The Federal Communications Commission has fined wireless carriers almost $200 million for illegally selling real-time location data about their customers, the latest chapter in an investigation that started so long ago that one of these carriers no longer exists.
The penalties announced Monday—$80.1 million from T-Mobile, $57.3 million from AT&T, $46.9 million from Verizon, and $12.2 million from Sprint—are a slight reduction from the fines the FCC announced in February 2020. Since T-Mobile completed its purchase of Sprint that year, the now-defunct carrier’s fine goes on its tab.
The 2020 announcement came more than 1.5 years after Sen. Ron Wyden (D-Ore.) asked the FCC to investigate sales of real-time location data by US carriers to a data broker, Securus Technologies, which offered this information to government officials for "nothing more than the legal equivalent of a pinky promise," Wyden said.
Days after the Wyden letter, the New York Times reported that a Missouri sheriff had used this location information to track people without a warrant. A January 2019 Vice report then found some of these intermediaries also sold this data to bounty hunters and other private parties.
The carriers pledged to stop this resale, but the FCC found that their action violated Section 222 of the Communications Act, which requires carriers to protect “customer proprietary network information" (not providing it to random other companies without customers’ permission).
In a statement this week, FCC Chair Jessica Rosenworcel denounced the carrier’s stewardship of this information. "In the wrong hands, it can provide those who wish to do us harm the ability to locate us with pinpoint accuracy,” she said. “That is exactly what happened when news reports revealed that the largest wireless carriers in the country were selling our real-time location information to data aggregators, allowing this highly sensitive data to wind up in the hands of bail-bond companies, bounty hunters, and other shady actors.”
AT&T argues that the "FCC order lacks both legal and factual merit. It unfairly holds us responsible for another company’s violation of our contractual requirements to obtain consent, ignores the immediate steps we took to address that company’s failures, and perversely punishes us for supporting life-saving location services like emergency medical alerts and roadside assistance that the FCC itself previously encouraged."
AT&T says it will likely appeal the order "after conducting a legal review.”
The FCC has paid increasing attention to privacy issues under Rosenworcel. In August 2022, she asked the big three carriers to document their retention policies for cell-site location information, which did not require a warrant for law-enforcement inspection prior to a 2018 Supreme Court ruling. Verizon reported a retention period of one year for this location data, T-Mobile “up to 24 months” and AT&T five years.
In February, the FCC moved to start writing rules to prevent the abuse of connected-car features by stalkers. And the FCC’s vote last week to reinstate net-neutrality rules for internet providers followed arguments by Rosenworcel that these regulations would allow the commission to enforce privacy standards on ISPs. The FCC had sworn off this regulatory ambition in March 2017 after the commission flipped from a Democratic to a Republican majority following President Trump’s inauguration.
Sen. Wyden endorsed the FCC's enforcement action. "No one who signed up for a cell plan thought they were giving permission for their phone company to sell a detailed record of their movements to anyone with a credit card,” he said in a statement emailed by his office. “I applaud the FCC for following through on my investigation and holding these companies accountable for putting customers’ lives and privacy at risk.”
In April 2021, Sen. Wyden introduced a bill, The First Amendment Is Not For Sale Act, to ban law enforcement agencies from buying customer data from third parties; two weeks ago, the House passed a version of the bill in a 219-199 vote.
But while almost $200 million in fines for carrier misconduct may represent a sum that GOP Commissioner Brendan Carr called “eye-popping” in a statement that argued the Federal Trade Commission should have fielded this case, the big three carriers should feel no pain paying them after their latest quarterly-earnings reports. Verizon reported $4.7 billion in first-quarter net income on April 22, AT&T reported $3.8 billion in Q1 profit April 24, and T-Mobile followed by $2.4 billion in first-quarter profit on April 25.
Editors' Note: This story was updated with comment from AT&T.