Sprint, T-Mobile, and AT&T said they were taking steps to crack down on the misuse of customer location data after an investigation this week found how easy it was for third parties to track the locations of customers.
The announcements were the second promise from carriers in the past year to crack down on data access, and came as lawmakers questioned carriers’ commitment to protecting sensitive information.
In a story published on Tuesday, Motherboard said it had successfully paid a bounty hunter $300 to track the location of a cellphone, providing nothing except the phone’s number. The bounty hunter, the publication reported, was able to track the phone through data from a third-party aggregator called Zumigo. That company provided access from major phone carriers to a location-tracking service called Microbilt, which reportedly offered the service to several industries.
After the publication of the story, lawmakers, including Sens. Kamala Harris (D-CA) and Mark Warner (D-VA), were swift to criticize phone carriers for not adequately protecting their customers’ data. FCC commissioner Jessica Rosenworcel also said in a tweet that the agency “needs to investigate. Stat.”
In a statement to The Verge, Sprint said it won’t “knowingly share personally identifiable geo-location information” except in response to a legal request, but that Zumigo and Microbilt had violated the carrier’s privacy policies. “We took immediate action to ensure Microbilt no longer had access to Sprint location data, and have notified Zumigo that we are immediately terminating our contract,” a spokesperson for the company said.
A T-Mobile spokesperson confirmed to The Verge that the company has “blocked access to device location data for any request submitted by Zumigo on behalf of Microbilt,” and said it was in the process of ending providing access to third-party data aggregators more broadly. The phone described in the Motherboard story was tied to the carrier.
CEO John Legere also said in a tweet that T-Mobile was “ending location aggregator work.”
“We’re doing it the right way to avoid impacting consumers who use these types of services for things like emergency assistance,” he wrote. “It will end in March, as planned and promised.”
AT&T said in a statement that it had stopped partnering with “most” location aggregation services last year. “We are immediately eliminating the remaining services and will be done in March,” a spokesperson for the company said.
Verizon said it had terminated its location services agreement with Zumigo before the story was published. The company said it has also ended similar arrangements, with the exception of some roadside assistance companies, which it is also in the process of ending.
The companies have already made similar pledges in the past. After another scandal over location tracking last year, all four major carriers said in letters to Sen. Ron Wyden (D-OR) that they would end location-sharing agreements with data aggregators like Zumigo. “Major carriers pledged to end these practices, but it appears to have been more empty promises to consumers,” Wyden said in a tweet this week.