T-Mobile claimed selling location data without consent is legal–judges disagree
arstechnica.com380 points by Bender 3 days ago
380 points by Bender 3 days ago
Opt-out links by carrier:
ATT - https://www.att.com/consent/ccpa/dnsatt
T-Mobile: https://www.t-mobile.com/privacy-center --Access the Privacy Dashboard
Adjust the following privacy settings (toggle off as desired), per line/account: - Profiling and automated decisions (on by default) - Fraud and identity theft protection (shares account and usage info) - Sharing certain financial information (payment history, balances, etc.) - Analytics and reporting, Advertising options, and Do Not Sell or Share My Personal Information
Verizon - Go to your MyVerizon Navigate to Account > Account Settings > Privacy Settings on the web; or tap the gear icon and choose Manage privacy settings in the app.
Locate the following tracking options: - Custom Experience - Custom Experience Plus - Business & Marketing Insights - CPNI (Customer Proprietary Network Information) and Identity Verification programs -For each, select "Don't Use" or toggle off to opt out
Just checked my T-Mobile privacy settings. I had most everything turned off, but then I saw a few were turned on (such as my opt-out marketing settings). Opting out of everything took 2 tries to have them all disabled (sludge).
This one was seemingly a new one, and makes the hairs on my neck go up:
Make your choice about profiling and automated decisions.
You can tell us not to use your personal data for certain kinds of "profiling" that we might do in the future. This toggle allows you to opt out of having profiling used for future decisions that produce legal or similarly significant effects about you. We don't use profiling to make these kinds of decisions now. Turning this "OFF" or gray means "opt out of profiling and automated decisions."
For some reason I cannot turn off the "Alert the Gestapo if I remain too close to an abortion clinic for too long option" on my account, says not available for Texas accounts.
You're going to have to wait until Texas voters collectively grow the ability to reason and a backbone before you can toggle that option off (yes, I know it's not all of them but the fact that Abbot and company aren't metaphorically tarred and feathered then run out of town on a rail for even suggesting redistricting right now is telling)
What option was this? I wasn’t aware Texas had regulations like that
The comment is a joke, but Texas absolutely has dystopian laws about abortion, making it illegal to go to another state for one.
I figured the name was a joke but I am aware of how draconian their laws were so it wasn’t outside the realm of possibility that they had companies reporting location data for abortion clinics. I was just surprised if that was occurring and transparent enough to be an opt out setting on your account
Mark the accounts as kids account, they will not collect data till the birthday on the account turns 18. Pick any recent month and 2025 and you get 17+yrs of minimal data collection. They won't turn it on for new data sharing options.
Honestly, it's border line impossible for common mortals, I can't opt out from certain marketing initiatives because I don't have the marketing ID? (with no indication on how to retrieve it) I live in Washington, USA.
Any idea how this works for MVNOs?
I am also wondering this since I have a LTE-enabled camera with prepaid data on the Mint MVNO (four capital letters 𝅘𝅥𝅮) running on T-Mobile's network. My Mint account settings has no privacy controls at all, and their privacy policy only mentions “location” in terms of GeoIP while browsing their website and in terms of E911 access if you dial emergency services: https://www.mintmobile.com/privacy-policy/
I found this “Ultra Mobile and Mint Mobile – Policies regarding Geolocation Data” <https://docs.fcc.gov/public/attachments/DOC-386591A1.pdf> that mentions third-party sharing, but it's a little dated (2022):
“Describe the arrangements, agreements, and circumstances in which Ultra Mobile and Mint Mobile share subscriber geolocation data with third parties that are not law enforcement.
None. The enhanced 911 process provides subscriber geolocation from the cell phone in the event of a 911 call, but it is not controlled by Ultra or Mint Mobile. Neither Ultra nor Mint Mobile provide geolocation data to any third parties.”
What this doesn't answer, however, is what T-Mobile are doing with Mint customers' location data. I have to assume they're selling everything they can and that's why the MVNO is so cheap compared to the main brand lol
Main brand is even cheaper when you have a business account. It's only people with few lines that get railed on postpaid wireless.
i pay $15 for mint, lets see the tmobile commercial plan pricing?
