The year changed and so did two decades of regulatory architecture. On January 2 the Sixth Circuit struck down the FCC's net neutrality rules outright, ruling in the first major post-Chevron test that the agency never had the authority to classify broadband as a telecom service, and ending a twenty-year seesaw unless Congress writes it into law. Days earlier, AT&T, Verizon, and Lumen declared their networks clear of Salt Typhoon, statements that landed awkwardly against a White House count that was still climbing. And Vodafone closed the books on its European retreat, completing the 8 billion euro sale of Vodafone Italia to Swisscom on New Year's Eve.
December opened with the quiet part said out loud: Chinese state hackers had burrowed into at least eight US telecom providers, and the government's advice to Americans was to encrypt their way around the phone network. The FCC answered within a day, moving to turn a 30-year-old wiretap statute into a cybersecurity mandate for carriers. Away from the breach, AT&T used its first analyst day in years to commit to 50 million fiber locations and a copper farewell by 2029, Britain's competition regulator blessed the 15 billion pound Vodafone-Three merger with MVNO protections attached, and eSIM Go teamed with Vodafone UK to sell the MVNO model itself as a boxed product.
T-Mobile agreed to buy the bulk of UScellular for $4.4 billion — customers, stores, and spectrum — effectively ending the era of the major regional carrier and pushing U.S. wireless one big step closer to a pure three-carrier market. The consolidation landed the same week the Affordable Connectivity Program died: the FCC formally closed the subsidy that had helped 23 million households afford internet, with no successor funded. And Live Nation confirmed what breach forums had been advertising for days — Ticketmaster's data on hundreds of millions of customers was stolen, the Snowflake credential wave's biggest casualty yet.