On April 29, 2024, the FCC released four Forfeiture Orders imposing a total of nearly $200 million in fines against AT&T, T-Mobile, Sprint, and Verizon for disclosing customer location information, without their consent, to a third party who was not authorized to receive it and for failing to take reasonable steps to protect their customers’ location information.
A summary of the factual background is included in this blog post: FCC Releases NALs Against Four Carriers for Location Data Sharing Violations.
The FCC imposed a fine of
- $57,265,625 against AT&T, the same amount as proposed, finding no reasonable basis to cancel, withdraw, or reduce the proposed penalty.
- $91,630,000 against T-Mobile, a reduction of $11,550,000 from the proposed amount to remove double counting and reflect updated information T-Mobile provided regarding the termination dates for certain entities’ access to customer location information.
- $12,240,000 against Sprint, the same amount as proposed, finding no reasonable basis to cancel, withdraw, or reduce the proposed penalty.
- $46,901,250 against Verizon, a reduction of $1,417,500 from the proposed amount to reflect the fact that two entities identified in the Notice of Apparent Liability did not participate in the location sharing.
The FCC reiterated that location information constitutes CPNI under the Commission’s rules and that carriers have a responsibility to safeguard customer CPNI. The FCC also reiterated that carriers cannot delegate their CPNI responsibilities and are not absolved of liability for a breach simply because they are not directly responsible for the breach. Finally, the FCC rejected the carriers’ arguments with respect to notice, implicit consent, whether their protection efforts were sufficient, and whether the forfeiture is appropriate, among other things.
The FCC also released a Press Release on the orders.
Please Contact Us if you have any questions.