Contact GitHub

Spectrum & Regulation

How wireless spectrum is governed worldwide, the FCC and its peers, equipment authorization, privacy law, and FCC ID lookup.

Overview

Radio spectrum is a finite, shared natural resource, and every Wi-Fi radio you operate is legal only because it fits inside a stack of rules that reaches from a global treaty down to the label on the back of the device. The chain is consistent: the International Telecommunication Union sets the worldwide framework, national regulators turn that framework into binding domestic rules, and an equipment-authorization process certifies that a given radio behaves within those rules in a given place. On top of that radio layer sits a separate body of privacy law that governs what you may do with the data and identifiers a wireless deployment can collect. This page walks the hierarchy from the top down, with the real frequencies, channel families, and authorization mechanics you meet in the field, and then covers the privacy statutes that touch wireless capture. See also Antennas & MIMO for how power and gain combine into the limits described here, and the Glossary for term definitions.

The governance hierarchy

Spectrum is not owned the way land is. It is administered, region by region and service by service, against a single global reference. At the top sits the International Telecommunication Union (ITU), a specialized agency of the United Nations. Its radiocommunication arm, the ITU-R, is the global agency responsible for management of the radio-frequency spectrum and satellite orbit resources. Its central instrument is the Radio Regulations (RR), a binding international treaty that determines how the radio-frequency spectrum is shared between different services. The RR runs to over 2,300 pages of text and charts, and its core is the Table of Frequency Allocations in Article 5, which states, band by band, which radiocommunication services may use each slice of spectrum.

For allocation purposes the ITU divides the world into three Regions. Region 1 covers Europe, Africa, the Middle East west of the Persian Gulf, and the former Soviet states. Region 2 covers the Americas, including Greenland. Region 3 covers most of Asia and Oceania. The Regions exist precisely because allocations differ between them: a band can be assigned to one service in the Americas and a different service in Europe, which is why the same physical radio may be legal on a channel in one Region and prohibited in another. The Radio Regulations are revised at the World Radiocommunication Conference (WRC), which convenes roughly every four years; recent and scheduled conferences include WRC-23, WRC-27, and WRC-31.

The ITU framework is a treaty, not a domestic statute. Each member state implements it through a national regulator that issues legally enforceable rules inside its own territory. In the United States that is the Federal Communications Commission (FCC). In Canada it is Innovation, Science and Economic Development Canada (ISED). In the United Kingdom it is Ofcom. Across Europe, technical standards are developed by the European Telecommunications Standards Institute (ETSI) and spectrum policy is harmonized through the European Conference of Postal and Telecommunications Administrations (CEPT) and its Electronic Communications Committee (ECC), while market access is governed by the EU Radio Equipment Directive. National regulators may deviate from the ITU table only to the extent that they cause no harmful interference to other member states operating in accordance with the Regulations.

ITU-R (global) Radio Regulations treaty - Article 5 table Three ITU Regions R1 Europe/Africa/ME R2 Americas R3 Asia/Oceania FCC United States ISED Canada Ofcom United Kingdom ETSI / CEPT EU (RED) Equipment authorization FCC Part 15: Certification or SDoC Device label: FCC ID grantee code + product code
The spectrum governance chain: a global ITU-R treaty, divided into three Regions, implemented by national regulators, enforced at the device through equipment authorization and a public identifier.

What the FCC is and does

The Federal Communications Commission is the independent United States agency that regulates interstate and international communications by radio, television, wire, satellite, and cable. For wireless work, its decisive function is engineering and equipment policy, handled by the Office of Engineering and Technology (OET). The OET writes the technical rules for radio devices, runs the laboratory and equipment-authorization program, assigns grantee codes, and maintains the public database of authorized equipment.

The rules that govern almost every Wi-Fi radio sold in the US live in Title 47 of the Code of Federal Regulations, Part 15 (47 CFR Part 15), titled Radio Frequency Devices. Part 15 sets the conditions under which radio-frequency devices may operate without an individual license, provided they meet specified technical limits and do not cause harmful interference. Part 15 sorts devices into three classes: unintentional radiators (digital circuitry that emits RF as a byproduct), incidental radiators (devices not designed to emit RF but that do), and intentional radiators (deliberate transmitters such as a Wi-Fi card or access point). The fundamental bargain of Part 15 is stated on every compliant label: the device may not cause harmful interference, and it must accept any interference received, including interference that may cause undesired operation.

Equipment authorization and the FCC ID

Before an intentional radiator can be marketed in the US it must be authorized. The FCC operates two procedures, and the one that applies depends on the device class. Supplier's Declaration of Conformity (SDoC) is a self-declaration process used for unintentional radiators, where the responsible party tests the product and declares compliance without filing with the FCC. Certification is the more rigorous procedure required for intentional radiators, which is to say every Wi-Fi transmitter. Certification is performed by a Telecommunication Certification Body (TCB), an FCC-recognized third party that reviews test data produced by an accredited laboratory and issues the grant of authorization, which is then published in the FCC database.

A certified device must carry an FCC ID, the public identifier tying the physical product to its grant of authorization. The FCC ID has exactly two parts. The first is the grantee code, assigned permanently by the Commission to a single company. A grantee code that begins with a letter (A through Z) is three characters long; a grantee code that begins with a digit (2 through 9) is five characters long. To avoid visual ambiguity, the code does not use the digits 0 or 1. The second part is the product code, defined by the grantee itself to identify the specific product. Under 47 CFR 2.926 the product code consists of Arabic numerals, capital letters, and may include the dash or hyphen, with the total number of those characters not exceeding 14.

example FCC ID PD9 AX211NG grantee code assigned by FCC, permanent 3 chars (alpha start) or 5 chars (digit 2-9 start) no 0 or 1 product code chosen by the grantee A-Z, 0-9, and hyphen 14 characters maximum unique per grantee look up at fcc.gov/oet/ea/fccid (official) or fccid.io (mirror)
An FCC ID is grantee code plus product code. The split point is not marked in the printed string, so a lookup resolves the boundary; the grantee code length is fixed by its first character.

