The US Supreme Court ruling that overturned Roe v. Wade has once again brought the spotlight on location data privacy — the ways tech companies collect vast amounts of user location data, and work, many times in hand in hand with law enforcement agencies, in complete violation of existing laws and people’s privacy.

The Federal Communications Commission (FCC) is now investigating mobile carriers over their policies around collection, storage and sharing of geolocation data of users. On July 19, FCC Chairwoman Roseworcel sent a communication to top 15 mobile carries asking to explain what they do with mobile location they collect from the users.

The recipients include the big three carriers AT&T, T-Mobile, and Verizon; cable companies Comcast and Charter, which resell mobile service; mobile operators Consumer Cellular, C-Spire, Dish, Google, H2O Wireless, Lycamobile, Mint Mobile, Red Pocket, and US Cellular; and Best Buy Health, which operates the medical-focused Lively mobile service.

The carriers have been given time till August 3, 2022 to respond. 

This comes close on the heels of an announcement by Federal Trade Commission that it too was looking to crack down on “the shadowy ad tech and data broker ecosystem where companies have a profit motive to share data at an unprecedented scale and granularity”.

In a blog post on July 11, Kristin Cohen, Acting Associate Director, FTC Division of Privacy & Identity Protection, wrote that FTC was fully committed to enforcing the law against illegal use and sharing of highly sensitive data, especially when it comes to people’s location, health, and other sensitive information. 

ALSO READ: Google Under Lens Over Promise to Protect User Location Data, Again

What is the FCC saying?

The FCC letter asks carriers to explain how long users’ geolocation data is retained, and why and what the current safeguards are to protect this sensitive information. 

Roseworcel’s communication also seeks to investigate the carriers about their processes for sharing subscriber geolocation data with law enforcement agencies as well as data sharing agreements with other third parties. The carriers have also been asked to explain whether and how consumers are notified when their geolocation information is shared with third parties. 

Stating that mobile internet service providers are uniquely situated to capture a trove of data about their own subscribers, the letter notes that “the highly sensitive nature of this data — especially when location data is combined with other types of data — and the ways in which this data is stored and shared with third parties is of utmost importance to consumer safety and privacy.”

This data includes the subscribers’ actual identity and personal characteristics, geolocation data, app usage, and web browsing data and habits, and could jeopardize a user’s safety and security if not handled properly.

This latest FCC probe is in line with the commission’s continuing attempts to protect user privacy. Earlier, in February 2020, it had held the country’s four largest wireless carriers — AT&T, Verizon, Sprint and and T-Mobile — guilty of improperly disclosing some consumer real-time location data, and imposed penalties of more than USD 200 million. 

At that time, there was largescale outrage over reports that aggregators were able to buy user data from wireless carriers and sell “location-based services to a wide variety of companies” and others, including bounty hunters.

The US communications law prohibits telecom carriers from using or sharing private information except under specific circumstances.

What is the FTC saying?

In her blog, Cohen observed that among the most sensitive categories of data collected by connected devices are a person’s precise location and information about their health. 

“Smartphones, connected cars, wearable fitness trackers, smart home” products, and even the browser you’re reading this on are capable of directly observing or deriving sensitive information about users,” she noted.

Location information of all these consumers are constantly being tracked because these devices regularly ping cell towers, interacting with WiFi networks, capturing GPS signals, and otherwise creating a comprehensive record of their whereabouts. 

Consumer location data can reveal a lot about people — where they work, study, socialize, worship, or even seek medical treatment. “While many consumers may happily offer their location data in exchange for real-time crowd-sourced advice on the fastest route home, they likely think differently about having their thinly-disguised online identity associated with the frequency of their visits to a therapist or cancer doctor,” the FTC noted.

Cohen also pointed to the fact that beyond the obvious location information generated by these devices, millions of people also actively generate their own sensitive data, including by using apps to test their blood sugar, record their sleep patterns, monitor their blood pressure, or track their fitness, or sharing face and other biometric information to use app or device features. “The potent combination of location data and user-generated health data creates a new frontier of potential harms to consumers,” she observed.

Stating that while conversation about technology tends to focus on benefits, the “behind-the-scenes irony” needs to be examined in the open. And the marketplace for this information is opaque and once a company has collected it, consumers often have no idea who has it or what’s being done with it, as once collected, this data “enters a vast and intricate sales floor frequented by numerous buyers, sellers, and sharers”.

ALSO READ: DHS Found Buying Location Data of Millions From ‘Data Brokers’

Calling this a “murky marketplace” of data aggregators and brokers, Cohen pointed particularly to companies that collect information from multiple sources and then sell access to it (or analyses derived from it) to marketers, researchers, and even government agencies.

The misuse of this mobile location data and health information exposes consumers to significant harm. The innocent consumers may be subjected to phishing scams or identity theft, while in worst situations they could be easy target of stalkers. 

Cohen said the FTC would use “the full scope of its legal authorities” to protect consumers’ privacy, and would “vigorously enforce the law if we uncover illegal conduct that exploits Americans’ location, health, or other sensitive data”. 

Post Roe v Wade

Debates over user data privacy has taken the centerstage especially after the US Supreme Court’s decision overturning Roe v. Wade. There are now widespread concerns that harvesting health and location data could be used for profiling and exploiting, and even spying and stalking of people from states where abortion is banned visiting clinics in other states. 

At that time, a few location intelligence players were found selling location data of users to authorities. Last week, Sen. Warren, announced data brokers SafeGraph and Placer.ai made a permanent commitment to not sell location data of individuals visiting abortion clinics.

There are also concerns that the exposure of health information, especially data related to sexual activity or reproductive health, may subject people to discrimination, stigma, mental anguish, or other serious harms.

In addition to this, there is also the spotlight on ways tech companies share this data with even the law enforcement agencies in violating people’s privacy, and thus endangering many innocent people. 

This concern gets further validated with the recent revelation that the Department of Homeland Security (DHS) has been buying, without any warrants, location data of millions of cellphone users from third party players to track movements of civilians.

Acts to protect data privacy

The United States doesn’t have a comprehensive federal law on data privacy, and Congress is under increasing pressure to come up with one soon. There are already a couple of bills that have been introduced in Congress. 

There is a bipartisan legislation that seeks to curtail this overwhelming power of the enforcement that violate people’s privacy. The Fourth Amendment Is Not For Sale Act require the government to secure a court order before obtaining Americans’ data, such as location information from smartphones or from data brokers. 

ALSO READ: Location Data Protection — A Tale of Two Countries

There is another bill similar in nature that seeks to protect the privacy of data. Introduced by Sen. Elizabeth Warren and a group of other Democratic lawmakers in early June, the Health and Location Data Protection Act (HLDPA) seeks to make it “unlawful for data brokers to sell, resell, license, trade, transfer, share, or otherwise provide or make available any of the following forms of data, whether declared or inferred, of an individual”.

In the absence of a federal laws, some states have passed their own laws to protect consumer privacy. It’s time now that state laws such as CCPA serve as pilot programs for members of Congress as they consider how to regulate big tech and move on consumer data privacy.