Big commercial is ~$23/mo for pooled data and a 13-month subsidy. At one point we were running it like a revenue center and getting $250-350 for used iPhones. They balked because we have our shit together and dump phones quickly (most large customers don't), so we moved away from that for other concessions.
digression: I use Google Fi as my carrier but it's an MVNOs that's largely on T-Mobile. I don't believe Google Fi is selling my location data (they already know it via other ways), but since it runs on the T-Mobile network, they might still be able to? But since I lack a T-Mobile account there's no way to opt out.
Anyway know the story on location selling + Google Fi? Or with MVNOs in general.
"Google Fi users are not subject to T-Mobile's collection and sale of app data." From the first expandable question on https://support.google.com/fi/answer/6181037?hl=en#zippy=%2C....
While Google Fi users don't seem to be subject to T-Mobile's data collection, you might still want to go into Google Fi's "Privacy & security" section and opt out of "Allow CPNI sharing".
Wow, yep, thanks for that.
I was certain I had disabled all of these through the normal t-mobile dashboard, but sure enough there were about 5 still enabled including the “sell my personal information” ones. Ouch.
Is Verizon Identity Verification necessary at all? It says it helps 3rd parties prevent identity theft but I’m curious how true / necessary that is?
I did a cross-continent drive last month with my T-Mobile US phone and got a rude awakening of how real-time this is when the “source” area codes of all the spammy phone calls followed me from state to state.
e: I thought I had opted out of everything that was opt-out-able in TMo's privacy settings <https://www.t-mobile.com/privacy-center/dashboard/controls> years ago when I first set up my line/account, but I just checked again and more than half of the settings were enabled. Hate that I have to be in the habit of looking for new settings that default to enabled.
This! I did a long drive last week and was surprised that spam calls knew exactly the area code I was in. Realtime …
Chilling realization
Is it possible that some background app is polling and selling this info rather than your carrier?
How are the economics supposed to work here? Is the data so cheap they can get everyone's location several times a day despite having no need for it? What's in it for the carrier then?
I relocated during the pandemic and brought my existing (Los Angeles area code) number to the SF Bay Area with Mint Mobile. I really don't get local area code spam after five years. The few calls that do happen, I can trace by topic back to local business interactions I've had.
I'm not sure whether to think the Mint MVNO on T-Mobile is better about privacy than T-Mobile. Or do you have some phone apps that are really the guilty party linking your phone number to your travel locations...?
Weird! 99% of my spam calls come from the same area code as my cellphone number.
I think they mean scammers have adapted to targeting the area-codes your phone appears to be located now, as opposed to (just) the area code where you originally got your phone number.
For a lot of people the difference won't be apparent, because they haven't moved.
I got barely any spam calls on Tmo, but I recently switched away and am crying for mercy. They have an opt-in service that prevents 90% of them from reaching your phone, and it's free. ATT has a similar one. I wish Consumer Cellular did, and I'm almost thinking about going back to big carrier prices for big carrier features like that.
Look forward to the supreme Court ruling that the FCC is illegal and actually owes carriers money for some reason
SCOTUS hates the DC Circuit almost as much as it hates the Ninth; this decision is dead on arrival.
If that were the case, then it would probably stand. The Ninth usually has the lowest, or among the lowest, reversal rate of any district: https://ballotpedia.org/SCOTUS_case_reversal_rates_(2007_-_P...
You hear a lot of lies to the contrary that it has the highest number of reversals, which is misleadingly irrelevant because the Ninth also has by far the greatest number of decisions. It's like saying that New York City has more violent crimes than El Paso, which utterly ignores the population difference between the two.
Your link says that the 9th is the most reversed circuit both in terms of raw reversals (196) and as a rate (79.4%).
Include the time frame when you talk about this.
2007-present, in this case
People making conclusions should look at the data, though.
In this case, every ciruit has a 64+% reversal rate, the sixth has a reversal rate almost identical to the 9th. I have no idea what a significant difference would be.
Maybe someone can explain a set of assumptions and the resulting variance.
