The Federal Communications Commission (FCC) imposed significant fines worth $200 million on some of the largest wireless carriers in the United States, including Verizon, T-Mobile, Sprint, and AT&T, for unlawfully sharing customers’ location information without consent.
Sprint and T-Mobile, now merged entities, face fines exceeding $12 million and $80 million, respectively. AT&T is penalised with a hefty $57 million fine, while Verizon must pay nearly $47 million.
The FCC’s Enforcement Bureau conducted thorough investigations into these carriers’ practices, revealing a systematic breach of privacy protocols. Each carrier sold access to customer location data to intermediaries known as ‘aggregators,’ who further distributed this sensitive information to third-party location-based service providers.
The fundamental flaw in this process was the absence of valid customer consent, as carriers failed to ensure that downstream recipients obtained proper authorisation.
Moreover, the investigations found that the carriers neglected their duty to protect customer information, as Section 222 of the Communications Act mandates. This regulation requires carriers to implement reasonable measures to safeguard customer data, including location information, and to obtain explicit consent before sharing or allowing access to such data.
By disregarding these obligations, the carriers exposed millions of customers to potential privacy breaches.
The genesis of these fines traces back to public reports alleging the unauthorised disclosure of location information by major wireless carriers to a Missouri Sheriff. This disclosure, facilitated through a ‘location-finding service’ operated by Securus, a communications services provider for correctional facilities, raised serious concerns about privacy violations.
Despite being alerted to these breaches, the carriers persisted in their practices without implementing adequate safeguards to prevent further unauthorised access.
The April FCC’s Forfeiture Orders finalised the Notices of Apparent Liability of 2020. Following a review of submissions made in response to the initial notices, the fines for T-Mobile and Verizon were reduced, while the fine amounts for AT&T and Sprint remained unchanged.
“The protection and use of sensitive personal data such as location information is sacrosanct,” said Loyaan A. Egal, Chief of the FCC Enforcement Bureau and Chair of its Privacy and Data Protection Task Force. “When placed in the wrong hands or used for nefarious purposes, it puts all of us at risk.”
In the News: Memory feature brings personalised interactions to ChatGPT Plus
