AT&T, Verizon to limit sales of phone location data to third parties


But the company will not stop sharing that data entirely, the Associated Press reported.

AT&T for example fed Wyden the same line [PDF] that "despite AT&T's requirements to obtain customer consent, Securus did not in fact obtain customer consent before collecting customers' location information".

The Texas-based company helps prisons monitor inmate phone calls, and Wyden said the company's technology allowed it to easily track any cell phone.

Krebs wrote that tracking firm LocationSmart leaked customer location data from all major US mobile carriers - AT&T, Sprint, T-Mobile and Verizon - without consent.

Following Wyden's statement, AT&T said it was also cutting off access to third-parties.

In its letter, Verizon said that it provides location data through two aggregators - LocationSmart and Zumigo.

Popular commercial uses for so-called geolocation tracking include emergency roadside assistance; keeping tabs on packages, vehicles and employees; bank fraud prevention and targeted marketing offers.

In a follow-up tweet today, T-Mobile CEO John Legere said that T-Mobile "will not sell customer location data to shady middlemen", but didn't give any more specific details.

More news: Sarri set to raid Napoli after Chelsea appointment

"Our review of our location aggregator program has led to a number of internal questions about how best to protect our customers' location data", Verizon told Wyden in a June 15 letter. Sprint previously suspended all data sharing with LocationSmart on May 25, 2018.

The data has allowed outside companies to pinpoint the location of wireless devices without their owners' knowledge or consent. That changed in May, when it was revealed that anyone could access real-time location data about any phone in the USA, thanks to LocationSmart.

It appears that Securus was itself buying the data from LocationSmart.

A spokesperson for 3Cinteractive did not respond to a request for comment. It notified Wyden's office late last week that it would stop selling data to LocationSmart and a similar firm called Zumigo. "The company does not warehouse or track a mobile user's historic identity and location information", said the company. "We will not enter into new location aggregation arrangements unless and until we are comfortable that we can adequately protect our customers' location data through technological advancements and/or other practices".

Sprint, in a statement to The Verge, confirmed that it would be ending the sale of subscriber location data as well.

In May, Wyden asked the FCC to investigate the "abusive and potentially unlawful practices" of cell phone companies selling access to customers' real-time location.

In the wake of questions from Wyden's staff, Verizon filed a letter Tuesday saying that it is suspending its data-sharing agreement with LocationSmart and Zumigo until further notice.

Customers, unable to opt out of the phone giants' privacy policies, may be locked in to sharing their location data with aggregators.