That makes everything seem completely arbitrary and not based on anything besides personal feelings
I didn't choose the data set or the link, perhaps your admonishment should be levied against GP.
I agree that people should look at the data before making conclusions, which is why I posted that the data directly contradicted GP's claim that the 9th "usually has the lowest, or among the lowest, reversal rate of any district." It doesn't. Based on the data, it has not only the highest reversal rate but also the highest amount of reversals. I take no position on whether the 9th's reversal rate is significantly different than any other circuit's other than to note that it is the highest by all reported metrics and that when you hear that fact, it isn't a "lie" (as characterized by the GP).
> 2007-present, in this case
'07 seems arbitrary. 2017 would be a better date, given that's when Gorsuch flipped the Court conservative. (Though it really went full dumbfuck when Barrett started giving Alito and Thomas cover.)
> The carriers did not verify whether buyers obtained customer consent, the ruling said.
What would it take to disrupt the oligopoly of limited carriers in the USA? I feel this type of behavior will continue with minimal repercussions. Maybe a slap on the wrist.
FCC, whether intentional or unintentional, through their controlled access to wireless spectrum has made it near impossible for smaller players to disrupt them.
I know "MVNOs" exist but they just resell the spectrum/network from the big 3 carriers in the USA.
Infrastructure like this is pretty much the textbook example of natural monopoly. We just need to decouple the tower infrastructure from the consumer service providers. And, of course, have actual privacy protections.
Now that the president has king-like powers, a different governing coalition as the MAGA breaks up or we have some sort of conflict that resets some of the politics.
The government can break up the phone companies into regional carriers. The market doesn't have the power to do anything, as the government controls the spectrum allocation.
EchoStar/DISH-owned Boost Mobile is the fourth carrier, cleaved off of Sprint by Ajit Pai and co during the T-Mobile/Sprint merger process; DISH now claims it is able to provide coverage to 70% of the population in the US.
The problem is EchoStar/DISH are saddled with debt and Boost still uses its agreements with AT&T to throw at least some customers on AT&T coverage instead of its own.
A very large amount of capital, a substantial fraction of which you will be wasting on lobbying and financing the parties that managed to get spectrum allocated before you thought of this.
So next step is: breaking up the big 3, then.
If you have to lobby, then may as well attack them head on. Unfortunately, I think the current administration will _not_ help with this.
Don’t underestimate how cheap it actually is to buy politicians. A lot of Trump’s “big donors” who received billions of dollars worth of windfalls from his moves last term, were donors of a few million. Congress, too. Politicians are a very cheap investment compared to say, laying fiber covering a single metro area.
People don't realize this. At the State level, policy lobbying can yield concrete legislation for <$250k. For companies selling stuff, ~$60k/year gets you intros to civil service and some administration leadership.
In my city, I gave my local alderman $750 when he first ran. I have the guy's cell phone and the dude will fill potholes himself if I text him.
> Don’t underestimate how cheap it actually is to buy politicians
But if your idea becomes an extinction-level threat for a well-funded industry, surely they will also try to buy the politicians, getting into a bidding war with you, throwing their entire war-chest at the problem if necessary (knowing that thanks to their monopoly they have effectively forever to get it back).
No dispute there, though sometimes the industry that could be negatively impacted by those bribes doesn't realize until it's too late. An example of this is "everyone who uses aluminum as a raw material for manufacturing" which is not an organized lobbyist group, which has been screwed over by tariffs during both Trump terms, despite being bigger in market cap and number of jobs impacted.
Probably not the case with telecoms though -- they seem to have fully bought all the needed politicians already, so you're right on that front.
An "oh shit" moment where folks find themselves in a concentration camp because of data leaked from their devices would probably do the trick.
Now I don't actually have the knowledge but isn't something like the FCC partially there to ensure that this sector continues evolving in the same direction as any ol' utility?
Anyhow, I'm writing this from the EU where we actually have effective GDPR regulation. Fines for crossing that line are more than just wrist slaps. Outside of that somewhat similar on that oligopoly telecom front.
> effective GDPR regulation. Fines for crossing that line are more than just wrist slaps.
