Three major US telecom companies, T-Mobile, Sprint, and AT and T have been caught selling their users’ tracked phone location data to third-parties, enabling tracking of their phones.
Third-parties can track your smartphone location in real-time
Motherboard website described how, for $300, a bounty hunter could track down virtually any smartphone within a few hundred yards. It’s done without fancy tools or any prior knowledge about the phone's whereabouts, using only the number.
The majority of mobile carrier clients don’t know that they’ve agreed to allow third-parties to get their location data for marketing purposes. Most often it happens via one click on a website or an app, without paying attention to what's being said in that grey hard-to-read text. Apparently, some companies skip the opt-in part for their users as well.
Mobile carriers are selling your phone location data
Telecom companies actually have the right and do sell your location data to aggregators, acting as the wholesalers to smaller businesses. Securus and Microbuilt are two of the many companies that resell real-time location data. Microbuilt also allowed law enforcement to locate phones without any court order instantly.
What's more, LocationSmart, the wholesaler that provided Securus, leaked all its data back in May 2018 because of an error in their website code. Less than a week after the leak was exposed, Securus had been hacked, with 2800 accounts' information stolen. The majority of it belonged to the US law officers.
While law enforcers might be doing this for the greater good when they use real-time phone location data to react to an emergency, the chain of re-sellers runs much further, reaching car salespeople, creditors, landlords, and others. Such widespread use of this tool becomes more apparent when you know the database also gives the full name and address of the number holder. Given that the locating a phone can cost as much as $5, it comes with no surprise that there's a huge market for such services.
When your phone number is entered into the tracking software, it gives your location within 550 yards. Zumigo, one of the companies in the reseller chain that goes just below T-Mobile, called this "a way of protecting user's privacy." While this might make sense in the center of a metropolis where even an exact location won’t tell how many hundred yards above or below the ground you're standing, it looks much creepier in a small-town setting.
What the telecom companies and Google had to say
Like after the Securus issue in 2018, T-Mobile, Sprint, and AT&T have promised to shut down access to any companies that misconduct and assured the privacy of their users is their primary concern.
If we were to believe these words, there’s faith in seeing the stop of illegal use of customer's private data, especially after AT&T told on January 10, 2019, that they no longer sell customer's data to third-parties.
But this statement was made only after Motherboard had published the story, which was followed by the federal authorities demanding an investigation. T-Mobile and Verizon also informed about their decision to cancel location-sharing agreements, which came to force only later in March 2019, with Sprint ending the last deal in May 2019. We’re still not sure if all those deals were legal, with Federal Communication Commission (FCC) providing no further comments as of now.
Also, Google made a statement after this story broke out, demanding T-Mobile and Sprint not to share Google's customer data with third-parties.
It turns out, Google has a mobile virtual network operator named Google Fi that uses the infrastructure of the mobile carriers to provide its calling and texting services. Started in 2015, this service is available to US subscribers that use Android and Apple devices in 170 countries. This looks like Google and the telecom companies had no agreement between that would prohibit selling real-time personal information of Google Fi users.
How to stop mobile carriers from selling phone location data
We can only hope that the lawmakers will act to prevent all telecom companies from selling phone location data. Hopefully, this series of unfortunate events would call for a revision of other legal acts that relate to privacy protection and educate us on how our data is being used and how to opt-out when possible.
As of now, mobile carriers are not held accountable for any misuse of phone location data. Therefore, only knowing about the legal repercussions can help minimize the number of third parties tracking your phone location in the foreseeable future.
How to protect yourself from phone location tracking
The biggest problem with protecting yourself from phone location tracking is the same mobile carriers that sell cell tower data. Contrary to the GPS geolocation, which can be turned off, signals between your phone and the towers are constant.
So, the only way you can stop this location tracking is to turn off the phone and remove the battery. For most of us, such a method is unacceptable. Sadly, the alternatives are either using a radio signal jammer or a Faraday cage.
There are many cybersecurity threats, and leaking your phone location data is only one of them. Protecting your mobile internet data, which is also usually on 24/7, is another important action to be taken. Most of us be would be surprised to learn that the majority of our internet connections are unencrypted. This means that the data sent over the network can be easily intercepted and monitored by hackers, the government, or your ISP.
The good thing is that it's easier to avoid mobile data leakage compared to the phone location data. To secure your internet connection, both mobile and wifi, you need to use a VPN. It creates an encrypted tunnel between you and your destination, meaning nobody can see what you're doing and where you're doing it.
The Big Four of the US telecom providers
The US is the third-largest mobile phone user after China and India. There are about 240 million mobile internet users, a number expected to rise to 270 million in the next two years. That should give a perspective on what amount of data is available to those willing to sell it.
AT&T is the second-largest mobile carrier in the US (34%), less than one percent behind Verizon. It has the highest average revenue generated by the user, which may be even higher considering these deals with third parties. Along with Verizon, both are the most valuable mobile carrier brands in the world.
T-Mobile has a 17.5% market share among US carriers. Its major stakeholder is the German telecom company Deutsche Telekom. As of Q3 2018, it had almost 80 million clients.
Sprint had a 12% market share in Q3 2018, which makes it the fourth-largest US mobile network operator. It's thought that this will be the year when Sprint finally merges with T-Mobile to compete with Verizon and AT&T as the third telecom behemoth.
Together, T-Mobile, Sprint, and AT&T have been holding almost 64% of market share since 2011.
Verizon has dodged most of the requests to comment on selling real-time phone tracking data, but it's known that it previously had four contracts with the location-aggregators. Founded in 1983, the company had almost $126 billion of revenue in 2016, with more than 70% coming from the wireless services. While it has around 10 million more users, AT&T's revenue was $160 million.