FCC fines top US wireless carriers $200 million for selling customer location data

The Federal Communications Commission has slaps the largest US mobile carriers with a collective fine of $200 million for selling access to their customers’ location information without consent. AT&T was ordered to pay $57 million, while Verizon must pay $47 million. Sprint and T-Mobile, meanwhile, face penalties totaling a combined $92 million since the companies merged two years ago. The FCC conducted an extensive investigation into carriers’ unauthorized disclosure and sale of subscribers’ real-time location data after their practices came to light in 2018.

To summarize the practice in the words of FCC Commissioner Jessica Rosenworcel: Carriers sold “real-time location information to data aggregators, allowing this highly sensitive data to fall into the hands of bail bond companies, bounty hunters and other shady actors.” According to the agency, the scheme began to unravel after public reports that a Missouri sheriff had tracked multiple individuals using location information that a company called Securus, which provides communications services to the state’s prisons, received from wireless carriers.

While the carriers eventually shut down, the agency said they continued to operate their programs a year after the practice was disclosed and after they promised the FCC they would stop selling customers’ location data. Furthermore, they proceeded without reasonable safeguards to ensure that legitimate services using their customers’ information, such as roadside assistance and emergency medical services, actually obtained users’ consent to track their locations.

The companies said Fast company that they intend to challenge the fines. T-Mobile, which faces the largest $80 million fine — Sprint was fined $12 million — said it was excessive. AT&T said the ruling lacked “both legal and factual merit” and that the ruling “wrongly penalizes [the companies] to maintain life-saving location services.”