CCR Electronic Delivery: Direct-URL, Email, and Bill-Insert Under the 2027 Rule
Last reviewed: 2026-04-18 by Andy Zhang.
For more than two decades, the default Consumer Confidence Report (CCR) delivery method was paper in an envelope. The 1998 CCR Rule allowed electronic distribution only through limited state-approved alternatives, and EPA's January 2013 delivery-options memorandum filled some of the gaps by interpretation. The revised CCR Rule finalized by EPA on May 24, 2024 (89 FR 45980, docket EPA-HQ-OW-2022-0260) codifies three electronic and hybrid delivery methods directly into 40 CFR §141.155(a)(1), keeps the option of "another direct delivery method approved in writing by the primacy agency" as a fourth path, and ties each to a three-year public-access requirement and a paper-copy-on-request obligation. The compliance date for the revised delivery framework is the first report distributed by July 1, 2027 (covering calendar year 2026 data).
This guide walks through the delivery methods a community water system can use under §141.155, what each one requires in terms of the notification, URL, and paper-fallback, and how primacy agencies — New Jersey's NJDEP in particular — are layering additional reporting on top of the federal floor. If you are operating the 2027 production-and-distribution workflow, this is the reference for deciding which method fits which customer segment and how to document compliance.
Delivery-method decision matrix
| Customer segment | Primary method under §141.155(a)(1) | Notification required? | Paper fallback trigger |
|---|---|---|---|
| Paper-billing customer (no e-delivery consent) | Bill insert: paper CCR or one-page direct-URL notice (§141.155(a)(1)(i)–(ii)) | Yes — notice must prominently display link and how to request paper copy | Bounced/undeliverable return |
| Paperless-billing customer with CCR email consent | Email with direct link or attached CCR (§141.155(a)(1)(iii)) | Email itself is the notification | Bounced email, invalid address |
| Customer with only a postal address | Mailed direct-URL notice (§141.155(a)(1)(ii)) or paper CCR (§141.155(a)(1)(i)) | Yes | Undeliverable return |
| Customer who has explicitly requested paper | Paper CCR by mail (§141.155(a)(1)(i)) | N/A — paper is the delivery | — |
| Non-bill-paying consumers (renters, workers) | "Good-faith effort" mix under §141.155(b): internet posting, public-place notices, social media, community orgs | Not customer-specific | Primacy-agency discretion |
Why 2027 updated electronic delivery rules
The 1998 rule gave primacy agencies discretion to approve alternative delivery methods — email, bill inserts, posting on a website — without prescribing the technical or notification requirements for any of them. EPA's January 2013 memorandum, Safe Drinking Water Act — Consumer Confidence Report Rule Delivery Options, filled some of the interpretive gaps but was explicit that it did "not add to, or replace any existing CCR Rule requirements." That produced two decades of uneven practice: some utilities posted a PDF to an obscure page of their website and considered that compliant; others insisted on certified mail.
EPA's 2024 rulemaking, driven in part by the America's Water Infrastructure Act of 2018 (AWIA) directive to improve CCR communication, replaced the interpretive framework with codified delivery methods in §141.155(a)(1): paper mail, direct-link notification by mail, email with a direct link or electronic copy, and any other direct delivery method approved in writing by the primacy agency. It paired these with a three-year public-access requirement for any CCR posted to a website (§141.155(a)(1)(ii)–(iii) read with §141.155(a)(4)) and a mandatory paper-copy-on-request pathway (§141.155(a)(2)).
The 2027 compliance date is the cutoff. A CCR covering calendar-year 2026 data, delivered by July 1, 2027, is the first report produced under the revised delivery framework. The CCR 2027 deadline calendar covers the full sequence of state-by-state primacy adoption deadlines feeding into this federal compliance date.
Method 1: Direct-URL notification by mail
Direct-URL notification is the headline method most large utilities are migrating to. Under §141.155(a)(1)(ii), a community water system may mail a notification that the CCR is available on a website via a direct link. Combined with the operational requirements in §141.155(a)(3), this means the URL in the notification must land on the CCR document itself — not merely the utility's home page — and the CCR must already be publicly available on the site at the time the notification is sent.
The URL must be a direct link to the CCR. A link to utility.example.gov that requires the customer to find a "reports" menu and click through does not satisfy §141.155(a)(3)(ii), which requires that notifications "prominently display the link and include an explanation of the nature of the link." The URL must also remain stable for the public-access period — a URL that redirects or expires mid-cycle fails §141.155(a)(4)'s three-year requirement.
The notification itself is short — typically a quarter-page or less — but §141.155(a)(2) requires that it "prominently display directions for requesting" a paper copy, because any customer receiving electronic delivery retains the right to request a paper copy at no charge. EPA's 2013 delivery-options memorandum (still referenced on EPA's electronic delivery guidance page) suggests fulfilling paper requests within 14 days is a reasonable expectation, though the rule itself does not set a fixed turnaround.
