AT&T said Thursday that it will stop selling its customers’ location data to third-party service providers after a report this week said the information was winding up in the wrong hands.
The announcement follows sharp demands by federal lawmakers for an investigation into the alleged misuse of data, which came to light when Motherboard revealed a complex chain of unauthorized information sharing that ended with a bounty hunter successfully tracking down a reporter’s device.
AT&T had already suspended its data-sharing agreements with a number of so-called “location aggregators” last year in light of a congressional probe finding that some of Verizon’s location data was being misused by prison officials to spy on innocent Americans. AT&T also said at the time that it would be maintaining those of its agreements that provided clear consumer benefits, such as location sharing for roadside assistance services.
But AT&T’s announcement Thursday goes much further, pledging to terminate all of the remaining deals it had – even the ones that it said were actively helpful.
“In light of recent reports about the misuse of location services, we have decided to eliminate all location aggregation services – even those with clear consumer benefits,” AT&T said in a statement. “We are immediately eliminating the remaining services and will be done in March.”
In characteristic fashion, T-Mobile CEO John Legere tweeted Tuesday that his firm would be “completely ending location aggregator work” in March. Verizon said in a statement Thursday that it, too, was winding down its four remaining location-sharing agreements, which are all with roadside assistance services – after that, customers would have to give the company permission to share their data with roadside assistance firms. A Sprint spokeswoman didn’t immediately respond to a request for comment.
The announcements reflect a major victory for privacy advocates who have slammed corporate America over its handling of consumers’ personal information, often to their personal and economic expense.
“Carriers are always responsible for who ends up with their customers’ data – it’s not enough to lay the blame for misuse on downstream companies,” said Sen. Ron Wyden (D., Ore.) in a statement. “The time for taking these companies at their word is long past. Congress needs to pass strong legislation to protect Americans’ privacy and finally hold corporations accountable when they put your safety at risk by letting stalkers and criminals track your phone on the dark web.”
Other critics said Americans have an “absolute right” to their privacy of their data.
“I’m extraordinarily troubled by reports of this system of repackaging and reselling location data to unregulated third-party services for potentially nefarious purposes,” Sen. Kamala Harris (D., Calif.) said in a statement after the Motherboard report was published. “If true, this practice represents a legitimate threat to our personal and national security.”
Harris called on the Federal Communications Commission to immediately open an investigation.
Motherboard reported that major U.S. wireless carriers T-Mobile, AT&T, and Sprint have been selling the location data of their customers in an unregulated market in which Americans’ personal information travels through several layers of third-party entities that buy the location data but are not authorized to handle such information.
After the report was released, FCC Commissioner Jessica Rosenworcel said on Twitter, “The @fcc needs to investigate. Stat.” In a subsequent post in which she agreed with Harris and others calling for an investigation, Rosenworcel added: “It shouldn’t be that you pay a few hundred dollars to a bounty hunter and then they can tell you in real time where a phone is within a few hundred meters. That’s not right. This entire ecosystem needs oversight.”
The FCC did not immediately respond to requests for comment; the agency’s operations are limited because of the ongoing government shutdown.
The sharing of the phone location data at the center of the report began at T-Mobile, which shared it with a “location aggregator,” who shared it with a phone location service, which shared it with a bounty hunter, who shared it with a source, who ultimately sent the phone’s location to Motherboard, according to the report.
As Motherboard reported, there are legitimate uses for the sharing of location data, including detecting financial fraud or locating motorists who need roadside assistance. But according to the report, in some cases the sensitive information was resold without authorization for purposes that violated data-sharing policies and without the knowledge of the phone company and its third-party partners.
Wyden has called on the FCC to investigate the relationship between wireless carriers and data brokers. He sees the new report as another urgent motivation for government action, including an investigation by the Federal Trade Commission. “Major carriers pledged to end these practices, but it appears to have been more empty promises to consumers,” Wyden said on Twitter. He said Congress should advance his legislation that would grant the FTC greater authority to safeguard consumer data and fine companies for privacy and security violations.
Sprint said in a statement: “Protecting our customers’ privacy and security is a top priority, and we are transparent about that in our Privacy Policy. We do not knowingly share personally identifiable geolocation information except with customer consent or in response to a lawful request such as a validated court order from law enforcement.”
Responding to the report, AT&T said in a statement: “We only permit sharing of location when a customer gives permission for cases like fraud prevention or emergency roadside assistance, or when required by law. Over the past few months, as we committed to do, we have been shutting down everything else.”
Sen. Mark Warner (D., Va.), who has criticized the privacy practices of Facebook and other companies that collect massive quantities of user data, said the report highlights how customers and policymakers “have been kept in the dark” about the ways personal information is gathered, repackaged and sold.
“Responsible federal agencies and the U.S. Congress should continue to hold hearings to shine a light on these practices, and look at regulations to ensure companies are actually upfront with consumers about whether and how their sensitive data is being used and sold,” Warner said in a statement.