2 carriers set to end data sales to 2 firms
Verizon and AT&T have pledged to stop providing information on phone owners’ locations to data brokers, stepping back from a business practice that has drawn criticism for endangering privacy.
The data apparently have allowed outside companies to pinpoint the location of wireless devices without the owners’ knowledge or consent. Verizon said that about 75 companies have been obtaining its customer data from two little-known California brokers that Verizon supplies directly — LocationSmart and Zumigo.
Verizon became the first major carrier to declare it would end sales of such data to brokers that then provide it to others. It did so in a letter Friday to Sen. Ron Wyden, DOre., who has been probing the phone location-tracking market. AT&T, T-Mobile, and Sprint followed suit Tuesday after The Associated Press reported the Verizon move.
Neither company said it was getting out of the business of selling location data. Verizon and AT&T are the two largest U.S. mobile carriers in terms of subscribers.
Chief privacy officer Karen Zacharia said Verizon
would be careful not to disrupt “beneficial services” such as fraud prevention and emergency roadside assistance. In an email to the AP, AT&T spokesman Jim Greer cited similar reasons for cutting off the intermediaries “as soon as practical.”
Last month, Wyden revealed abuses in the lucrative but loosely regulated field involving Securus Technologies and its affiliate 3C Interactive. Verizon said that contract was approved only for the location tracking of outside mobile phones called by prison inmates.
Verizon notified LocationSmart and Zumigo, both privately held, that it intends to “terminate their ability to access and use our customers’ location data as soon as possible,” Zacharia wrote.
Location data from Verizon and other carriers makes it possible to identify the whereabouts of nearly any phone in the U.S. within seconds. Popular commercial uses for the information include keeping tabs on packages, vehicles and employees; bank-fraud prevention; and targeted marketing offers.
The cutoff won’t affect users’ ability to share locations directly with apps and other services. Rather, it deals with the practice of providing data to third parties with which users have no direct contact.
Wyden wrote all four major U.S. wireless carriers on May 8 after learning about a Web portal that let law officers track Americans’ locations without proper oversight. A former sheriff in Missouri has been accused of using Securus data for unauthorized surveillance of a judge, a sheriff and state highway patrol officers.
Days later, a Carnegie Mellon University security researcher discovered a security flaw in LocationSmart’s website that could have allowed any reasonably sophisticated hacker to secretly track almost any phone in the U.S. or Canada.
Wyden asked the carriers to identify the third parties that have been acquiring carrier location data and to provide details such as any third-party sharing of location data without customer consent. His office shared the companies’ responses with the AP.
None of the four carriers named any third parties, with two exceptions. One was Securus, which all four carriers have since cut off. The other was 3CInteractive, the reseller that supplied Securus.
“Verizon did the responsible thing and promptly announced it was cutting these companies off,” Wyden said in a statement, referring to the aggregators as “shady middlemen.”
“The big concern was that this was probably the tip of the iceberg,” said Laura Moy, deputy director of the Georgetown Center on Privacy and Technology. She said Verizon’s move “indicates that it cannot actually police this process, that it doesn’t have the ability.” Nor can the other carriers, she said.
Verizon and AT&T did not respond to questions from the AP on whether and how they plan to sell location data directly to companies or individuals instead of relying on the two California companies. Sprint and T-Mobile did not immediately respond Tuesday to emailed requests for comment.
AT&T and T-Mobile, No. 2 and 3 in customers, said in letters to Wyden that they allow only authorized third parties to access customer location data if the affected customers have given consent or if it is required by law — for instance, a court order. Verizon said the same.
Sprint said account holders must “generally be notified” if the data is to be used so they can decide whether they consent. T-Mobile has offered to buy Sprint for $26.5 billion.
The carriers left most of Wyden’s questions unanswered — such as how many of their customers had been affected by location sharing they never agreed to.
Information for this article was contributed by Matt O’Brien and Mae Anderson of The Associated Press.