T-Mobile claimed selling location data without consent is legal—judges disagree

A federal appeals court rejected T-Mobile's attempt to overturn $92 million in fines for selling customer location information to third-party firms.

The Federal Communications Commission last year fined T-Mobile, AT&T, and Verizon, saying the carriers illegally shared access to customers' location information without consent and did not take reasonable measures to protect that sensitive data against unauthorized disclosure. The fines relate to sharing of real-time location data that was revealed in 2018, but it took years for the FCC to finalize the penalties.

The three carriers appealed the rulings in three different courts, and the first major decision was handed down Friday. A three-judge panel at the US Court of Appeals for the District of Columbia Circuit ruled unanimously against T-Mobile and its subsidiary Sprint.

"Every cell phone is a tracking device," the ruling begins. "To receive service, a cell phone must periodically connect with the nearest tower in a wireless carrier's network. Each time it does, it sends the carrier a record of the phone's location and, by extension, the location of the customer who owns it. Over time, this information becomes an exhaustive history of a customer's whereabouts and 'provides an intimate window into [that] person's life.'"

Until 2019, T-Mobile and Sprint sold customer location information (CLI) to location information aggregators LocationSmart and Zumigo. The carriers did not verify whether buyers obtained customer consent, the ruling said. "Several bad actors abused Sprint and T-Mobile's programs to illicitly access CLI without the customers' knowledge, let alone consent. And even after Sprint and T-Mobile became aware of those abuses, they continued to sell CLI for some time without adopting new safeguards," judges wrote.

Carriers claimed selling data didn’t violate law

Instead of denying the allegations, the carriers argued that the FCC overstepped its authority. But the appeals court panel decided that the FCC acted properly:

Sprint and T-Mobile (collectively, "the Carriers") now petition for our review. Neither denies what happened. Instead, they argue that the undisputed facts do not amount to a violation of the law. The Carriers also argue that the Commission misinterpreted the Communications Act, miscalculated the penalties, and violated the Seventh Amendment by not affording them a jury trial. Because the Carriers' arguments lack merit, we deny the petitions for review.

The FCC fines included $80.1 million for T-Mobile and $12.2 million for Sprint. T-Mobile, which bought Sprint in 2020, reported service revenue of $17.4 billion and net income of $3.2 billion in the most recent quarter.

Although the FCC first proposed the fines in 2020, under Republican Chairman Ajit Pai, the 2024 vote to finalize the penalties was 3-2, with dissents from Republicans Brendan Carr and Nathan Simington. Carr is now chairman of the FCC.

T-Mobile told Ars today that it is "currently reviewing the court's action" but did not provide further comment. The carrier could seek an en banc review in front of all the appeals court's justices, or ask the Supreme Court to review the case. Meanwhile, AT&T is challenging its fine in the 5th Circuit appeals court while Verizon is challenging in the 2nd Circuit.

AT&T and Verizon were fined $57.3 million and $46.9 million, respectively. The FCC last year said the major carriers disclosed customer location information "without customer consent or other legal authorization to a Missouri Sheriff through a 'location-finding service' operated by Securus, a provider of communications services to correctional facilities, to track the location of numerous individuals."

Carriers gave up right to jury trial, court rules

AT&T and Verizon made similar arguments about their right to a jury trial and cited the Supreme Court's June 2024 ruling in Securities and Exchange Commission v. Jarkesy. That ruling held that "when the SEC seeks civil penalties against a defendant for securities fraud, the Seventh Amendment entitles the defendant to a jury trial."

In the ruling against T-Mobile, the DC Circuit panel held that the carriers gave up any potential right to a jury trial when they "chose to pay their fines and to seek direct review in this court... The Carriers may not now complain that they were denied a right they voluntarily surrendered."

The carriers could have obtained a jury trial if they simply failed to pay the fines and waited to be served with a complaint, the ruling said. "Even if the Seventh Amendment applies, it was not violated because the Carriers had the opportunity to put their case before a jury," judges wrote.

The carriers argued that they didn't really have a right to a jury trial because the FCC orders "are final agency actions with real-world effects; indeed, the FCC acknowledges that it may use its untested factual findings in license-renewal decisions and penalty calculations."

The carriers argued that in some jurisdictions where the government could bring a collection action, "the Companies would not have the right to raise factual and legal challenges to the Orders. The possibility of a government-initiated collection action therefore does not satisfy the Seventh Amendment and Article III."

The appeals court panel responded that "this court has not adopted the rule that troubles" the carriers. If "the government brought an enforcement action in a jurisdiction with the unfavorable rule, the Carriers could have raised as-applied challenges in those proceedings. But we cannot 'invalidate legislation on the basis of... hypothetical... situations not before' us," judges wrote.

Carriers quibbled over definition of sensitive data

The carriers also argued that the device-location information, which is "passively generated when a mobile device pings cell towers to support both voice and data services," does not qualify as Customer Proprietary Network Information (CPNI) under the law. The carriers said the law "covers information relating to the 'location... of use' of a telecommunications service," and claimed that only call location information fits that description.

Judges faulted T-Mobile and Sprint for relying on "strained interpretations" of the statute. "We begin with the text. The Communications Act refers to the 'location... of a telecommunications service, not the location of a voice call... Recall that cell phones connect periodically to cell towers, and that is what enables the devices to send and receive calls at any moment," the ruling said.

In the judges' view, "a customer 'uses' a telecommunications service whenever his or her device connects to the carrier's network for the purpose of being able to send and receive calls. And the Carriers' reading therefore does not narrow 'location... of use' to times when the customer is actively on a voice call."

Judges also weren't persuaded by the argument that the fines were too large. "The Carriers note that the Commission previously had imposed such large fines only in cases involving fraud or intentional efforts to mislead consumers, and they are guilty of neither form of misconduct," the ruling said. "The Commission reasonably explained, however, that the Carriers' conduct was 'egregious': Even after the Securus breach exposed Sprint and T-Mobile's safeguards as inadequate, both carriers continued to sell access to CLI under a broken system."