Verizon claimed the privacy rules in Section 222 of the Communications Act cover only call-location data, and not device-location data. The 2nd Circuit disagreed, pointing to the law’s text stating that Customer Proprietary Network Information (CPNI) includes data that is related to the location of a telecommunications service, and which is made available to the carrier “solely by virtue of the carrier-customer relationship.”
“It thus qualifies as customer proprietary network information and triggers the privacy protections set forth in § 222 of the Communications Act,” the ruling said.
The 2nd Circuit ruling described how Verizon sold location data to two aggregators, LocationSmart and Zumigo, “which in turn contracted with 63 third-party entities.” News reporting showed that Securus Technologies misused the program to let law enforcement officers access location data, and a Missouri sheriff “was able to access customer data with no legal process at all,” the ruling said.
The major carriers have said they discontinued the data-sharing programs the fines related to, but still claim the fines were illegal. AT&T and T-Mobile still have hopes of getting rulings that would invalidate their fines.
T-Mobile asked the Supreme Court to find that the location information protected under the law “refers only to call-location information, not other information about the location of a mobile device.”
The 5th Circuit ruling in AT&T’s favor was decided solely on Seventh Amendment grounds and did not reach AT&T’s other arguments. After its Supreme Court loss, AT&T filed a brief urging the 5th Circuit to find that the customer data it sold is not protected by Section 222.
An AT&T or T-Mobile victory could limit the ability of future FCC chairs to punish carriers for sales of device-location data. No such penalties are likely under the current administration. FCC Chairman Brendan Carr argued against the fines in 2024 when the commission was led by a Democratic majority, agreeing with carriers that only call location information is protected.