Yeah the GDPR is only effective on paper. In practice, the enforcement of it is near non-existent. It is and has always been more profitable to breach the GDPR than comply with it.
Please provide source on this. Profitable how? Always when? Enforcement nonexistent?
It's enough that the internal legal team keeps an eye on compliance to have had an enormous effect in itself.
I'm sorry but no. Every day I encounter something related to GDPR here in the EU. Companies big and small would not do all this if enforcement were "near non-existent"
Source: all those websites with annoying "cookie banners" where it's easier to accept than to decline.
The GDPR does not approve of that (it should be as easy to consent as it is to decline, otherwise the consent is void for GDPR purposes). Not to mention a lot of them aren't even implemented properly and personal data is leaked to third parties before any consent is given.
But everyone does it and keeps doing it (there's an entire ecosystem of those "consent management platforms" that include built-in features to breach it, including per-country variations so you can vary your non-compliance depending on the ferocity of that country's DPA and your risk-appetite).
And this is just the tip of the iceberg - I've seen things inside organizations that are not compliant either, but there's no point even talking about those if even the basic and obvious things like online consent flows not being enforced.
Here's a report from Noyb exposing the reality on the ground, quite a contrast with the tech-bros' fear-mongering: https://noyb.eu/en/data-protection-day-only-13-cases-eu-dpas...
Is there any way to block this location data sharing? What about other carriers? I always think about denying apps access to this stuff but a carrier tracking me is insane and scary. The linked article makes it seem like ATT and Verizon also do this.
Beyond carrier opt-outs (which often have loopholes), you can physically block tracking by toggling airplane mode with WiFi enabled when possible, or using a signal-blocking Faraday bag for your phone during sensitive travel.
> during sensitive travel.
if your location data is continuous, but happens to "switch off" when you're doing something sensitive, then it's like a blaring alarm that this is the period of time that is "sus". It gives any sort of LEA/feds a time period to investigate, and might even be the evidence they need for a search warrant.
Therefore, you should not just hide your signal only when you are doing sensitive things. You should periodically hide it going to groceries, going to the shops etc. You might want to do it regularly, as part of your daily life. Camouflage only works if it cannot be used to tell apart your activities.
Case in point... protest tracking, Brian Kohberger, hell, a local case used location data as an additional smoking gun on a murder, even getting past GPS "accuracy" barriers and claims to get a conviction.
Probably not. The infrastructure has to know where your cell phone is in order to communicate with it.
Last I checked, the large carriers in the states hoard this information for years.
This is not quite true. They have to know roughly where your cell phone is but, helpfully, your cellphone starts the process as soon as you start it up and then it is a courtesy to you that the unit closest to you will handle your call(s) and other traffic because that will save you battery and reduces the amount of power your phone will use which in turn will allow others relatively nearby to use the same slice of the spectrum while you are transmitting. Phased arrays on the mast make this even more precise and further conserve power. But that really is a courtesy: it would all work without that luxury but less efficient and your phone's battery would be empty faster.
The part that really is optional is where the carrier then stores and even sells your location. They are mandated by law with respect to the first and they abuse the technical capabilities of the system for the second. And even if it isn't very precise for a single measurement it is in fact quite precise after you haven't moved for a while.
They know alot. The data is used to estimate average speeds on roads with alot of throughput and can profile location between known sites. (Work/school/etc)
You can buy data about the incomes of people driving past a given intersection. That's why you'll see a Starbucks sometimes on a trunk road in a sketch area.
Yes, the aggregate value of this data is substantial. And of course nobody in the possession of something valuable, especially not a telco, ever thought 'am I acting in the interest of the data subjects by selling this data?'.
Carrier tracking isn't precise as GPS tracking via the phone. Its frequently a mile or more off. Banks were using it in lieu of a travel notice to see if the card swipe and phone were in the same city. Thats my experience with it. They moved away though and now try to ping the app(silent push) to get an IP or location data since buying location data from carriers is expensive.
> Carrier tracking isn't precise as GPS tracking via the phone.
