No federal law says internet providers need your Social Security number, but nearly every major ISP asks for it during signup, and they are allowed to turn you away if you refuse. The number lets them run a credit check before extending you a month of service on a bill-later basis, and it doubles as an identity verification tool. You can often sign up without it by using alternative ID, paying a deposit, or choosing a prepaid plan.
Why the Provider Is Asking
Home internet is usually sold on a post-paid cycle: you use the service, then you pay. From the ISP’s side, that is a small monthly extension of credit. Your Social Security number lets the company pull a credit report to judge whether you are likely to pay on time. Strong credit typically means straightforward approval with no extras. A thin or damaged file often means a security deposit or a nudge toward a prepaid plan.
The number also serves as an identity check. The Red Flags Rule, at 16 CFR Part 681, requires businesses that maintain certain consumer accounts — utility accounts are specifically named — to run an identity theft prevention program that detects fraud at account opening.1eCFR. 16 CFR Part 681 – Identity Theft Rules Matching a name and Social Security number against credit bureau records is the fastest way for an ISP to confirm you are who you say you are.
What the Law Says About the Request
The Privacy Act of 1974 restricts Social Security number demands, but only when they come from federal, state, or local government agencies. A government agency generally cannot deny you a benefit for refusing to share your number, and it must tell you whether the request is mandatory or voluntary.2Office of the Law Revision Counsel. 5 USC 552a – Records Maintained on Individuals Those rules do not reach private companies. The Social Security Administration itself confirms that a business may ask for your number and use it for any lawful purpose, that you may refuse, and that the business may then decline to serve you.3Social Security Administration. Can I Refuse to Give My Social Security Number to a Private Business?
So the exchange is governed by contract, not federal mandate. The ISP is free to ask. You are free to say no. And the ISP is free to walk away.
Some states add rules on top. Texas requires a business collecting Social Security numbers to maintain a privacy policy and keep the number confidential. California prohibits publicly displaying the number or printing it on mailed documents. More than a dozen other states have their own laws limiting how businesses store, display, or transmit the number after collection. These laws mostly govern what happens to the number once the company has it, not whether the company can ask in the first place.
How to Sign Up Without Giving Your Social Security Number
Most major providers offer at least one path around the credit check. Each carries a trade-off.
Use a Government-Issued Photo ID
Some ISPs will accept a driver’s license, passport, or military ID in place of a Social Security number. This usually means going into a retail store so a representative can inspect the document in person. The provider records the ID number for identity verification and skips the credit check. Because the company has no credit data to work with, expect a security deposit.
An Individual Taxpayer Identification Number is sometimes suggested as a substitute, but its value here is limited. The IRS issues ITINs strictly for federal tax purposes and states that an ITIN does not serve as identification outside the tax system.4Internal Revenue Service. Individual Taxpayer Identification Number (ITIN) Some ISPs may accept one through bureaus that keep ITIN-based credit files, but acceptance varies and is not universal.
Pay a Security Deposit
When the credit check is skipped, the ISP protects itself with an upfront deposit. Amounts vary by provider and plan. Fifty to two hundred dollars is common for basic service, and higher-speed packages with leased equipment can push the figure higher. The provider holds the money as a guarantee against unpaid bills or unreturned hardware. After a stretch of on-time payments, often around 12 months, the deposit is typically credited back or refunded. Whether it earns interest depends on state law and the provider’s terms.
Choose a Prepaid Plan
The cleanest way to avoid the question entirely is prepaid home internet. You pay for the month in advance, so the provider never has to assess your creditworthiness. Several major ISPs and fixed wireless providers now sell service this way. These plans usually require you to buy the router or gateway outright rather than lease it, which raises the upfront cost but eliminates the deposit and the credit pull. The trade-offs can include lower speed caps, no promotional pricing, and less priority in customer service. For someone determined to keep their Social Security number out of another database, prepaid solves the problem.
If You Do Provide It: Your Rights
When you hand over the number, the ISP sends it to one of the three major credit bureaus. The Fair Credit Reporting Act allows this because a service application is a consumer-initiated transaction, which is a permissible purpose for accessing your credit file.5Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports No separate written consent form is required for this kind of check.
The pull may be a soft inquiry, which does not affect your score, or a hard inquiry, which other lenders can see and which can nudge your score down slightly.6TransUnion. Hard vs Soft Inquiries – Different Credit Checks Not every provider will volunteer which type it runs. If you are comparing several ISPs, ask before you apply so you don’t stack hard inquiries.
Adverse Action Notices
If the ISP denies your application, imposes a security deposit, or offers worse terms because of your credit report, that counts as an “adverse action” under federal law. The provider has to send you a notice with the name and contact information of the credit bureau that supplied the report, a statement that the bureau did not make the decision, the credit score used, and your right to request a free copy of the report within 60 days and dispute inaccuracies.7Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports The rule applies even when the adverse action is a larger deposit rather than an outright rejection. If an ISP charges a deposit after a credit check and never explains why or names the bureau, you can complain to the Consumer Financial Protection Bureau or the Federal Trade Commission.
Credit Freezes and Fraud Alerts
A credit freeze on your file will block the ISP’s credit check the same way it blocks any other new inquiry. The application usually stalls at that point.8Consumer Advice – FTC. Credit Freezes and Fraud Alerts You have two choices: temporarily lift the freeze with the relevant bureau before applying and refreeze afterward, or skip the credit check and use the deposit or prepaid route.
A fraud alert works differently. It does not block access, but it tells the ISP to take extra steps to verify your identity, typically by calling a phone number you have on file.8Consumer Advice – FTC. Credit Freezes and Fraud Alerts Signup may take longer, but it can go through. If a provider approves the account without ever contacting you, the alert is not doing its job.
How the ISP Must Handle It Afterward
Once the ISP has your number, it is on the hook for protecting it. The Red Flags Rule requires a written identity theft prevention program that spots warning signs of fraud at account opening and over the life of the account, scaled to the size of the company and the sensitivity of the data.1eCFR. 16 CFR Part 681 – Identity Theft Rules Utility accounts are named in the rule, so an ISP cannot argue it falls outside.
Breach notification is more fragmented. The FCC updated its data breach rules in 2024 to cover personally identifiable information, including Social Security numbers, and to require customer notification within 30 days of discovering a breach.9Federal Register. Data Breach Reporting Requirements Those rules apply to telecommunications carriers and VoIP providers; whether they cover broadband-only ISPs is less clear. Every state has its own breach notification law that fills the gap, and the major ISPs have publicly committed to notifying customers when Social Security numbers are exposed, though for broadband providers that commitment is voluntary rather than a federal mandate. Every database is a place your number can leak from, which is one more reason to keep it out of the ones you don’t have to feed.