April 29 (UPI) — Four of the nation’s largest wireless carriers have each been fined tens of millions of dollars for illegally sharing information about their customers’ locations, the Biden administration announced Monday.
The fines against AT&T, Sprint, T-Mobile and Verizon, in total amounting to nearly $200 million, were levied after an investigation found they had sold access to their customers’ location information to third-party aggregators and location-based service providers, the Federal Communications Commission said in a statement.
Under the penalties, Sprint and T-Mobile — which have merged since the investigation began — face fines of more than $12 million and $80 million, respectively, while AT&T was penalized more than $57 million and Verizon slapped with a fine of nearly $47 million.
“Our communications providers have access to some of the most sensitive information about us. These carriers failed to protect the information entrusted to them,” said FCC Chairwoman Jessica Rosenworcel.
“Here, we are talking about some of the most sensitive data in their possession: customers’ real-time location information, revealing where they go and who they are. As we resolve these cases — which were first proposed by the last administration — the Commission remains committed to holding all carriers accountable and making sure they fulfill their obligations to their customers as stewards of this most private data,” she said.
The agency asserted the carriers sold access to their customers’ location information to “aggregators,” who in turn re-sold that access to third-party, location-based service providers, thus allegedly attempting to “offload” their legal obligations requiring consent onto “downstream recipients.”
The FCC said the probe began when members of the public reported that their location information was being disclosed without consent to a Missouri sheriff through a location-finding service operated by Securus, a provider of communications services to correctional facilities.
Despite warnings that the practice was illegal under Section 222 of the Communications Act requiring carriers to take “reasonable measures” to protect customers’ location information, “all four carriers continued to operate their programs without putting in place reasonable safeguards to ensure that the dozens of location-based service providers with access to their customers’ location information were actually obtaining customer consent,” the FCC said.
The wireless providers disputed the fines in statements issued Monday.
The decision “is wrong and the fine is excessive. We intend to challenge it,” T-Mobile said in a statement issued to media outlets, adding that the “industry-wide, third-party aggregator, location-based services program was discontinued more than five years ago.”
“The FCC order lacks both legal and factual merit,” an AT&T spokesperson said in a statement to CNN, saying it “unfairly holds us responsible for another company’s violation of our contractual requirements to obtain consent and ignores the immediate steps we took to address that company’s failures.”
“When one bad actor gained unauthorized access to information relating to a very small number of customers, we quickly and proactively cut off the fraudster, shut down the program, and worked to ensure this couldn’t happen again,” Verizon spokesman Rich Young told USA Today. “Unfortunately, the FCC’s order gets it wrong on both the facts and the law.”
The two Republican members of the five-member commission also disagreed with the decision to institute the fines.
“There is no valid basis for the arbitrary and capricious finding,” FCC member Nathan Simington wrote in a dissenting opinion, contending the methodology used to arrive at the hefty fines was flawed and against FCC precedent.