The practical value of the FCC ID is that it is a key into a public record. The official lookup is the FCC's OET Equipment Authorization (EAS) database, reachable from the FCC ID Search page; a widely used third-party mirror is fccid.io. Because the printed string does not mark where the grantee code ends, a search resolves the boundary and returns the grantee's identity, the equipment class, the tested frequency ranges, measured output power, internal and external photographs, the user manual, and the test reports filed for certification. For a field operator this turns any labeled radio into a documented capability profile.

Regulatory domains: channels, power, and the 5 / 6 GHz mechanisms

Because allocations differ by Region and by country, products ship with a regulatory domain setting that constrains which channels and power levels the radio will use. The same access point sold worldwide gates its behavior on this setting, which is why a channel that is routine in one country may be disabled in another. Two quantities define the legal envelope: the channels (frequency) and the power. Power is usually expressed as EIRP, effective isotropic radiated power, which combines transmitter conducted power and antenna gain into the total a perfect omnidirectional antenna would need to match the signal; this is the number regulators cap, and it is why a higher-gain antenna forces a lower conducted power.

In the US, 5 GHz Wi-Fi is split into U-NII sub-bands. U-NII-1 spans 5.150 to 5.250 GHz, U-NII-2A spans 5.250 to 5.350 GHz, U-NII-2C spans 5.470 to 5.725 GHz, and U-NII-3 spans 5.725 to 5.850 GHz. The two middle blocks, U-NII-2A and U-NII-2C, share spectrum with weather, aviation, and military radar, so devices there must run Dynamic Frequency Selection (DFS): the radio listens for radar, and on detecting it must vacate the channel, typically within seconds, and stay off it. DFS is the reason a 5 GHz network can momentarily drop and re-home to a new channel.

The 6 GHz band added 1,200 MHz of spectrum (5.925 to 7.125 GHz) as U-NII-5 through U-NII-8. Rather than DFS, the FCC protects the band's incumbents (chiefly thousands of fixed microwave links) with Automated Frequency Coordination (AFC). Standard-power outdoor access points must query an AFC system with their location; the system returns the channels and power levels that are safe to use there. Lower-power categories, Low Power Indoor (LPI) and Very Low Power (VLP), are allowed across the band without AFC, at reduced power and under a contention-based protocol. Europe and the UK opened 6 GHz on a different, narrower footprint and under ETSI rules, a concrete example of why the regulatory domain, not the hardware, decides what is legal.

5 GHz (U-NII-1 to 3) U-NII-1 5.150-5.250 no DFS U-NII-2A 5.250-5.350 DFS + TPC U-NII-2C 5.470-5.725 DFS + TPC (radar protection) U-NII-3 5.725-5.850 no DFS 6 GHz (U-NII-5 to 8) - 5.925 to 7.125 U-NII-5 5.925-6.425 AFC for standard power U6 6.425-6.525 U-NII-7 6.525-6.875 AFC for standard power U-NII-8 6.875-7.125 frequencies in GHz, per FCC 47 CFR Part 15 Subpart E. LPI and VLP allowed band-wide at reduced power without AFC.
US 5 GHz and 6 GHz unlicensed sub-bands. The 5 GHz middle blocks use DFS to dodge radar; the 6 GHz standard-power blocks use AFC to protect fixed microwave incumbents.

Privacy law that touches wireless capture

Operating a radio within Part 15 is a separate question from what you may lawfully do with the data a wireless deployment observes. Wi-Fi monitoring, probe-request logging, and captive-portal collection routinely gather identifiers and behavior that privacy statutes treat as protected, and the two largest regimes a field operator will encounter are the EU's GDPR and California's CCPA.

The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, has applied across the EU since 25 May 2018. Article 4(1) defines personal data as "any information relating to an identified or identifiable natural person," where an identifiable person is one who can be identified directly or indirectly, including by reference to an online identifier. Recital 30 makes the wireless connection explicit: natural persons may be associated with online identifiers provided by their devices, applications, tools, and protocols, such as internet protocol addresses or radio frequency identification tags. The clear implication for wireless work is that device identifiers tied to a person, including IP addresses and the MAC-style identifiers a sniffer collects, are personal data when they can be linked to an individual. Article 4(2) defines processing broadly enough to cover essentially any handling of that data: collection, recording, storage, use, disclosure, or erasure, whether automated or not. GDPR therefore reaches the moment of capture, not just later analysis.

The California Consumer Privacy Act (CCPA) of 2018 took effect on 1 January 2020 and was amended by the California Privacy Rights Act (CPRA), whose changes became operative on 1 January 2023. The CCPA defines personal information as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Like GDPR, that definition is broad enough to capture network identifiers, geolocation, and browsing activity collected over a wireless link. The two regimes differ in structure (GDPR is a comprehensive consent-and-lawful-basis framework; the CCPA is a consumer-rights and disclosure framework), but the operative lesson is the same: a Wi-Fi capture that can be tied to a person is regulated data, and lawful collection depends on authorization, scope, and jurisdiction, not on whether the radio itself is Part 15 compliant. Treat the radio rules and the data rules as two independent gates that both must be cleared.

Sources

(c) 2026 VTEM Labs, Inc. All rights reserved. | vtemlabs.com