Not any more. 5G changes this now that the location spying is baked into the cell tech itself. The base stations are literally steering the beam to follow you in order to achieve such high bandwidth. See “5G NR Positioning Enhancements in 3GPP Release-18” (2024): https://arxiv.org/html/2401.17594v1
“New radio (NR) positioning in the Third Generation Partnership Project (3GPP) Release 18 (Rel-18) enables 5G-advanced networks to achieve ultra-high accuracy positioning without dependence on global navigation satellite systems (GNSS)”
“Release 18 (Rel-18) NR pushes the boundaries even further, unlocking the potential for applications in 5G-Advanced networks that demand ultra-high positioning accuracy – down to centimeter-level (cm-level)” (emphasis mine)
The overwhelming majority of 5G cells don't do any of that.
Even though modern cellular deployments have increased the positioning accuracy a bit, best in class network telemetry (either embedded or third party probes) that estimate positions from timing advances is still pretty crap in real life.
There are other tricks you can use such as "minimization of drive tests" that get the A-GPS position (which again, is not always that accurate, because it's cached), but this kind of telemetry is enabled only on small samples, because it has a non-trivial impact on the network performance.
Then I guess you could use straight up illegal ways such as abusing the E911 / E112 location tracking.
For a long time I've wanted something like Remote Desktop for my phone.
With the idea being that I use a second phone to connect to my main phone over the internet.
This lets the phone number you actually have associated with you stay in the same fixed geographical location.
E.g. all calls are initiated by the primary phone and tunnelled over the internet to the disposable phone.
I use Ooma VOIP service and you can forward calls to a different number (I use that occasionally). I don't use it but they also have an iOS / Android app which lets you make calls from your Ooma VOIP number. The FAQ says you can't call 911 with it, so that's smoke anyway.
https://support.ooma.com/home/ooma-app-faq/#can-i-make-emerg...
Could just set up a phone farm like the Chinese run. They've got fun little adapters and boxes to get full "remote" control of a phone. Could rig one up for your own application, or maybe a pseudo-phone-RDP setup.
Get a Direct Inward Dialing (DID) number and a VoIP host that speaks SIP. Dunno about iOS, but Android has had native SIP support built in since Android 2.3 Gingerbread.
Google actually ripped VoIP support out of the native dialer several years ago
https://www.xda-developers.com/android-12-killing-native-sip...
That would work for calls, thanks.
But for apps like WhatsApp, Signal, SMS, iMessage etc. they would all need their own workarounds.
But those apps don't actually care about the phone number beyond the initial registration? Once registered, they work entirely via IP and don't know nor care which SIM is in your phone.
You will however have a problem with registering on those with a VoIP number - those ranges are generally blacklisted due to bad actors misusing those numbers for nefarious purposes.
Could use a VNC of sorts. Maybe a Miracast receiver that dumps the screen buffer to your own web service that just spits out the frames over UDP
How would this fool the network operator? Tmobile/ATT/Verizon will still know and be able to share your location.
Yeah it is quite easy, just take out your phone and follow these steps,
1. Go outside
2. Break the phone in half
3. Toss it in the nearest garbage can
4. Walk away
You can purchase a Faraday cage for your phone. Or you can make one.
Yes you could go full rms and not own one* and ask someone else to borrow theirs.
* does anyone know if this is still true?
Asking to borrow someone's phone is a common theft tactic. I wouldn't do it, for fear of someone thinking you're up to no good.
Burners / prepaid SIM's are still a thing.
I doubt RMS frequently borrows phones from strangers. It's usually from people who know him and are with him. They already have the phone, so RMS's using it doesn't increase the tracking it's already doing, and in some ways it pollutes the tracking data, also good.
I once suggested some alternatives to him like Meshtastic, but he travels too much to random places for that to be practical.
Even better - randomly pickpocket someone else’s phone, use it once, then toss it /s
[flagged]
Probably worth noting that selling this phone location data is already considered illegal in most other nations.
More like selling when and where you got on and off the bus
Yeah I mean that's fair, it's hard to tell exactly what's happening from the article. To be clear I'm not saying tmobile is right or wrong, just that I don't think the title is totally honest here