or service provider pursuant to a contractual agreement with Comcast. “Vendor” shall not include any third party that only accesses, collects, processes, or stores de minimis amounts of Subscriber PII and/or SPI on behalf of Comcast. (y) “Vendor Management Program” means the compliance obligations, program, and procedures described in this Consent Decree at paragraph 14. 2 H.R. Rep. No. 98-934, *76, 79. 3 Pub. L. 98-549, 98 Stat. 2779, § 631(a)(2)(A) (Protection of Subscriber Privacy), codified at 47 U.S.C. § 551(a)(2)(A). 4 Pub. L. 98-549, 98 Stat. 2779, § 631(c), (e) (Protection of Subscriber Privacy), codified at 47 U.S.C. § 551(c), (e). 3 Federal Communications Commission DA 25-973 II. BACKGROUND 3. Legal Framework. Section 631 of the Cable Act establishes a nationwide standard for the protection of cable subscriber privacy.5 Pursuant to section 631(c) of the Cable Act and subject to limited exceptions, cable operators may not disclose personally identifiable information concerning any subscriber without the subscriber’s prior written or electronic consent.6 Moreover, cable operators are required to take measures that “are necessary to prevent unauthorized access” to such information by a person other than the subscriber or the cable operator.7 Section 631(e) further requires cable operators to destroy PII when the information is no longer necessary for the purposes for which it was collected, unless a relevant exception applies.8 4. Factual Background. Comcast is a communications limited liability company that owns and operates cable systems as well as broadband, wireless, and video businesses for residential and business customers. Under the Xfinity brand, Comcast provides Internet, TV and streaming, mobile, interconnected Voice over Internet Protocol (iVoIP), and home security services to residential customers. 5. From 2010 to 2022, Financial Business and Consumer Solutions, Inc. (FBCS) provided debt collection services to Comcast. The relationship required Comcast to provide FBCS with customer PII, including that of Subscribers. Comcast notified FBCS in 2020 that it was terminating the parties’ agreement and stopped referring new accounts to FBCS for debt collection services shortly thereafter. FBCS was obligated to continue working on previously placed accounts while winding down its work for Comcast. FBCS ceased all work for Comcast in 2022, when Comcast recalled the final accounts. Between February 14 and February 26, 2024, threat actors accessed the FBCS network without authorization (FBCS Breach). The FBCS Breach exposed the information of 237,702 current and former Comcast customers who used the following Comcast services: Internet; TV and streaming; iVoIP; and home security. The FBCS Breach implicated multiple categories of PII including: first names or first initial and last names, addresses, Social Security numbers, dates of birth, Comcast account numbers, internal Comcast ID numbers, and internal FBCS ID numbers. At least {[ ]} of the affected customers subscribed to Comcast’s cable services. FBCS first informed Comcast that the FBCS Breach affected data of current and former Comcast customers on July 15, 2024. FBCS informed Comcast that it was unable to notify current and former Comcast customers affected by the FBCS Breach. Comcast undertook those notifications. FBCS filed for bankruptcy before notifying state authorities that the FBCS Breach impacted current and former Comcast customers. Comcast completed notifications to state authorities as well. 6. Settlement. To resolve this matter, the Parties negotiated the following terms and conditions of settlement and enter into this Consent Decree as provided below. 5 H.R. Rep. No. 98-934, *77, see also Scofield v. Telecable of Overland Park, Inc., 873 F.2d 874, 876 (10th Cir. 1992); Cox Communications, Order, 30 FCC Rcd 12302, 12302, para. 3 (2015). 6 Pub. L. 98-549, 98 Stat. 2779, § 631(c)(1), codified at 47 U.S.C. § 551(c)(1). 7 Id. 8 Pub. L. 98-549, 98 Stat. 2779, § 631(e), codified at 47 U.S.C. § 551(e). 4 Federal Communications Commission DA 25-973 III. TERMS OF AGREEMENT 7. Adopting Order. The provisions of this Consent Decree shall be incorporated by the Bureau in an Adopting Order. 8. Jurisdiction. Comcast agrees that the Bureau has jurisdiction over it and the matters contained in this Consent Decree and has the authority to enter into and adopt this Consent Decree. 9. Effective Date. The Parties agree that this Consent Decree shall become effective on the Effective Date as defined herein. As of the Effective Date, the Parties agree that this Consent Decree shall have the same force and effect as any other order of the Commission. 