Major US carriers will stop selling customer location data to aggregators (updated)

Last month, Senator Ron Wyden (D-OR) sent letters to Verizon, AT&T, Sprint and T-Mobile, asking who they share their customers' location data with and whether those companies obtain customer consent. The move came after reports revealed that a service provided by Securus Technologies -- a company previously reported to have allowed prisons to record calls between inmates and their lawyers -- let a former Mississippi County sheriff track the cellphones of other officers and a judge without court orders. All four carriers have now replied to Wyden and Verizon has pledged to end its practice of selling location data through intermediary companies.

In its letter, Verizon said that it provides location data through two aggregators -- LocationSmart and Zumigo. They then give other companies access to their location-based services that utilize Verizon's and other carriers' data. Those types of services can include routing calls to the right facility, fraud prevention and vehicle tracking. Verizon told Wyden that not only had it suspended Securus' access to its customer location data, it had also decided to end its arrangements with LocationSmart and Zumigo. "Verizon has notified these location aggregators that it intends to terminate their ability to access and use our customers' location data as soon as possible," the company wrote.

Verizon will still provide data to companies offering services like fraud prevention and call routing, but it won't do so through aggregators. "Verizon will work with aggregators to ensure a smooth transition for these beneficial services to alternative arrangements so as to minimize the harm caused to customers and end users," said Verizon.

AT&T also noted that it works with LocationSmart while T-Mobile told Wyden it works with LocationSmart and Zumigo. Sprint didn't share which firms it works with. However, aside from ending agreements with Securus, none of the other three carriers said they would make changes similar to Verizon's (see note below). "Verizon deserves credit for taking quick action to protect its customers' privacy and security," Wyden said in a statement. "After my investigation and follow-up reports revealed that middlemen are selling Americans' location to the highest bidder without their consent, or making it available on insecure web portals, Verizon did the responsible thing and promptly announced it was cutting these companies off. In contrast, AT&T, T-Mobile and Sprint seem content to continuing to sell their customers' private information to these shady middle men, Americans' privacy be damned."

Other issues with Securus include a data breach and Wyden asked the FCC to investigate the company in May. Last month, LocationSmart leaked real-time location data on its website, spurring the FCC to take action just a day later.

Update (1:40PM): Following Verizon's announcement, AT&T told The Verge that it will also stop selling location data to aggregators. "Our top priority is to protect our customers' information, and, to that end, we will be ending our work with aggregators for these services as soon as practical in a way that preserves important, potential lifesaving services like emergency roadside assistance," the company said in a statement.

Update (5:20PM): LocationSmart provided Engadget with a statement regarding the data-sharing changes being implemented by US carriers. "LocationSmart has maintained close communications with the wireless carriers about recent incidents, and continues to work with them to ensure that mobile device user access to important services are maintained and that user privacy is treated with the utmost priority," said the company. "We are working with each of them to ensure that industry best practices and carrier guidelines are met and service is not interrupted for any of our customers as the carriers implement changes to their respective programs for use of location data. We do not anticipate adverse impact to current services in the near future."

Update (5:40PM): Sprint has also joined in. That means three major US wireless providers are pledging to end the practice. T-Mobile CEO John Legere tweeted that his company won't share data with "shady middlemen," but didn't indicate if it would end the practice entirely.

Update 6/20/18 2:25 PM: Security researcher Brian Krebs reports that T-Mobile has clarified its CEO's tweet. The company explained that it too has terminated its location aggregator agreements.