Friday, 18 January 2019
Latest news
Main » Telcos promise to stop selling location data, but Congress is not satisfied

Telcos promise to stop selling location data, but Congress is not satisfied

13 January 2019

Motherboard reported that major USA wireless carriers T-Mobile, AT&T and Sprint have been selling the location data of its customers in an unregulated market in which Americans' personal information travels through several layers of third-party entities that buy the location data but are not authorized to handle such information.

'In light of recent reports about the misuse of location services, we have made a decision to eliminate all location aggregation services-even those with clear consumer benefits, ' an AT&T spokesman told PCMag.

Senate Democrats called on federal agencies Wednesday to investigate the practice by major telecommunications companies of selling location data generated by subscribers' mobile devices following an undercover investigation by a security reporter that shed new light on a black market trade. Verizon said in a statement Thursday that it, too, was winding down its four remaining location-sharing agreements, which are all with roadside assistance services - after that, customers would have to give the company permission to share their data with roadside assistance firms.

The sensitive data was available because AT&T, T-Mobile, and Sprint sell the information to third-party "location aggregators". We're ending this location aggregator work the right way - avoiding the impact consumers who use these types of services for things like emergency assistance.

After repeat questions on what that actually meant, a few days later T-Mobile US clarified that it was "winding down our location aggregation agreements".

"The FCC must take immediate action to ensure no wireless carrier is allowing the rampant disclosure of real-time location data, and take enforcement action against carriers that violated the Commission's rules and the trust of their customers", Pallone said. Even if carriers sell the data to legitimate companies for beneficial reasons such as roadside assistance, it only takes a few degrees of separation (the roadside assistance company sells it to someone else, and so on) for the data to end up in the wrong hands.

Sprint said earlier this week that it is "investigating this matter and it would be inappropriate to comment further until that process is complete". As an illustrative example, Joseph Cox of Motherboard managed to track down the real-time location of his friend (who was a willing participant in the experiment) for just $300.

Verizon says that it ended its agreement with Zumigo before the original report came out this week.

T-Mobile told Gizmodo in response to the story that it had "blocked access to device location data for any request submitted by Zumigo". "Stat", Federal Communications Commission member Jessica Rosenworcel wrote on Twitter on Tuesday.

"At least one company, called Microbilt, is selling phone geolocation services with little oversight to a spread of different private industries, ranging from vehicle salesmen and property managers to bail bondsmen and bounty hunters, according to sources familiar with the company's products and company documents obtained by Motherboard", Cox wrote. But they sell access to this information to bail bondsmen (AKA bounty hunters) some of whom will do a location check for money under the table.

LocationSmart, a company that provided geolocation data on almost any phone in the United States was investigated a year ago. On Friday, Sen. Ron Wyden, D-Ore., commended Pallone for "taking this critical first step towards creating real transparency and oversight of wireless carriers that misuse Americans' data". Congress should act on passing comprehensive legislation and empowering specialized agencies like the FCC. The FCC is closed because of the government shutdown.

Telcos promise to stop selling location data, but Congress is not satisfied