• by Wendy Davis  @wendyndavis, August 12, 2019

A Democratic lawmaker is urging the major wireless carriers to limit the data they retain about customers -- including information about their online browsing, app use and geolocations.

“Your companies collectively hold deeply-sensitive information about hundreds of millions of Americans,” Sen. Ron Wyden (D-Oregon) writes in a letter sent to the CEOs of AT&T, Sprint, T-Mobile and Verizon. “It should come as no surprise that this data is a juicy target for foreign spies. Particularly in this modern era of massive data breaches, it is critical that companies like yours minimize the data you keep.”

Wyden notes in his letter that the Federal Communications Commission requires telecoms to keep records of calls for 18 months. But the lawmaker says there is no reason for the companies to keep other types of data for that long.

“Absent a legal requirement to retain specific records, you should delete records of your customers' historical locations, their web browsing, app usage and their communications as soon as those records are no longer needed to reasonably manage your networks and provide service,” Wyden writes.

He adds that a “reasonable” length of time could be “a few weeks, or even just a couple of days.”

Wyden's letter comes as wireless carriers are facing increasing scrutiny over their privacy practices.

Earlier this year, the publication Motherboard reported that some carriers were selling customers' location data to third parties. Motherboard's article detailed how a journalist paid a “bounty hunter” $300 to track a phone's location to a neighborhood in Queens, New York.

The carrier for that phone was T-Mobile, which shared the location data with the aggregator Zumigo, which shared the data with Microbilt. Microbilt then disclosed the information to a bounty hunter, who shared it with a bail industry source, according to the article.

Last year, it also emerged that an aggregator was selling location data obtained from carriers to law enforcement authorities who lacked warrants.

The four major U.S. carriers have said they no longer sell location data.

Broadband carriers have also made clear they would like to use some of the data mentioned by Wyden -- including information about people's web browsing and app usage -- for ad targeting.

In 2016, the major carriers lobbied heavily against Federal Communications Commission rules that would have required carriers to obtain consumers' opt-in consent before drawing on their web-browsing or app use for ad-targeting purposes. Those rules were repealed by Congress before they took effect.

Wyden is asking the wireless companies to inform him by September 4 of the steps they will take minimize data retention.