10. Termination of Investigation. In express reliance on the covenants and representations in this Consent Decree and to avoid further expenditure of public resources, the Bureau agrees to terminate the Investigation. In consideration for the termination of the Investigation, Comcast agrees to the terms, conditions, and procedures contained herein. The Bureau further agrees that, in the absence of new material evidence, it will not use the facts developed in the Investigation through the Effective Date, or the existence of this Consent Decree, to institute any new proceeding on its own motion against Comcast concerning the matters that were the subject of the Investigation, or to set for hearing the question of Comcast’s basic qualifications to be a Commission licensee or hold Commission licenses or authorizations based on the matters that were the subject of the Investigation.9 11. Admission of Facts. Comcast admits for the purpose of this Consent Decree and for Commission civil enforcement purposes, and in express reliance on the provisions of paragraph 10 herein, that its actions as described in paragraphs 4 through 5 are true and accurate descriptions of the facts underlying the Investigation. Comcast makes no other admissions other than as described in this paragraph. 12. Compliance Officer. Within thirty (30) calendar days after the Effective Date, Comcast shall designate a senior corporate manager with the requisite corporate and organizational authority to serve as a Compliance Officer and to discharge the duties set forth below. The person designated as the Compliance Officer shall be responsible for developing, implementing, and administering the Compliance Plan and ensuring that Comcast complies with the terms and conditions of the Compliance Plan and this Consent Decree. 13. Compliance Plan. Within one hundred and eighty (180) calendar days after the Effective Date, Comcast shall supplement its existing compliance policies and procedures regarding the Subscriber Privacy Requirements by developing and adopting a Compliance Plan designed to ensure future compliance with the Subscriber Privacy Requirements consistent with the terms of this Consent Decree. Comcast will implement, at minimum, the following procedures: a. Compliance Manual. Within six (6) months after the Effective Date, the Compliance Officer shall develop and distribute an updated Compliance Manual to all Covered Employees. The updated Compliance Manual shall explain the Subscriber Privacy Requirements that Covered Employees shall follow to help 9 See 47 CFR § 1.93(b). 5 Federal Communications Commission DA 25-973 ensure Comcast’s compliance with this Consent Decree and the Subscriber Privacy Requirements. Comcast shall periodically review and revise the Compliance Manual as necessary to ensure that the information set forth therein remains current and accurate. Comcast shall distribute any additional revisions to the Compliance Manual promptly to all Covered Employees. b. Compliance Training Program. Comcast shall supplement its existing compliance training for Covered Employees with training on the Subscriber Privacy Requirements, to the extent that topic is not already covered, and the Compliance Plan (Compliance Training Program). As part of the Compliance Training Program, Covered Employees shall be advised of Comcast’s obligation to report noncompliance with this Consent Decree in accordance with paragraph 15 and shall be instructed on how to disclose such noncompliance to the Compliance Officer. All Covered Employees shall be trained pursuant to the updated Compliance Training Program within six (6) months after the Effective Date, except that any person who becomes a Covered Employee at any time after the initial delivery of the Compliance Training Program shall be trained within sixty (60) calendar days after the date such person becomes a Covered Employee. For any Covered Employee who is on leave when training otherwise would be required under this subparagraph 13.b., Comcast shall provide such training within sixty (60) calendar days after the Covered Employee’s return from leave. 