• by Wendy Davis  @wendyndavis, September 30, 2024

AT&T's $57 million privacy fine for allegedly disclosing customers' locations should remain in place, the Federal Communications Commission argues in new court papers.

“For years, AT&T sold the location of its wireless customers to its business partners with no way of verifying that the information was being used for a legitimate purpose or that the customers had consented to sharing it,” the agency argues in papers filed Friday with the 5th Circuit Court of Appeals. “This system-wide vulnerability endangered the privacy, and safety, of millions of the company’s customers.”

The agency's argument comes in a battle that began in 2020, when the FCC proposed fining AT&T, Verizon and T-Mobile for allegedly sharing customers' location data with third parties.

The FCC specifically alleged in a “notice of apparent liability” that the carriers sold access to geolocation data to aggregators that resold the information to outside companies. The FCC issued the notice around one year after Vice Media's Motherboard reported that a journalist had been able to pay a “bounty hunter” $300 to track a phone's location to a neighborhood in Queens, New York.

Earlier this year, the FCC followed through on the notice of apparent liability and fined AT&T around $57 million, Verizon around $47 million, and T-Mobile $92 million (including $12 million for Sprint, which merged with T-Mobile in 2020).

The agency voted 3-2 to impose the fines, with Republican commissioners Brendan Carr and Nathan Simington dissenting.

The carriers -- which say they no longer sell location data -- paid the fines under protest and are now appealing to separate federal circuit courts. (AT&T appealed to the 5th Circuit, Verizon filed its appeal with the 2nd Circuit, and T-Mobile appealed to the District of Columbia Circuit.)

AT&T argued in papers filed in July that the sanction should be vacated for several reasons, including that the FCC imposed the fine without proving the allegations at a jury trial.

AT&T also contends the agency lacked authority to issue fines because the location data at issue wasn't tied solely to voice services, like telephone calls. Instead, the location information was tied to non-voice location-based services such as the Life Alert program, which sends medical help to people, or roadside assistance company AAA.

AT&T said the difference between “call information” and location information that isn't derived from phone calls is critical, arguing that the FCC is only authorized to police the confidentiality of “call information.”

The FCC is now asking the 5th Circuit to reject those arguments for numerous reasons.

Among other contentions, the agency says AT&T would have been entitled to a jury trial if it had requested one before paying the fine.

“AT&T simply chose to dispense with that opportunity and instead opted to pay the forfeiture at once and to seek relief in this court,” the agency argues.

The FCC also says it has the authority to police the privacy of location data tied to a broader range of services than phone calls.

AT&T's argument to the contrary “ignores the undisputed fact that a cellphone constantly shares its location with a carrier, even when it is idle,” the FCC contends.

The agency adds: “AT&T points to no way of disaggregating location data particular to voice services from those relating to non-voice services, nor any distinguishing characteristic of such voice location data.”

The 5th Circuit hasn't yet scheduled a date for oral arguments.