FCC Fines Major U.S. Wireless Carriers for Selling Customer Location Data:
The U.S. Federal Communications Commission (FCC) today levied fines totaling nearly $200 million against the four major carriers — including AT&T, Sprint, T-Mobile and Verizon — for illegally sharing access to customers' location information without consent.
The fines mark the culmination of a more than four-year investigation into the actions of the major carriers. In February 2020, the FCC put all four wireless providers on notice that their practices of sharing access to customer location data were likely violating the law.
The FCC said it found the carriers each sold access to its customers' location information to 'aggregators,' who then resold access to the information to third-party location-based service providers.
"In doing so, each carrier attempted to offload its obligations to obtain customer consent onto downstream recipients of location information, which in many instances meant that no valid customer consent was obtained," an FCC statement on the action reads. "This initial failure was compounded when, after becoming aware that their safeguards were ineffective, the carriers continued to sell access to location information without taking reasonable measures to protect it from unauthorized access."
The FCC's findings against AT&T, for example, show that AT&T sold customer location data directly or indirectly to at least 88 third-party entities. The FCC found Verizon sold access to customer location data (indirectly or directly) to 67 third-party entities. Location data for Sprint customers found its way to 86 third-party entities, and to 75 third-parties in the case of T-Mobile customers.
The commission said it took action after Sen. Ron Wyden (D-Ore.) sent a letter to the FCC detailing how a company called Securus Technologies had been selling location data on customers of virtually any major mobile provider to law enforcement officials. (Emphasis added.)
That same month, KrebsOnSecurity broke the news that LocationSmart — a data aggregation firm working with the major wireless carriers — had a free, unsecured demo of its service online that anyone could abuse to find the near-exact location of virtually any mobile phone in North America.
The carriers promised to "wind down" location data sharing agreements with third-party companies. But in 2019, reporting at Vice.com showed that little had changed, detailing how reporters were able to locate a test phone after paying $300 to a bounty hunter who simply bought the data through a little-known third-party service.
Sen. Wyden said no one who signed up for a cell plan thought they were giving permission for their phone company to sell a detailed record of their movements to anyone with a credit card.
"I applaud the FCC for following through on my investigation and holding these companies accountable for putting customers' lives and privacy at risk," Wyden said in a statement today.
The FCC fined Sprint and T-Mobile $12 million and $80 million respectively. AT&T was fined more than $57 million, while Verizon received a $47 million penalty. Still, these fines represent a tiny fraction of each carrier's annual revenues. For example, $47 million is less than one percent of Verizon's total wireless service revenue in 2023, which was nearly $77 billion.
The fine amounts vary because they were calculated based in part on the number of days that the carriers continued sharing customer location data after being notified that doing so was illegal (the agency also considered the number of active third-party location data sharing agreements). The FCC notes that AT&T and Verizon each took more than 320 days from the publication of the Times story to wind down their data sharing agreements; T-Mobile took 275 days; Sprint kept sharing customer location data for 386 days.
Update, 6:25 p.m. ET: Clarified that the FCC launched its investigation at the request of Sen. Wyden.
Related Stories
T-Mobile, Verizon, and AT&T will pay a combined $10.2 million in a settlement with US states that alleged the carriers falsely advertised wireless plans as "unlimited" and phones as "free." The deal was announced yesterday by New York Attorney General Letitia James.
"A multistate investigation found that the companies made false claims in advertisements in New York and across the nation, including misrepresentations about 'unlimited' data plans that were in fact limited and had reduced quality and speed after a certain limit was reached by the user," the announcement said.
T-Mobile and Verizon agreed to pay $4.1 million each while AT&T agreed to pay a little over $2 million. The settlement includes AT&T subsidiary Cricket Wireless and Verizon subsidiary TracFone.
[...]
The carriers denied any illegal conduct despite agreeing to the settlement. In addition to payments to each state, the carriers agreed to changes in their advertising practices. It's unclear whether consumers will get any refunds out of the settlement, however.
[...]
The three carriers agreed that all advertisements to consumers must be "truthful, accurate and non-misleading." They also agreed to the following changes, the NY attorney general's office said:
- "Unlimited" mobile data plans can only be marketed if there are no limits on the quantity of data allowed during a billing cycle.
- Offers to pay for consumers to switch to a different wireless carrier must clearly disclose how much a consumer will be paid, how consumers will be paid, when consumers can expect payment, and any additional requirements consumers have to meet to get paid.
- Offers of "free" wireless devices or services must clearly state everything a consumer must do to receive the "free" devices or services.
