Verizon has pledged to stop selling data that can pinpoint the location of its mobile users to third-party intermediaries, according to The Associated Press. Verizon is the first carrier to end the controversial practice after Sen. Ron Wyden (D-OR) revealed that one of the companies that purchased the real-time location-tracking data from carriers wasn’t verifying if its users had legal permission to track cellphone users through its service.
In a letter to carriers and the FCC, Sen. Wyden said that Securus Technologies — a company that mainly monitors phone calls to inmates in jails and prisons across the country and also sells real-time location data to law enforcement agencies who must upload legal documents such as a warrant stating they have the right to access the data — wasn’t actually verifying if those documents were legitimate. Securus did not “conduct any review of surveillance requests,” Wyden wrote in his letter to the FCC.
A sheriff in Missouri was charged with illegally tracking people 11 times without court orders using Securus, according to The New York Times. While all four major carriers have now cut off access to Securus, only Verizon has said it will stop selling data to geolocation aggregators who can then turn around and sell that data to someone else. Verizon said 75 companies obtained data from the two companies it sells location data directly to: LocationSmart and Zumigo.
Last month, KrebsOnSecurity reported that LocationSmart — which supplies Securus with the location-tracking data — was leaking the real-time location data of customers on every major US carrier through a free demo tool on its website, which was subsequently taken down.
“Verizon did the responsible thing and promptly announced it was cutting these companies off,” Wyden said in a statement to the AP. “In contrast, AT&T, T-Mobile, and Sprint seem content to keep selling their customers’ private information to these shady middle men, Americans’ privacy be damned.”