"US fines telcos $200M for sharing customer location data without consent", 30 April 2024

The U.S. Federal Communications Commission said... that it is fining the four U.S. major wireless carriers around $200 million in total for “illegally” sharing and selling customers’ real-time location data without their consent.

AT&T’s fine is more than $57 million, Verizon’s is almost $47 million, T-Mobile’s is more than $80 million and Sprint’s is more than $12 million, according to the FCC’s announcement.

“Our communications providers have access to some of the most sensitive information about us. These carriers failed to protect the information entrusted to them. Here, we are talking about some of the most sensitive data in their possession: customers’ real-time location information, revealing where they go and who they are,” FCC Chairwoman Jessica Rosenworcel said in the announcement.

The FCC said its investigative arm, the Enforcement Bureau, concluded that the four companies sold access to its customers’ location data to third-party companies, which the FCC called “aggregators,” which in turn resold the location data to other companies. These series of sales and resales effectively created a whole gray market for cell phone subscribers’ historical and real-time location data. Most customers had no idea such a market for their data even existed, let alone consented to the sale of their data.

Cell phone carriers are required by law to “maintain the confidentiality of such customer information and to obtain affirmative, express customer consent before using, disclosing, or allowing access to such information,” the FCC wrote.

The fines come years after investigations by news organizations revealed that the four carriers were sharing this type of data with law enforcement and bounty hunters, among other organizations.

The FCC wrote that despite these public reports, the four carriers failed to put safeguards in place “to ensure that the dozens of location-based service providers with access to their customers’ location information were actually obtaining customer consent,” and kept selling the data.

All four carriers criticized the decision and said they intend to appeal it.

T-Mobile spokesperson Tara Darrow said in a statement that “this industry-wide third-party aggregator location-based services program was discontinued more than five years ago after we took steps to ensure that critical services like roadside assistance, fraud protection and emergency response would not be disrupted.”

Darrow said that T-Mobile, which merged with Sprint in 2020, will appeal the decision.

AT&T spokesperson Alex Byers also said the company will appeal, and said that the FCC decision “lacks both legal and factual merit.”

Verizon spokesperson Rich Young said that the “FCC’s order gets it wrong on both the facts and the law, and we plan to appeal this decision.”