Telecoms Fined For Sharing Data Without Consent

The Federal Communications Commission has fined T-Mobile, Verizon, and AT&T $196 million collectively for sharing data without consent, including access to customers’ location data. The Record reports that the action, announced on April 29, finalizes a 2020 “notice of apparent liability” the FCC issued against the telecoms.

“Each carrier attempted to offload its obligations to obtain customer consent onto downstream recipients of location information, which in many instances meant that no valid customer consent was obtained,” the FCC said in a press release.

The wireless companies sold location data to “aggregators,” who resold it to third-party data brokers, according to the FCC, which accused the companies of failing to take “reasonable measures” to safeguard customers’ location information so it wouldn’t be disclosed without their authorization, a violation of section 222 of the federal Communications Act.

The Record notes that “privacy hawk” Sen. Ron Wyden, Oregon, discovered the violations in 2018. His staff discovered that a government contractor who bought the data created a “self-service website” that allowed government officials to obtain the location data of any phone in the U.S. without a court order. It was misused multiple times to track everyone from judges to spouses and love interests. Bounty hunters also obtained the location information from data brokers.

An AT&T statement said the “FCC order lacks both legal and factual merit,” and unfairly holds the company responsible for another company’s violation of its contractual requirements to obtain consent. 

A Verizon statement said that the FCC got its facts wrong and it intends to appeal. It noted that it “proactively cut off a fraudster, shut down the program, and worked to ensure this couldn’t happen again,” upon discovering that a bad actor gained unauthorized access to information relating to a small number of customers. 

T-Mobile also intends to challenge the decision.