On Monday, the Federal Communications Commission (FCC) announced that it is fining the top four mobile carriers in the U.S. for illegally sharing access to the location data of their customers without consent. In a press release, the FCC claimed that the carriers failed to protect the highly sensitive information that their customers entrusted to them.
Specifically, the FCC claims that Verizon, AT&T, T-Mobile, and Sprint (prior to the merger of the latter two) sold access to customers’ location data to aggregators. They then turned around and sold the data they acquired to third-party location-based service providers.
Not only did customers not consent to their data being sold multiple times, but the carriers also continued to sell the location data after being made aware that their safeguards weren’t enough to protect that data. By law, “carriers are required to take reasonable measures to protect certain customer information, including location information,” the FCC explains. That’s not truly possible when the information is repeatedly changing hands.
As a result, the FCC is handing down massive fines. T-Mobile received the heaviest fine at $80 million. Sprint – which merged with T-Mobile during the investigation – is being fined $12 million. AT&T and Verizon face fines of $57 million and $47 million, respectively.
“The protection and use of sensitive personal data such as location information is sacrosanct,” said Loyaan A. Egal, Chief of the FCC Enforcement Bureau and Chair of its Privacy and Data Protection Task Force. “When placed in the wrong hands or used for nefarious purposes, it puts all of us at risk. Foreign adversaries and cybercriminals have prioritized getting their hands on this information, and that is why ensuring service providers have reasonable protections in place to safeguard customer location data and valid consent for its use is of the highest priority for the Enforcement Bureau.”
Verizon, AT&T, and T-Mobile all plan to appeal the ruling, USA Today reports.