14. Vendor Management Program. Within six (6) months after the Effective Date, Comcast shall review and revise its existing vendor management program as necessary to comply with this Consent Decree, and thereafter shall maintain and document that its program is reasonably designed to protect the privacy, security, confidentiality, and integrity of Subscriber PII maintained by or made available to Vendors from unauthorized access, use, or disclosure (Vendor Management Program). At a minimum, Comcast’s Vendor Management Program shall address the following: a. Compliance Officer. The Compliance Officer designated in paragraph 12, or another senior corporate manager with the requisite corporate and organizational authority designated by Comcast within thirty (30) calendar days after the Effective Date, shall oversee implementation of the requirements delineated in paragraph 14.b. through 14.e. b. Inventory of Data Shared with Vendors. Comcast shall implement or take steps to enhance an existing data inventory program reasonably designed to accurately track Subscriber PII shared with Vendors. c. Vendor Data Minimization, Retention, and Deletion. Comcast must prospectively contractually require Vendors with Subscriber SPI access to adhere to applicable requirements regarding the retention and deletion of Subscriber SPI (Vendor Retention and Deletion Requirements) before granting such Vendors access to Subscriber SPI, either by including these Vendor Retention and Deletion Requirements expressly in an agreement with such Vendors, or by mandating compliance with Comcast policies, industry standards, or similar that already have such requirements, except where: (1) a Vendor is already subject to negotiated and agreed-upon terms related to retention and deletion of Subscriber SPI; or (2) 6 Federal Communications Commission DA 25-973 Comcast, after performing a Vendor Risk Classification Assessment, has determined and documented that retention and deletion requirements are unnecessary for the Vendor given the low risks posed by the Vendor relationship. The Vendor Retention and Deletion Requirements shall apply to records containing Subscriber SPI for which the Vendor is responsible for retention and deletion, and, subject to (1) and (2) of this subparagraph 14(c), must be agreed upon by Comcast and the Vendor prior to such Vendor accessing records containing Subscriber SPI. The Vendor Retention and Deletion Requirements must set forth a timeframe, schedule, or other relevant criteria for the secure deletion, disposal, anonymization, or return of applicable Subscriber SPI. At a minimum, the Vendor Retention and Deletion Requirements must include the following provisions: i. Comcast must prospectively contractually require each Vendor with access to Subscriber SPI subject to the Vendor Retention and Deletion Requirements to provide a written confirmation no less than once every two (2) years that includes reasonably sufficient information from such Vendor to: (1) identify the type and approximate volume of records containing Subscriber SPI that are subject to the Vendor Retention and Deletion Requirements and the reason(s) the Vendor retains those records; and (2) confirm that Vendor is in compliance with any applicable Vendor Retention and Deletion Requirements; and ii. Within six (6) months of the date that a Vendor is required to delete, dispose of, anonymize, or return to Comcast records containing Subscriber SPI pursuant to the Vendor Retention and Deletion Requirements, Comcast must request and make reasonable efforts to obtain written confirmation from such Vendor that such records containing Subscriber SPI have actually been deleted, disposed of, anonymized, or returned to Comcast in accordance with the Vendor Retention and Deletion Requirements, unless the Vendor is required to continue to retain such records to comply with legal obligations. If any Vendor indicates that it cannot provide the confirmation otherwise required under this subparagraph 14(c)(ii) due to the Vendor’s legal obligations related to data retention, then Comcast must request and make reasonable efforts to obtain from that Vendor a confirmation identifying the legal obligations that require the Vendor to continue to retain Subscriber SPI and the length of time for which Subscriber SPI must be retained pursuant to those obligations. d. Vendor Risk Classification Assessment. Comcast shall conduct biennial risk assessments reasonably designed to identify and assess risks to Subscriber PII and SPI obtained by Vendors on behalf of Comcast (Vendor Risk Classification Assessments). Based on these identified risks, Comcast shall require Vendors to implement reasonable safeguards to control such risk and shall document the safeguards implemented in response by those Vendors in its regular Vendor Risk Classification Assessments. 