T-Mobile claimed selling location data without consent is legal—judges disagree

A federal appeals court has upheld a significant ruling against T-Mobile, confirming the company's $92 million fine for unlawfully selling customer location data to third-party entities. This decision follows an investigation by the Federal Communications Commission (FCC), which found that T-Mobile, along with AT&T and Verizon, had shared sensitive location information without proper customer consent. The penalties stem from revelations made in 2018, but it has taken several years for the FCC to finalize these fines. T-Mobile, along with its subsidiary Sprint, challenged the FCC's decisions in multiple courts. However, a three-judge panel from the US Court of Appeals for the District of Columbia Circuit delivered a unanimous verdict against the telecom giant. The court's ruling emphasized the pervasive nature of cell phone tracking, stating, "Every cell phone is a tracking device." It explained how customers' phones connect to the nearest cell towers, transmitting location data that can create a detailed history of an individual's movements, offering insights into their private lives. The judges criticized T-Mobile and Sprint for their previous practices, noting that they sold customer location information to data aggregators like LocationSmart and Zumigo without verifying whether these buyers had obtained the necessary consent from customers. Furthermore, the ruling highlighted the serious consequences of these actions, pointing out that several malicious actors exploited T-Mobile and Sprint's systems to access customer location data without authorization. Even after becoming aware of these breaches, the companies continued their practices without implementing adequate safeguards, leading to the court's stern decision.