The digital rights group Electronic Frontier Foundation has sued wireless provider AT&T and two aggregators for allegedly disclosing customers' location data.
“AT&T has been selling its customers’ real-time location data to credit agencies, bail bondsmen, and countless other third parties without the required customer consent and without any legal authority,” the EFF alleges in a complaint filed Tuesday in U.S. District Court for the Northern District of California.
The complaint alleges several claims, including violations of the Federal Communications Act. That law requires telecoms and their agents to preserve the confidentiality of “customer proprietary network information” -- meaning that private data carriers obtain “solely by virtue of the carrier-customer relationship.”
“AT&T has breached its duty to protect customers’ [proprietary network information] by knowingly allowing countless third parties access to the location data,” the complaint alleges.
The EFF is seeking an injunction prohibiting AT&T, and the aggregators LocationSmart and Zumigo, from disclosing customers' geolocation data in violation of federal or state law.
The class-action complaint names three California residents as class representatives -- Katherine Scott, Carolyn Jewel and George Pontis.
The lawsuit comes several months after the publication Motherboard reported that some carriers were selling customers' location data to third parties. Motherboard's article detailed how a journalist paid a “bounty hunter” $300 to track a phone's location to a neighborhood in Queens, New York.
The carrier for that phone was T-Mobile, which shared the location data with the aggregator Zumigo, which shared the data with Microbilt. Microbilt then disclosed the information to a bounty hunter, who shared it with a bail industry source, according to the article.
Last year, it also emerged that an aggregator was selling location data obtained from carriers to law enforcement authorities who lacked warrants.
The four major U.S. carriers have said they no longer sell location data. But EFF attorney Aaron Mackey says the organization believes a court order is still necessary.
“There's no definitive proof that unequivocally shows that AT&T has stopped selling this data and that it has taken steps to safeguard its customers data,” he says.
An AT&T spokesperson says the company will fight the lawsuit.
“We only share location data with customer consent,” the spokesperson said. “We stopped sharing location data with aggregators after reports of misuse.”
AT&T, T-Mobile, Verizon and Sprint were hit with separate class-action suits earlier this year over the alleged data transfers. AT&T and T-Mobile have asked for those cases to be sent to arbitration, arguing that the subscriber contracts require arbitration of all disputes. Judges have not yet ruled on those requests.
But the EFF's Mackey notes that California's highest court recently issued a ruling that could hurt AT&T's argument. In 2017, California's Supreme Court ruled against enforcing an arbitration agreement in a case where a consumer sought an injunction.