Analysis of carrier data sent to FCC: 10 of the top 15 US carriers collect geolocation data and don't let users opt out; most keep data for two years on average
Ten of the top 15 mobile carriers collect geolocation data and provide no way for consumers to opt-out, according to information …
Context & Ripple Effects
The carrier disclosures draw a line between ending third-party sales and limiting collection itself. In 2019, AT&T, Sprint, T-Mobile, and Verizon told the FCC they had stopped selling customer location data to third parties, after earlier reporting exposed carrier-connected access to real-time location information through LocationSmart.
The new analysis shows that, despite that retreat from resale, location-data retention and consumer control remain unresolved across much of the carrier market. It gives the FCC a clearer record of where carrier privacy practices extend beyond the prior middleman controversy.
First-order effects
- Customers of the 10 identified carriers lack an opt-out for geolocation collection, while those carriers retain a record of users' movements for roughly two years on average.
- The disclosures put carriers' collection and retention policies—not only their past data-sharing arrangements—under direct FCC and public scrutiny.
Second-order effects
- Carriers that previously emphasized the end of location-data sales must distinguish that commitment from their continuing collection and retention practices.
- The findings strengthen the case for privacy comparisons to focus on opt-out rights and retention periods, creating pressure on carriers with less user control to explain or revise their policies.
Third-order effects
- If FCC disclosures continue to reveal wide variation in carrier practices, location privacy governance is likely to shift from policing third-party access toward standards for collection, consent, and retention at the network level.
The trend: US mobile-location privacy is moving from a narrow focus on data resale to scrutiny of carriers' own long-term collection and user-control policies.