7 Federal Communications Commission DA 25-973 e. Vendor Management. Comcast shall monitor Vendors’ compliance with Comcast’s applicable information security requirements as set forth in the agreement between Comcast and the Vendor, using assessments or reviews, so long as the business engagement remains active and/or the Vendor continues to retain Subscriber PII and/or SPI. At a minimum, such oversight must include the following: i. Comcast will undertake risk-based assessments, reviews, or other oversight (for example, the receipt and review of third-party assessment reports based on industry standard cybersecurity frameworks) of Vendor compliance with the Subscriber Privacy Requirements. Comcast will take into account risks posed to the security of Subscriber PII and/or SPI when determining the frequency and level of assessment or review for each Vendor. ii. Upon confirmation of a Breach from a Vendor, Comcast must perform an appropriate investigation of that Breach in coordination with the Vendor consistent with Comcast’s incident response protocols. Where appropriate based on the risks posed to the security of Subscriber PII and/or SPI, Comcast shall subject a Vendor that has experienced a Breach to an assessment or review following the Breach unless the business engagement is terminated and the Vendor no longer retains Subscriber PII and/or SPI; and iii. Any Vendor that does not conform with any material aspect of the Vendor Retention and Deletion Requirements set forth in the agreement between Comcast and the Vendor shall be subject to annual assessments or reviews for a period of at least three (3) years in addition to any existing requirements under a Comcast Vendor oversight program, unless the material nonconformance is remediable within ninety (90) days or the business engagement is terminated and the Vendor no longer retains Subscriber PII and/or SPI. f. Funding and resources. Comcast shall provide the Vendor Management Program with the resources and support necessary to comply with this Consent Decree, including adequately resourced staff. 15. Reporting Noncompliance. Comcast shall report any material noncompliance with the terms and conditions of this Consent Decree within thirty (30) calendar days after discovery of such material noncompliance. Such reports shall include a detailed explanation of: (i) each instance of material noncompliance; (ii) the steps that Comcast has taken or will take to remedy such material noncompliance; (iii) the schedule on which such remedial actions will be taken; and (iv) the steps that Comcast has taken or will take to prevent the recurrence of any such material noncompliance. All reports of material noncompliance shall be submitted to IHDTelecom@fcc.gov. 16. Compliance Reports. Comcast shall file compliance reports with the Commission six (6) months after the Effective Date, twelve (12) months after the Effective Date, twenty-four (24) months after the Effective Date, and thirty-six (36) months after the Effective Date. Such compliance reports are expected to contain highly sensitive information about Comcast’s systems 8 Federal Communications Commission DA 25-973 and security measures that, if disclosed, not only could disadvantage Comcast competitively but could provide bad actors with information that could assist in threat activity. Nothing in this Consent Decree shall directly or indirectly in any way whatsoever impair, prejudice, or otherwise adversely affect Comcast’s right to submit any reports under Paragraphs 15 or 16 under a request for confidentiality. The Commission shall not use any information contained in any compliance report or noncompliance report for any purpose other than the oversight or enforcement of this Consent Decree. a. Each Compliance Report shall include a summary of Comcast’s efforts during the relevant period to comply with the terms and conditions of this Consent Decree. In addition, each Compliance Report shall include a certification by the Compliance Officer, as an agent of and on behalf of Comcast, stating that the Compliance Officer has personal knowledge that Comcast: (i) has established and implemented the Compliance Plan and Vendor Management Program; and (ii) is not aware of any instances of material noncompliance with the terms and conditions of this Consent Decree, including the reporting obligations set forth in paragraph 15 of this Consent Decree. b. The Compliance Officer’s certification shall be accompanied by a statement explaining the basis for such certification and shall comply with section 1.16 of the Rules and be subscribed to as true under penalty of perjury in substantially the form set forth therein.10 c. If the Compliance Officer cannot provide the requisite certification, the Compliance Officer, as an agent of and on behalf of Comcast, shall provide the Commission with a detailed explanation of the reason(s) why and describe fully: (i) each instance of material noncompliance; (ii) the steps that Comcast has taken or will take to remedy such material noncompliance, including the schedule on which proposed remedial actions will be taken; and (iii) the steps that Comcast has taken or will take to prevent the recurrence of any such material