The CCR must remain publicly accessible for no less than three years from the date of posting (§141.155(a)(4)). Utilities must plan their web-hosting URL scheme to accommodate rolling three-year retention: the 2026-data CCR delivered in July 2027 must remain reachable through at least July 2030. Many utilities are adopting a /ccr/2026/ path scheme (or equivalent by calendar year) rather than a /ccr/current/ scheme, specifically to avoid URL collisions when the next cycle lands.
Primacy agency inspectors commonly verify direct-URL delivery by visiting the URL during the compliance review window. A URL that returns a 404 or redirects away from the CCR document during the three-year public-access window is a §141.155(a)(4) violation regardless of the reason, which means utilities need uptime monitoring on the hosted CCR URLs, not just on the main website.
Method 2: Email with attachment or direct link
Email delivery is a separate codified method under §141.155(a)(1)(iii). A community water system may "email a direct link or electronic version of the report." The email may either attach the CCR PDF directly or contain a direct URL meeting the Method 1 rules, but it may not point the customer to a general website and require navigation to find the report.
Customer consent is the operational constraint for email delivery. While the federal rule text does not use the word "consent," EPA's 2013 delivery-options memorandum — which remains the principal source of interpretive guidance — is clear that a utility must have a valid, working email address and a reasonable basis to believe the customer uses that channel for official communications from the utility. In practice, most primacy agencies treat paperless-billing enrollment, a checkbox on a customer portal that explicitly references CCR delivery, or an affirmative opt-in response as adequate evidence. Utilities should not assume that an email address collected for service initiation alone establishes the right channel for CCR delivery; primacy-agency expectations on this point vary.
Email counts as delivery only when the utility has a documented send record tied to the customer account and a valid delivery address at the time of send. A bounced email does not satisfy the delivery obligation; the utility must re-attempt delivery by another method (paper mailing being the standard fallback) within the compliance window. Most utilities running email delivery integrate bounce detection with their billing system so that a bounce triggers automatic paper fallback for that customer in that cycle.
The federal rule does not require periodic reconfirmation of CCR email delivery eligibility, but several state primacy agencies have recommended or required that utilities re-verify email addresses on a rolling schedule (two to three years is typical). Confirm your primacy agency's position before assuming that a 2024-era paperless-billing enrollment establishes valid CCR e-delivery into 2027 and beyond.
Method 3: Bill inserts (paper CCR or direct-URL notice)
Bill inserts are the traditional hybrid approach: the CCR itself (for short reports) or a direct-URL notice (for longer reports) is physically inserted into the customer's paper water bill. Under §141.155(a)(1)(i), mailing a paper copy of the report satisfies direct delivery; a bill insert containing the paper CCR qualifies. A direct-URL notice inserted into a paper bill qualifies under §141.155(a)(1)(ii) so long as the notice itself meets the prominence requirements of §141.155(a)(3)(ii).
A bill insert counts as delivery only when the customer is on paper billing. A customer enrolled in paperless billing does not receive a physical bill and therefore cannot be reached by a bill insert; that customer must be delivered via email (Method 2) or by a direct-URL notice sent as a separate paper mailing or electronic communication. Utilities running hybrid billing must track which customers are on which channel and deliver the CCR by the appropriate method for each.
Bill inserts containing the full multi-page CCR are impractical for large systems whose reports run to many pages. The standard pattern for large utilities is to insert a one-page direct-URL notice with the link and paper-copy request language, and host the full CCR at the URL. This is consistent with §141.155(a)(1)(ii) and with EPA's electronic delivery guidance.
Bill-insert timing matters. The insert must land in a billing cycle that reaches the customer on or before the July 1 delivery date (§141.155(j)(1)). For a utility with a monthly billing cycle, that typically means inserting into the June bill; for a utility with quarterly billing, it means coordinating with the Q2 cycle. Printer lead times on bill-insert draft lock are typically 10 to 14 days before insertion, which puts the internal CCR draft-lock deadline in mid-to-late May for a June insertion. Systems serving 10,000 or more people must repeat the exercise in the second half of the year for the December 31 biannual delivery under §141.155(j)(2).
Method 4: Direct mail (paper CCR) and "another approved method"
Direct mail — the traditional standalone CCR mailing in an envelope — is the baseline method under §141.155(a)(1)(i) and is required for any customer who falls outside the other methods. Three customer segments typically require direct mail: customers who are not on paper billing and have not consented to email delivery (for example, commercial or multi-unit customers billed by an aggregator), customers who have explicitly requested paper delivery under §141.155(a)(2), and customers for whom the utility has no valid electronic address.
