Phone networks were illegally sharing users’ data without their consent and must pay $200 million, US says

AT&T, Sprint, T-Mobile and Verizon all fined by US FCC

(Getty Images)

US phone carriers were sharing users’ location without their consent, the US has said.

The networks – AT&T, Sprint, T-Mobile and Verizon – must now pay nearly $200 million in fines because of the data breach.

The fines mark the end of a years long investigation that looked into numerous examples of location data being sold on to third-parties. The phone networks sold that data on to as many as 88 other companies in the case of AT&T, US regulator the Federal Communications Commission said.

"These carriers failed to protect the information entrusted to them. Here, we are talking about some of the most sensitive data in their possession: customers’ real-time location information, revealing where they go and who they are,” FCC Chairwoman Jessica Rosenworcel said in a statement released Monday.

Officials first began investigating the carriers back in 2019 after they were found selling customers' location data to third-party data aggregators. Fines were proposed in 2020, but carriers were given time to argue against the claims before the fines were imposed.

The FCC argues that the four firms are required to take reasonable measures to protect certain consumer data per federal law.

“The FCC order lacks both legal and factual merit,” AT&T said in a statement. “It unfairly holds us responsible for another company’s violation of our contractual requirements to obtain consent, ignores the immediate steps we took to address that company’s failures, and perversely punishes us for supporting life-saving location services like emergency medical alerts and roadside assistance that the FCC itself previously encouraged.

“We expect to appeal the order after conducting a legal review.”

T-Mobile faces the largest fine at $80 million. Sprint, which merged with T-Mobile since the investigation began, received a $12 million charge. The FCC hit Verizon with a $47 million penalty, and AT&T was issued a $57 million fee.

Additional reporting by agencies