Mikey Campbell
Major U.S. cellular carriers recently confirmed to the Federal Communications Commission that they have, for the most part, stopped selling customer geolocation data to third-party aggregators, a questionable practice first discovered a year ago.
On Thursday, FCC Commissioner Jessica Rosenworcel issued a statement on an ongoing investigation into the sale of real-time geolocation data by AT&T, Sprint, T-Mobile and Verizon, calling out both the companies and the commission for a lack of transparency on the matter, reports TechCrunch.
"The FCC has been totally silent about press reports that for a few hundred dollars shady middlemen can sell your location within a few hundred meters based on your wireless phone data," she wrote. "That's unacceptable."
Last year, reports from various media outlets detailed a concerning industry-wide trend that saw telecoms profiting from the sale of subscriber location data to aggregation firms. The third parties acted as middlemen, selling the acquired information to a range of buyers, including tracking services, without consent from users or originating carriers.
For example, a report from The New York Times published in May 2018 found law enforcement officers leveraging a location tracking tool from Securus Technologies to target suspects, effectively bypassing the legal warrant process. Other reports, like an expose from Motherboard, saw customer data purchased and used by bounty hunters.
Pressured by calls to action from the public, including a recent class action lawsuit, and lawmakers like Sen. Ron Wyden, the carriers on multiple occasions vowed to end geolocation data sales.
Little has been heard from the companies beyond assurances that the controversial programs would soon come to an end.
With that as a backdrop, Rosenworcel in early May sent letters to the carriers requesting a status update on their respective location based services policies. The commissioner subsequently published letters of response (PDF link) as an attachment to her statement on Thursday.
AT&T in June 2018 said it would be "phasing out" the provision of LBS information to aggregators, though it appears that initiative began earnest when the company "accelerated" its efforts in January 2019.
"As of March 29, 2019, AT&T stopped sharing any AT&T customer location data with location aggregators and LBS providers," AT&T said.
Sprint notes a similar drawdown due for completion on May 31, 2019, with two exceptions. LBS data will continue to be doled out to a provider of roadside assistance for Sprint customers and a provider that "facilitates compliance with state requirements for a lottery that funds state government."
T-Mobile ceased all service provider access to location data in Feb. 2, 2019, and terminated LBS contracts with location aggregators on March 9, 2019. Like AT&T, T-Mobile phased out the program over a period of months, meeting a deadline promised by CEO John Legere in January.
Verizon was the quickest to act and cut ties with location aggregators in November 2018 after committing to halt the program in June of that year. The company continued to provide data to four roadside assistance firms, but those agreements expired at the end of March 2019.
As noted by TechCrunch, each of the four carriers attempted to distance themselves from any wrongdoing, saying the respective programs were in place as benefits to customers. How said location data would be managed and protected after it left carrier hands was left unmentioned, implying the onus was on third-party aggregators.
In any case, it appears the controversial LBS programs are, for the most part, a thing of the past. At least for now.
William Gallagher
Christine McKee
AppleInsider Staff
Chip Loder
Malcolm Owen
4 Comments
[yells loudly] WE STOPPED DOING THAT!! WE NO LONGER DOING THAT!!
- US telecoms
[whispers furtively] we're doing something else now.
- same US telecoms
They may have stopped selling your location data, but the SS7 protocol makes your cellphone's location public to anyone connected to the SS7 network. I explained it in detail in a previous story on this topic so I won't repeat it here. And even if you aren't connected to the SS7 network, there are web portals which let you pay to track a specific phone's location. All you need is the number of the phone and some money to pay for the location data. And even when I make this point, it seems that not a single reader is able or willing to learn this, so I'm exasperated explaining it. In a similar way I see so many people upset about their own government installing trap doors in products, but not quite as many of them are worried about foreign-made products made in hostile nations spying on them.
22july2013: the problem here wasn't so much that your location data was being accessed by third parties, it was a problem of disclosure and compensation. If my location data is valuable (and it apparently is), I want a) to know every company or individual that is accessing it, and what for, and b) what's my cut of the money paid for that.
AT&T, who you can always count on to say the scummiest things about being made to do the right thing, protested that selling real-time location data wasn't illegal. They're right, but the lack of consent and transparency is the problem here.