Who has your location data?
After outcry over privacy, phone carriers say they’ll stop selling location info
After allegations of misuse of data sold to third parties, cellphone carriers are dropping data-sharing deals.
Major cellphone carriers have been selling real-time data about their customers’ locations, and that information has been ending up in the wrong hands, a report said this week — leading lawmakers to sharply demand an investigation and several carriers to say they are distancing themselves from the practice.
The alleged misuse of data came to light when tech site Motherboard revealed a complex chain of unauthorized information sharing that ended with a bounty hunter tracking down a reporter’s device.
On Thursday, AT&T said it will stop selling its customers’ location data to thirdparty service providers.
The company had already suspended its datasharing agreements with a number of “location aggregators” last year in light of a congressional investigation finding that prison officials were misusing some of Verizon’s location data to spy on innocent Americans. AT&T also said at the time that it would maintain those of its agreements that provided clear consumer benefits, such as location sharing for roadside assistance services.
AT&T’s Thursday announcement went much further. The company pledged to terminate all the remaining deals it had.
“In light of recent reports about the misuse of location services, we have decided to eliminate all location aggregation services — even those with clear consumer benefits,” AT&T said in a statement. “We are immediately eliminating the remaining services and will be done in March.”
T-Mobile Chief Executive John Legere tweeted Tuesday that his firm would be “completely ending location aggregator work” in March.
Verizon said Thursday that it too was winding down its four remaining locationsharing agreements, which are all with roadside assistance services. After that, customers could choose whether to give Verizon permission to share their data with those services.
A Sprint spokeswoman didn’t immediately respond to a request for comment.
The announcements reflect a major victory for privacy advocates who have criticized corporate America over its handling of consumers’ personal information.
“Carriers are always responsible for who ends up with their customers’ data — it’s not enough to lay the blame for misuse on downstream companies,” Sen. Ron Wyden (D-Ore.) said in a statement. “The time for taking these companies at their word is long past. Congress needs to pass strong legislation to protect Americans’ privacy and finally hold corporations accountable when they put your safety at risk by letting stalkers and criminals track your phone on the dark web.”
Others said Americans have an “absolute right” to the privacy of their data.
“I’m extraordinarily troubled by reports of this system of repackaging and reselling location data to unregulated third-party services for potentially nefarious purposes,” Sen. Kamala Harris (D-Calif.) said in a statement after the Motherboard report was published. “If true, this practice represents a legitimate threat to our personal and national security.”
Harris called on the Federal Communications Commission to immediately open an investigation.
Rep. Frank Pallone Jr. (D-N.J.), chairman of the House Committee on Energy and Commerce, requested Friday that FCC Chairman Ajit Pai provide an emergency briefing on the topic.
Motherboard reported Tuesday that major U.S. wireless carriers T-Mobile, AT&T and Sprint have been selling their customers’ location data in an unregulated market in which Americans’ personal information travels through several layers of third-party entities that buy the location data but are not authorized to handle such information.
After the report was released, FCC Commissioner Jessica Rosenworcel said on Twitter, “The @fcc needs to investigate. Stat.” In a subsequent post, she added: “It shouldn’t be that you pay a few hundred dollars to a bounty hunter and then they can tell you in real time where a phone is within a few hundred meters. That’s not right. This entire ecosystem needs oversight.”
The FCC did not immediately respond to requests for comment. The agency’s operations are limited because of the partial shutdown of the federal government.
The sharing of the phone location data at the center of the report began at TMobile, which shared it with a “location aggregator,” who shared it with a phone location service, which shared it with a bounty hunter, who shared it with a source, who ultimately told the phone’s location to Motherboard, according to the report.
As Motherboard reported, there are legitimate uses for the sharing of location data, including detecting financial fraud or locating motorists who need roadside assistance. But according to the report, in some cases, the sensitive information was resold without authorization for purposes that violated datasharing policies and without the knowledge of the phone company and its third-party partners.
Wyden has called on the FCC to investigate the relationship between wireless carriers and data brokers. He sees the new report as another urgent motivation for government action, including an investigation by the Federal Trade Commission.
“Major carriers pledged to end these practices, but it appears to have been more empty promises to consumers,” Wyden said on Twitter. He said Congress should advance his legislation that would grant the FTC greater authority to safeguard consumer data and fine companies for privacy and security violations.
Sprint said in a statement: “Protecting our customers’ privacy and security is a top priority, and we are transparent about that in our Privacy Policy. We do not knowingly share personally identifiable geolocation information except with customer consent or in response to a lawful request such as a validated court order from law enforcement.”
Responding to the report, AT&T said in a statement: “We only permit sharing of location when a customer gives permission for cases like fraud prevention or emergency roadside assistance, or when required by law. Over the past few months, as we committed to do, we have been shutting down everything else.”
Sen. Mark Warner (DVa.), who has criticized the privacy practices of Facebook and other companies that collect massive quantities of user data, said the report highlights how customers and policymakers “have been kept in the dark” about the ways personal information is gathered, repackaged and sold.
“Responsible federal agencies and the U.S. Congress should continue to hold hearings to shine a light on these practices, and look at regulations to ensure companies are actually upfront with consumers,” Warner said in a statement.