Top wireless network operators in the US -- Verizon, AT&T, T-Mobile and Sprint -- told the FCC that they have mostly discontinued the sale of customer location data to third parties and aggregators, like providers of roadside assistance, call routing and fraud prevention.
The operators detailed their actions in letters to FCC Commissioner Jessica Rosenworcel, who questioned the operators about the issue earlier this month. However, it's unclear whether this represents the end of the issue or if it will continue to dog the wireless industry.
Operators' sale of customers' location information first blasted into light last year, when The New York Times wrote that Securus Technologies had been selling or giving away location data to a sheriff's office in Mississippi County, Mo., without a court order or any kind of authorization.
Then, earlier this year, Brian Krebs and ZDNet reported that a hack into the website of a company called LocationSmart allowed anyone to obtain real-time location information for any mobile device from AT&T, Verizon, T-Mobile and Sprint.
The situation then bloomed into a full-blown public-relations disaster for the industry after an investigative report from Motherboard found that LocationSmart was selling data from T-Mobile, AT&T and Sprint to a company called CerCareOne, which was then selling that data to bounty hunters and bail bondsmen.
That report was the final straw for Rosenworcel, a Democratic commissioner on the Republican-led FCC who has been critical of many of the agency's actions.
"The FCC has been totally silent about press reports that for a few hundred dollars shady middlemen can sell your location within a few hundred meters based on your wireless phone data. That's unacceptable," she said in a statement today. "I don't recall consenting to this surveillance when I signed up for wireless service -- and I bet neither do you. This is an issue that affects the privacy and security of every American with a wireless phone. It is chilling to think what a black market for this data could mean in the hands of criminals, stalkers, and those who wish to do us harm. I will continue to press this agency to make public what it knows about what happened. But I do not believe consumers should be kept in the dark. That is why I am making these letters available."
Below is a condensed version of what the operators said in their responses to Rosenworcel's queries. The operators' full responses can be viewed here.
- Sold customers' location data to aggregators LocationSmart and Zumigo, but decided in June 2018 (shortly after the NYT story on Securus) to stop doing so.
- Fully terminated its contract with Zumigo and mostly ended its contract with LocationSmart in November 2018.
- Fully terminated its contract with LocationSmart in March 2019 after supporting roadside assistance services for four unnamed companies during the winter "for public safety reasons."
- Sold customer information to unnamed aggregators but decided to stop doing so in June 2018, though "we made an exception for use cases involving emergency services and fraud prevention."
- AT&T decided in January 2019 to "accelerate our phase-out of these services."
- As of March 29, 2019, AT&T said it no longer sells customer location data to location aggregators or location-based services (LBS) providers.
- T-Mobile's two "location aggregators" were LocationSmart and Zumigo.
- After the Securus incident, T-Mobile evaluated its sale of customers' location data, and ultimately decided to end the program. T-Mobile alerted its location aggregators in October 2018 of its decision.
- T-Mobile terminated "all LBS provider access to location data" on Feb. 8, 2019, and ended its contracts with the location aggregators on March 9, 2019.
- Sprint said it is "currently only using one location aggregator to provide LBS to two customers with a public interest -- a provider of roadside assistance for Sprint customers, and a provider that facilitates compliance with state requirements for a lottery that funds state government. As of May 31, 2019, Sprint will no longer contract with any location aggregators to provide LBS. Sprint anticipates that after May 31, 2019, it may provide LBS services directly to customers like those described above, but there are no firm plans at this time."
Representatives from LocationSmart and Zumigo did not immediately respond to questions on the topic.