U.S. regulators have proposed fining the four major U.S. phone companies more than $200 million combined for improperly disclosing customers’ real-time location to other companies.
The proposed fines by the Federal Communications Commission amounted to $91 million for T-Mobile, $57 million for AT&T, $48 million for Verizon, and $12 million for Sprint. The amounts vary based on how long each company sold the user data and how many companies and organizations it sold the data to. The phone companies can object, and the amounts could change.
Critics said the FCC took too long, and the proposed fines were too low.
“Instead of meetings its obligation to come down hard on the wireless carriers that are guilty in this case, the FCC dragged its feet and issued penalties that let these companies off easy,” said Sen. Edward Markey (D-Mass.).
Lisa Hayes of the advocacy group Center for Democracy & Technology said the FCC’s “weak enforcement response” demonstrate why the United States needs a comprehensive privacy law.
Location data makes it possible to identify the whereabouts of nearly any phone in the United States within seconds.
According to published reports, phone companies were selling access to such data to little-known companies such as LocationSmart and Zumigo. These data brokers then sold the information to other “location-based” services, like prison-communications company Securus. The FCC said the phone companies failed to ask customers for consent for what companies like Securus were doing, or make sure that those companies were getting an OK from customers.
The FCC action deals with phone companies’ practice of providing data to third parties with whom users have no direct contact. It’s unrelated to users sharing locations directly with apps and other services.
Federal law requires that telecommunications companies protect the confidentiality of some customer data, including location information. The FCC said that those companies must try to protect against unauthorized attempts to gain access to this data and that they or those acting on their behalf must get consent from customers before using it.
The FCC opened its investigation after a 2018 report showed Securus allowing such abuses as letting a sheriff track a judge and others, thanks to information that ultimately came from data broker LocationSmart.
Verizon, AT&T, Sprint, and T-Mobile pledged to stop providing information on U.S. phone owners’ locations to LocationSmart, Zumigo, and other data brokers later that year. But Congress questioned in early 2019 why sharing by some carriers seemed to have continued, as detailed in a Motherboard report about bounty hunters gaining access to the data in January 2019.
AT&T and T-Mobile said then that they would stop selling all location data from mobile phones to brokers by March 2019.
T-Mobile says it took “quick action” after it learned its location-data program was being abused and ended the program in February 2019. The company said it plans to dispute the FCC’s conclusions and fines.
The other phone companies didn’t immediately return calls for comment.
By Tali Arbel