noncompliance, including the schedule on which such preventive action will be taken. d. All Compliance Reports shall be submitted to IHDTelecom@fcc.gov. 17. Termination Date. The requirements set forth in this Consent Decree shall expire thirty-six (36) months after the Effective Date. 18. Voluntary Contribution. Comcast will pay a Voluntary Contribution to the United States Treasury in the amount of one million five hundred thousand dollars ($1,500,000) within thirty (30) calendar days of the Effective Date. Comcast acknowledges and agrees that upon execution of this Consent Decree, the Voluntary Contribution shall become a “Claim” or “Debt” as defined in 31 U.S.C. § 3701(b)(1).11 Upon an Event of Default, all procedures for collection as permitted by law may, at the Commission’s discretion, be initiated. Comcast shall send electronic notification of payment to IHDTelecom@fcc.gov on the date said payment is made. 10 See 47 CFR § 1.16. 11 Debt Collection Improvement Act of 1996, Pub. L. No. 104-134, 110 Stat. 1321, 1358 (Apr. 26, 1996). 9 Federal Communications Commission DA 25-973 Payment of the Voluntary Contribution must be made by credit card using the Commission’s Registration System (CORES) at https://apps.fcc.gov/cores/userLogin.do, ACH (Automated Clearing House) debit from a bank account, or by wire transfer from a bank account. The Commission no longer accepts Voluntary Contribution payments by check or money order. Below are instructions that payors should follow based on the form of payment selected:12 • Payment by wire transfer must be made to ABA Number 021030004, receiving bank TREAS/NYC, and Account Number 27000001. In the OBI field, enter the FRN(s) captioned above and the letters “FORF”. In addition, a completed Form 15913 or printed CORES form14 must be faxed to the Federal Communications Commission at 202-418- 2843 or e-mailed to RROGWireFaxes@fcc.gov on the same business day the wire transfer is initiated. Failure to provide all required information in Form 159 or CORES may result in payment not being recognized as having been received. When completing FCC Form 159 or CORES, enter the Account Number in block number 23A (call sign/other ID), enter the letters “FORF” in block number 24A (payment type code), and enter in block number 11 the FRN(s) captioned above (Payor FRN).15 For additional detail and wire transfer instructions, go to https://www.fcc.gov/licensing- databases/fees/wire-transfer. • Payment by credit card must be made by using CORES at https://apps.fcc.gov/cores/userLogin.do. To pay by credit card, log-in using the FCC Username associated to the FRN captioned above. If payment must be split across FRNs, complete this process for each FRN. Next, select “Manage Existing FRNs | FRN Financial | Bills & Fees” from the CORES Menu, then select FRN Financial and the view/make payments option next to the FRN. Select the “Open Bills” tab and find the bill number associated with the CD Acct. No. The bill number is the CD Acct. No. with the first two digits excluded (e.g., CD 1912345678 would be associated with FCC Bill Number 12345678). After selecting the bill for payment, choose the “Pay by Credit Card” option. Please note that there is a $24,999.99 limit on credit card transactions. • Payment by ACH must be made by using CORES at https://apps.fcc.gov/cores/userLogin.do. To pay by ACH, log in using the FCC Username associated to the FRN captioned above. If payment must be split across FRNs, complete this process for each FRN. Next, select “Manage Existing FRNs | FRN Financial | Bills & Fees” on the CORES Menu, then select FRN Financial and the view/make payments option next to the FRN. Select the “Open Bills” tab and find the bill number associated with the CD Acct. No. The bill number is the CD Acct. No. with the first two digits excluded (e.g., CD 1912345678 would be associated with FCC Bill Number 12345678). Finally, choose the “Pay from Bank Account” option. Please contact the appropriate financial institution to confirm the correct Routing Number and the correct account 12 For questions regarding payment procedures, please contact the Financial Operations Group Help Desk by phone at 1-877-480-3201 (option #6). 13 FCC Form 159 is accessible at https://www.fcc.gov/licensing-databases/fees/fcc-remittance-advice-form-159. 14 Information completed using the Commission’s Registration System (CORES) does not require the submission of an FCC Form 159. CORES is accessible at https://apps.fcc.gov/cores/userLogin.do. 15 Instructions for completing the form may be obtained at http://www.fcc.gov/Forms/Form159/159.pdf. 10 Federal Communications Commission DA 25-973 number from which payment will be made and verify with that financial institution that the designated account has authorization to accept ACH transactions. 