- Offers to lease wireless devices must clearly state that the consumer will be entering into a lease agreement.
- All "savings" claims must have a reasonable basis. If a wireless carrier claims that consumers will save using its services compared to another wireless carrier, the claim must be based on similar goods or services or differences must be clearly explained to the consumer.
The advertising restrictions are to be in place for five years.
(Score: 1, Interesting) by Anonymous Coward on Wednesday May 01, @10:11AM (5 children)
Working from home (and semi-retired) I have no need for a cell phone. But I do have a land line, through the cable TV company that is also my ISP (good voice quality and very few dropouts or disconnects).
If I go online to just about any big store (say, Home Depot), it finds my location two towns over (10 miles/16KM from my actual address). First guess is the cable company has some sort of hub or business office there.
Q1. Does anyone bother to sell land line location, similar to cell location in tfa?
Q2. What are the odds that my phone location would be similar to my online location?
(Score: 5, Interesting) by ElizabethGreene on Wednesday May 01, @01:23PM (2 children)
Landline location data for published phone numbers is available in white pages and reverse white pages databases. For unpublished numbers, there is a much smaller market that involves bribery or data theft, and the data is available to LEO/FED too. I've worked with a PI that was able to get the latter. His cost was ~$20 per, iirc. I don't know if he was buying it off a LEO or knew someone at Bellsouth.
Geolocation is fuzzy. If your kit has a GPS chip, like a phone, that's high-quality data and is what T and VZ are selling. Services can also geolocate by looking up the wireless network AP beacon addresses they can "see" in an online database. That's pretty accurate too. Geolocation based on IP address is mid. AFAIK, "phone tower" location data isn't commonly used, but I'm not an expert at that. I know it's used for e.g. missing persons searches, but I don't think it's commonly exposed through geolocation APIs for apps.
(Score: 2) by HiThere on Wednesday May 01, @01:26PM (1 child)
For most purposes, location by triangulation between hotspots is sufficient.
Javascript is what you use to allow unknown third parties to run software you have no idea about on your computer.
(Score: 0) by Anonymous Coward on Thursday May 02, @03:34AM
> ... location by triangulation between hotspots ...
Wooooooosh!
(Score: 3, Interesting) by crm114 on Wednesday May 01, @09:27PM (1 child)
If your landline is from the ISP, then it is VoIP (SIP - RFC3261) which means the call has IP information in it when it is transferred from your ISP to the PSTN carrier. Your ISP's POP (point of presence) for transferring the calls to the PSTN is likely in the zip code Home Depot reports. There are other reasons for getting the geo-location wrong, but that is probably the most obvious.
As mentioned in another comment, there are "white-pages" providers that try. But, as an example, my landline phone with verizon has a monterey bay CA area code and exchange (XXX-YYY-....). I live on the east coast of USA. It is a land line - not a wireless line. With VoIP, it is just like cell phones, but without the triangulation.
I have a similar situation to you. It is fun to see Spectrum move where my cable modem gets its IP address from. I have had the same physical address for 7+ years, but Home Depot, Lowes, Google and Amazon all think I live in a 10mi circle from my actual address. Amazon has gotten better because a real human has to show up, and take a geo-tagged picture of the delivery.
(Score: 0) by Anonymous Coward on Thursday May 02, @03:32AM
Thanks for chiming in with some additional info. My cable company is also Spectrum (TV/Phone/Internet) in the Great Lakes area, but I don't recall the location changing as frequently as you describe in your area. I'll start to pay more attention now!
I don't use Amazon (never started) for "reasons", and the orders I place online mostly come with the US Post Office or UPS/FedEx handling the local delivery. Photos are only starting to be used by some of the couriers.
(Score: 5, Insightful) by ElizabethGreene on Wednesday May 01, @01:13PM (1 child)
The location data market was estimated to be worth 1.2 Billion dollars annually in 2021 (https://themarkup.org/privacy/2021/09/30/theres-a-multibillion-dollar-market-for-your-phones-location-data)
At&t's annual revenue in 2023 was 122 billion (Bloomberg Terminal).
Verizon annual revenue in 2023 was 134 billion (Bloomberg Terminal).
These fines are literally rounding errors to T and VZ. :|
(Score: 0) by Anonymous Coward on Saturday May 04, @01:01AM
They really need to tie fines to a company's revenue.
(Score: 2, Insightful) by Anonymous Coward on Wednesday May 01, @03:18PM
$200 million dollars of fines across four carriers is chump change and just the cost of doing business
(Score: 0) by Anonymous Coward on Wednesday May 01, @08:01PM
It's about time !!