krebsonsecurity.i2p/2024/04/fcc-fines-major-u-s-wireless-carriers-for-selling-customer-location-data/ http://theguardian.i2p/business/2024/apr/29/fcc-fines-wireless-carriers-t-mobile-verizon http://arstechnica.i2p/tech-policy/2024/04/fcc-fines-big-three-carriers-196m-for-selling-users-real-time-location-data/

The carriers sold “real-time location information to data aggregators, allowing this highly sensitive data to wind up in the hands of bail-bond companies, bounty hunters, and other shady actors”, the FCC chair Jessica Rosenworcel said in a statement.

The wireless carriers said they plan to challenge the fines.

T-Mobile said the FCC “decision is wrong, and the fine is excessive. We intend to challenge it.”

T-Mobile said the “industry-wide third-party aggregator location-based services program was discontinued more than five years ago after we took steps to ensure that critical services like roadside assistance, fraud protection and emergency response would not be disrupted”.

Verizon said it has worked to protect customers: When “one bad actor gained unauthorized access to information relating to a very small number of customers, we quickly and proactively cut off the fraudster, shut down the program and worked to ensure this couldn’t happen again”.

AT&T criticized the order as lacking “both legal and factual merit. It unfairly holds us responsible for another company’s violation of our contractual requirements to obtain consent, ignores the immediate steps we took to address that company’s failures and perversely punishes us for supporting life-saving location services.”

The FCC said carriers relied on contract-based assurances that service providers would obtain consent from carriers’ customers before accessing location information.

Lawmakers in 2019 expressed outrage that aggregators were able to buy user data from wireless carriers and sell “location-based services to a wide variety of companies” and others, including bounty hunters.