Skip to main content

AT&T and Sprint to follow Verizon in ending its sale of user location data to third-party brokers

AT&T and Sprint to follow Verizon in ending its sale of user location data to third-party brokers

Share this story

Illustration of the AT&T logo on a dark blue background.
Illustration by Alex Castro / The Verge

AT&T says it will end its practice of selling real-time user location data to third-party brokers after its primary competitor Verizon agreed to do the same earlier today. “Our top priority is to protect our customers’ information, and, to that end, we will be ending our work with aggregators for these services as soon as practical in a way that preserves important, potential lifesaving services like emergency roadside assistance,” reads a statement from an AT&T spokesperson given to The Verge. Typically, geolocation data collected by telecoms is shared with third parties for services like fraud prevention and, as Verizon points out, emergency roadside assistance.

Yet following pressure from lawmakers, specifically Sen. Ron Wyden (D-OR), Verizon said this morning that it would end the controversial, industry-wide practice. This is after Wyden revealed that the brokers who purchased the data were not verifying if its users had legal permission to track cellphone users through its service. It was then providing that data to other companies, notably Securus Technologies, a company that mainly monitors phone calls to prison inmates. Securus, it turns out, also sells real-time location data to law enforcement agencies without checking the validity of warrants. A former sheriff in Missouri has now been accused of using that data for unlawful surveillance of a judge and other police officers.

All four US telecoms have for years shared sensitive user data with third-party brokers

Effectively, because Verizon had little oversight into two California-based data brokers — LocationSmart and Zumigo — more than 75 companies had access to real-time user location data, and Verizon had little to no control over how those companies used that data. As the Associated Press put it, “Location data from Verizon and other carriers makes it possible to identify the whereabouts of nearly any phone in the US within seconds.” Even more dire was a free demo tool on LocationSmart’s website that, according to security reporter Brian Krebs last week, allowed any reasonably adept hacker to secretly track pretty much every phone in the entire US. The tool has since been shut down.

All four major carriers have cut off access to Securus, but only AT&T and Verizon have said they will stop sharing data with third-party brokers that facilitated the abuse in the first place. Sprint, which has yet again entered into merger talks with T-Mobile, initially told The Verge it would not officially end the practice of sharing data like real-time user location with third-party brokers. It did, however, say it would be reviewing the situation.

“While we continue to review the facts and determine next steps, as of May 25th we have suspended all services with LocationSmart. Our ongoing internal review also includes our relationship with Zumigo and, if warranted, we will take additional action,” reads a statement from a Sprint spokesperson. Later on in the day, Sprint clarified that it is now moving to end its contracts with third-party data brokers.

Here is Sprint’s new statement:

Protecting our customers’ privacy and security is a top priority at Sprint. Based on our current internal review, Sprint is beginning the process of terminating its current contracts with data aggregators to whom we provide location data. This will take some time in order to unwind services to consumers, such as roadside assistance and fraud prevention services. Sprint previously suspended all data sharing with LocationSmart on May 25, 2018. We are taking this further step to ensure that any instances of unauthorized location data sharing for purposes not approved by Sprint can be identified and prevented if location data is shared inappropriately by a participating company.

In a tweet, T-Mobile CEO John Legere said his company has pledged “not to sell customer location data to shady middlemen.” He did clarify whether T-Mobile had any current contracts with third-party data brokers that it is now moving to end.

Update 6/19, 2:07PM ET: Added statement from Sprint.

Update 6/19, 4:12PM ET: Added new statement from Sprint saying it has moved to end its contracts with data brokers. The headline has been updated to reflect this fact.

Update 6/19, 5:00PM ET: Added statement from T-Mobile CEO John Legere.