• by Wendy Davis  @wendyndavis, February 28, 2020

The Federal Communications Commission has proposed fining the four largest wireless carriers more than $200 million over location privacy lapses, the agency said Friday.

“This FCC will not tolerate phone companies putting Americans’ privacy at risk,” FCC Chairman Ajit Pai stated Friday.

The agency is proposing fines of more than $91 million for T-Mobile, $57 million for AT&T, $48 million for Verizon and $12 million for Sprint.

“The FCC has long had clear rules on the books requiring all phone companies to protect their customers’ personal information,” he stated. “And since 2007, these companies have been on notice that they must take reasonable precautions to safeguard this data and that the FCC will take strong enforcement action if they don’t.”

The four major U.S. carriers have said they no longer sell location data.

The FCC said investigation found that all four carriers sold access to location data to aggregators, which resold it to outside companies.

“Although the carriers had several commonsense options to impose reasonable safeguards (such as verifying consent directly with customers via text message or app), the carriers apparently failed to take the reasonable steps needed to protect customers from unreasonable risk of unauthorized disclosure,” the agency stated. 

Advocacy group Free Press said Friday the proposed fine was too small.

“No amount of money can undo the real-world harm that sharing this information with the likes of criminals and bounty hunters has caused,” policy counsel Gaurav Laroia stated. “Compared to their collective revenues, $207 million is a slap on the wrist amounting to less than one one-thousandth of their annual take. As a fine, it will fail the people these companies harmed and only guarantee that these businesses continue to prioritize their profits over our privacy.”

Senator Ed Markey (D-Massachusetts) also criticized the FCC -- both for moving too slowly, and for not proposing larger fines.

“This compromise of our trust and personal information isn’t just a creepy, abstract privacy risk, it is a direct threat to consumers’ physical safety and well-being,” he stated, referring to the carriers' alleged prior practices. “Instead of meetings its obligation to come down hard on the wireless carriers that are guilty in this case, the FCC dragged its feet and issued penalties that let these companies off easy.”

In addition to the FCC action, AT&T faces a lawsuit by the digital rights group Electronic Frontier Foundation, which claims the telecom violated the Federal Communications Act. That law requires telecoms to preserve confidentiality of “customer proprietary network information” -- including location data they obtain via their role as carriers.

The Electronic Frontier Foundation is seeking a court order prohibiting AT&T from sharing their location data.