Direct mail uses the traditional USPS delivery route, with the mailing date tied back to the July 1 distribution deadline in §141.155(j)(1). A direct-mail CCR must reach customers on or before July 1, which means the mailing itself typically goes out in the third or fourth week of June to account for USPS standard delivery times. Certified mail is not required for CCR delivery; standard first-class or marketing mail is sufficient provided the utility retains a mailing manifest or equivalent proof of postage.
Section 141.155(a)(1)(iv) also preserves a fourth path: "another direct delivery method approved in writing by the primacy agency." This keeps the door open for newer channels (for example, an authenticated utility mobile app push) so long as the primacy agency accepts them in writing. Do not treat (a)(1)(iv) as a self-service option; the writing requirement is literal.
The how to write a CCR guide covers the content formatting that feeds into whichever delivery method the utility chooses; the content itself is the same across methods.
Primacy agency overlays (NJDEP and others)
Federal §141.155(c) already requires every community water system to submit a copy of the CCR plus a certification that the report has been distributed to customers "no later than 10 days after the date the system is required to distribute the report" — that is, by July 11 for the annual delivery and by the equivalent post-December-31 window for the biannual second delivery. Primacy agencies commonly add state-specific elements on top.
New Jersey's Department of Environmental Protection (NJDEP) Bureau of Safe Drinking Water is a representative example; its implementation is covered in detail in the revised CCR rule 2027 New Jersey guide. New Jersey treats the federal delivery obligation as the floor and commonly layers on: (1) submission of a delivery certification describing the method(s) used, customer counts reached by each, and the URL for any electronic posting; (2) state-specific notice language for direct-URL notifications that references the customer's right to a paper copy and NJDEP contact information in addition to the utility's own; and (3) digital filing via NJDEP's electronic reporting portal, the same system used for other SDWA compliance reporting in New Jersey.
Other primacy agencies (including California, New York, Massachusetts, and Texas) are adopting state-specific variations on a similar pattern: a certification filing on top of the federal one, a state-specific element in the electronic notification, or a digital portal submission. Confirm your primacy agency's specific certification window and notice language before the July 1 delivery date; state windows are not all the same as the federal 10-day rule. The revised CCR rule 2027 summary covers the state-by-state adoption landscape in more detail.
Archive, retention, and verification requirements
Section 141.155 contains two distinct retention requirements that utilities commonly confuse:
- Public website access — three years. Under §141.155(a)(4), any system using a publicly available website to provide reports "must maintain public access to the report for no less than 3 years." A 2026-data CCR posted for July 2027 delivery must therefore remain reachable through at least July 2030. Plan your web-hosting URL scheme accordingly (per-year paths like
/ccr/2026/rather than/ccr/current/). - Utility retention of CCR copies — three years. Under §141.155(h), every community water system "must retain copies of its Consumer Confidence Report for no less than 3 years." This is the utility's own internal archive copy, separate from the public website.
Neither the federal rule nor EPA's 2013 guidance specifies a separate "proof of delivery" retention period. Utilities nonetheless keep proof-of-delivery artifacts — printer insertion records, USPS mailing manifests, email send/bounce logs, and dated snapshots of the hosted CCR page — because §141.155(c) requires them to certify delivery to the primacy agency within 10 days, and inspectors can ask to see supporting records. A common industry practice is to align proof-of-delivery retention with the primacy agency's broader SDWA record-retention schedule rather than with §141.155(h) specifically; confirm the applicable schedule with your primacy agency.
Certification itself is a utility self-attestation. The federal rule requires a certification that "the report(s) has/have been distributed to customers, and that the information is correct and consistent with the compliance monitoring data previously submitted to the primacy agency" (§141.155(c)). Most primacy agencies require a signed certification from a utility officer — typically the water system manager or designated compliance officer. Specific certification windows and forms are state-specific; do not assume the federal 10-day window is the operative deadline without checking the primacy agency's rule package.
The CCR 2027 checklist treats the archive and certification elements as compliance-tracking items so that retention is not deferred to the day the primacy agency asks for records.
What "good-faith effort" looks like
Section 141.155(b) requires community water systems to make a "good faith effort" to reach consumers who do not get water bills — renters, workers, and other non-bill-paying persons served by the system. The rule lists examples: posting on the internet, mailing postcards with links to all service addresses, opt-in email or text systems, advertising in news and social media, publication in local newspapers, posting notices in public places, and delivery to community organizations. EPA's non-exhaustive list is meant to be tailored to the specific non-bill-paying population a utility serves.
The good-faith effort standard is not strict liability, and it is not limited to the 2024 revision — the language has been part of the CCR Rule since 1998 and was retained on May 24, 2024. A documented mix of outreach methods, combined with customer-by-customer delivery records for bill-paying customers, is the evidentiary record a primacy-agency inspector will look for.
