AT&T sold customers’ location data, lawsuit alleges

AT&T is facing a class action lawsuit over allegations that it violated its customers’ privacy by providing location data to “thousands” of third parties.

The Electronic Frontier Foundation, a nonprofit that focuses on civil liberties as they relate to technology, and law firm Pierce Bainbridge Beck Price & Hecht filed a lawsuit in California Tuesday on behalf of three AT&T wireless customers against telecoms giant and two other companies alleging they allowed numerous people to track cellphone users’ whereabouts without authorization.

AT&T has real-time location data on its wireless customers that can be used to help 911 operators find callers in an emergency. The lawsuit alleges AT&T worked for years with location data aggregators like LocationSmart and Zumigo, which sell location data to others. That led to the data being used by bounty hunters, car dealers, landlords, stalkers and others in non-emergency situations without authorization from the people whose data were being tracked, the EFF said.

“AT&T and data aggregators have systematically violated the location privacy rights of tens of millions of AT&T customers,” EFF attorney Aaron Mackey said. “Consumers must stand up to protect their privacy and shut down this illegal market.”

Abbye Klamann Ognibene, an associate at Pierce Bainbridge, said the data can provide “a window into the intimate details” of cellphone users’ lives, including where they go to the doctor, worship and live.

The practice was first publicly revealed by an FBI investigation into a Missouri sheriff who was accused of using location data to stalk a judge and other law enforcement officers, according to the lawsuit.

Then, in 2018, The New York Times reported on how a company called Securus offered a phone-tracking service using data from cellphone carriers including AT&T. The next month, they followed up with another report after AT&T, Verizon, T-Mobile and Sprint said they would limit access to the location data.

But the tracking services are still operating.

Earlier this year, Motherboard reported how a reporter was able to pay a bounty hunter $300 to track a phone using location data that passed from T-Mobile to Zumigo to another company called Microbilt to a bail bond company.

AT&T said in a statement to FOX Business that it stopped sharing location data with aggregators after reports of misuse.

“The facts don’t support this lawsuit, and we will fight it,” the company said. “Location-based services like roadside assistance, fraud protection and medical device alerts have clear and even life-saving benefits. We only share location data with customer consent.”

The lawsuit alleges AT&T violated the Federal Communications act by providing the location data without customers’ authorization and California’s unfair competition law by misleading customers into thinking the information was better safeguarded. It also accuses AT&T, LocationSmart and Zumigo of violating the customers’ rights to privacy.

In a statement, LocationSmart said its API platform facilitates life-saving and other vital location-based services which require consent from the users.

“LocationSmart will fight this lawsuit because the allegations of wrongdoing are meritless and rest on recycled falsehoods,” the company said.

Zumigo didn’t immediately respond to requests to comment on the case.

CLICK HERE TO GET THE FOX BUSINESS APP

The EFF is asking a judge to stop the location data sharing practices and to award monetary damages.

“To sell this information without any notification to users is deceptive, extraordinarily invasive of their privacy and illegal,” Thomas D. Warren, a partner at Pierce Bainbridge, said.