What Does the Code Say About an Old House With Ungrounded Outlets?
Section 406.4(D)(2) gives you exactly three compliant options when you replace a receptacle in a box where no equipment grounding conductor exists. You are not required to rewire the circuit, and you are not permitted to simply install a three prong receptacle and leave the ground terminal floating.
The three permitted options
Option one under 406.4(D)(2)(a) is a non grounding type receptacle. You replace like with like, installing another two prong receptacle. This is legal, it is the cheapest path, and it is the honest one because it does not offer the user a grounding pin that goes nowhere.
Option two under 406.4(D)(2)(b) is a ground fault circuit interrupter type receptacle. The GFCI is installed in the box with no equipment grounding conductor connected, and it must be marked with the label No Equipment Ground that comes in the package. The GFCI still works without a ground, because it compares current on the ungrounded and grounded conductors and does not reference earth.
Option three under 406.4(D)(2)(c) is a grounding type receptacle supplied through a GFCI. The upstream device can be a GFCI receptacle in the same circuit or a GFCI breaker at the panel. The downstream grounding type receptacles must be marked both GFCI Protected and No Equipment Ground.
What you cannot do
You cannot bond the neutral to the ground screw at the receptacle. That was permitted decades ago and has been prohibited for a long time, because it puts normal neutral current on the equipment grounding path and energizes the frame of every connected appliance if the neutral opens upstream. Section 250.24(A)(5) and 250.142(B) prohibit it.
You also cannot run a ground wire to a nearby water pipe and call it done. Section 250.130(C) does permit extending an equipment grounding conductor for a replacement receptacle to specific points: any accessible point on the grounding electrode system, any accessible point on the grounding electrode conductor, the equipment grounding terminal bar within the enclosure where the branch circuit originates, or for existing branch circuits, the grounded conductor at the service. A random cold water pipe in the middle of a house is not on that list, especially given plastic repairs cut into copper systems everywhere.
Practical guidance
The most common approach is a single GFCI receptacle at the first outlet on the circuit, with grounding type receptacles downstream labeled per 406.4(D)(2)(c). One device protects the whole run and the homeowner gets usable three prong outlets. A GFCI breaker at the panel does the same job in one place and is often easier when the first outlet in the circuit cannot be identified with confidence.
Two cautions. First, GFCI protection is shock protection, not equipment protection. Surge protective devices and electronics that rely on a real ground reference will not perform as designed on an ungrounded circuit no matter what receptacle is installed. Tell the customer that in writing.
Second, check whether the box itself is grounded. In many older homes wired in armored cable or metal conduit, the metal raceway is a legitimate equipment grounding conductor under 250.118, and the box is already grounded. Test with a receptacle tester and then verify with a meter from hot to the box, because in that case you can simply install a grounding type receptacle with a bonding jumper to the box per 250.146.