In practical operational terms, electronic delivery adds two additional expectations. First, a tracked send: an email send log, mailing manifest, or bill-insert insertion record tied to each customer account. Second, failure detection and fallback: bounce detection for email, undeliverable returns for paper, and URL uptime monitoring for the hosted CCR. A utility that delivers by direct-URL to 99 percent of its customer base and mails paper to the remainder where electronic delivery failed — while documenting the attempt-detect-fallback cycle — has a defensible compliance posture. Utilities running electronic delivery therefore need a customer-by-customer delivery record, not just an aggregate delivery count.
Section 141.155(b)(ii) also includes an explicit caution: where a system is aware of a substantial number of bill-paying consumers without access to electronic forms of the report, the system should use at least one non-electronic form of delivery. This is a direct rule-text reason not to go 100-percent electronic even when it would be operationally convenient.
The how to find your CCR consumer-facing guide complements this: customers who did not receive their CCR by the expected delivery method can locate it at the utility's hosted URL, which reduces the operational burden of chasing individual delivery failures.
FAQ
Can I only use direct-URL notification for 2027?
No. Direct-URL notification is the most efficient electronic method, but a community water system cannot use it alone for 100 percent of its customer base. Section 141.155(a)(2) requires that any customer receiving electronic delivery be able to request a paper copy on demand, and §141.155(b)(ii) cautions against going fully electronic when a substantial share of customers lack electronic access. In practice, utilities use a combination: direct-URL notice for paper-billing customers, email for paperless-billing or email-consenting customers, and paper CCRs mailed to customers who have requested paper or for whom no electronic channel is available. See the small water system CCR compliance guide for smaller utilities weighing the cost-benefit of multi-method delivery.
What counts as a customer opting into email CCR delivery?
The federal rule text does not use the word "consent," but EPA's 2013 delivery-options memorandum and common primacy-agency practice treat an affirmative customer action as the baseline: a checkbox on a customer portal that explicitly references CCR delivery, a signed paperless-billing enrollment that includes CCR language, or an affirmative response to an opt-in communication. What does not qualify on its own: an email address provided at service initiation with no indication it is for CCR delivery, or a customer merely receiving a utility newsletter. Primacy-agency expectations on documentation vary; confirm yours in writing. See the CCR software guide for tracking tooling.
Do I still have to mail paper to some customers?
Yes. Any customer who explicitly requests a paper copy under §141.155(a)(2) must receive one at no charge. Any customer for whom the utility has no paper-billing channel and no valid email opt-in must still be reached by one of the §141.155(a)(1) methods — in practice, mailed paper CCR or mailed direct-URL notice. And §141.155(b)(ii) notes that systems aware of a substantial number of bill-paying consumers without electronic access "should use at least one non-electronic form of delivery."
How long must the hosted CCR remain live?
No less than three years, under §141.155(a)(4). A 2026-data CCR posted for July 2027 delivery must remain publicly accessible through at least July 2030. Utilities should plan URL schemes that accommodate rolling retention — a per-year path like /ccr/2026/ rather than a /ccr/current/ path that gets overwritten each cycle. Separately, §141.155(h) requires the utility to retain its own copy of each CCR for no less than three years.
What does NJDEP require beyond federal?
New Jersey's Bureau of Safe Drinking Water generally layers state-specific elements on top of the federal delivery obligation: a delivery certification describing the method(s) used and customer counts reached by each, state-specific notice language for any electronic notification, and digital submission via NJDEP's electronic reporting portal. The exact certification window and notice template are state-specific and can change between rule cycles — the revised CCR rule 2027 New Jersey guide tracks the current NJDEP operational detail. The CCR requirements 2027 summary covers how the federal requirements sit underneath state overlays. Utilities operating under multiple state primacies should also review the utilities resource hub for cross-state coordination.
Sources
- Code of Federal Regulations, 40 CFR § 141.155 — Report delivery, reporting, and recordkeeping. Accessed 2026-04-18.
- U.S. EPA, "National Primary Drinking Water Regulations: Consumer Confidence Reports" — Final Rule, 89 FR 45980, Federal Register document 2024-10919, docket EPA-HQ-OW-2022-0260, RIN 2040-AG14. Published May 24, 2024; effective June 24, 2024; compliance date January 1, 2027. Accessed 2026-04-18.
- U.S. EPA, How Water Utilities can electronically deliver their CCR (program page linking to the January 2013 delivery-options memorandum). Accessed 2026-04-18.
- U.S. EPA, Safe Drinking Water Act — Consumer Confidence Report Rule Delivery Options (January 2013 memorandum). Accessed 2026-04-18.
- U.S. EPA, Safe Drinking Water Act: Consumer Confidence Reports (CCR) landing page. Accessed 2026-04-18.
- America's Water Infrastructure Act of 2018, Pub. L. 115-270, § 2013 — amending SDWA § 1414(c)(4) regarding CCR communication. Accessed 2026-04-18.