19. Event of Default. Comcast agrees that an Event of Default shall occur upon the failure by Comcast to pay the full amount of the Voluntary Contribution on or before the due date specified in this Consent Decree. 20. Interest, Charges for Collection, and Acceleration of Maturity Date. After an Event of Default has occurred under this Consent Decree, the then unpaid amount of the Voluntary Contribution shall accrue interest, computed using the U.S. Prime Rate in effect on the date of the Event of Default plus 4.75%, from the date of the Event of Default until payment in full. Upon an Event of Default, the then unpaid amount of the Voluntary Contribution, together with interest, any penalties permitted and/or required by the law, including but not limited to 31 U.S.C. § 3717 and administrative charges, plus the costs of collection, litigation, and attorneys’ fees, shall become immediately due and payable, without notice, presentment, demand, protest, or notice of protest of any kind, all of which are waived by Comcast. 21. Waivers. As of the Effective Date, Comcast waives any and all rights it may have to seek administrative or judicial reconsideration, review, appeal or stay, or to otherwise challenge or contest the validity of this Consent Decree and Adopting Order. Comcast shall retain the right to challenge Commission interpretation of the Consent Decree or any terms contained herein. If either Party (or the United States on behalf of the Commission) brings a judicial action to enforce the terms of the Consent Decree or the Adopting Order, neither Comcast nor the Commission shall contest the validity of the Consent Decree or Adopting Order, and Comcast shall waive any statutory right to a trial de novo. Comcast hereby agrees to waive any claims it may otherwise have under the Equal Access to Justice Act16 relating to the matters addressed in this Consent Decree. 22. Severability. The Parties agree that if any of the provisions of the Consent Decree shall be held unenforceable by any court of competent jurisdiction, such unenforceability shall not render unenforceable the entire Consent Decree, but rather the entire Consent Decree shall be construed as if not containing the particular unenforceable provision or provisions, and the rights and obligations of the Parties shall be construed and enforced accordingly. 23. Invalidity. In the event that this Consent Decree in its entirety is rendered invalid by any court of competent jurisdiction, it shall become null and void and may not be used in any manner in any legal proceeding. 24. Subsequent Rule, Order, Law, or Regulation. The Parties agree that if any provision of the Consent Decree conflicts with any subsequent Rule or order adopted by the Commission (except an order specifically intended to revise the terms of this Consent Decree to which Comcast does not expressly consent) or any federal law or regulation, that provision will be superseded by such Rule, order, law, or regulation. 25. Successors and Assigns. Comcast agrees that the provisions of this Consent Decree shall be binding on its successors, assigns, and transferees. 16 See 5 U.S.C. § 504; 47 CFR §§ 1.1501–1.1530. 11 Federal Communications Commission DA 25-973 26. Final Settlement. The Parties agree and acknowledge that this Consent Decree shall constitute a final settlement between the Parties with respect to the Investigation. 27. Modifications. This Consent Decree cannot be modified without the advance written consent of both Parties. 28. Paragraph Headings. The headings of the paragraphs in this Consent Decree are inserted for convenience only and are not intended to affect the meaning or interpretation of this Consent Decree. 29. Authorized Representative. Each Party represents and warrants to the other that it has full power and authority to enter into this Consent Decree. Each person signing this Consent Decree on behalf of a Party hereby represents that he or she is fully authorized by the Party to execute this Consent Decree and to bind the Party to its terms and conditions. 30. Counterparts. This Consent Decree may be signed in counterpart (including electronically or by facsimile). Each counterpart, when executed and delivered, shall be an original, and all of the counterparts together shall constitute one and the same fully executed instrument. ________________________________ Patrick Webre Acting Chief Enforcement Bureau ________________________________ Date ________________________________ Francis M. Buono Executive Vice President, Legal Regulatory Affairs & Senior Deputy General Counsel Comcast Corporation ________________________________ Date 12