AT&T hit with lawsuit over sale of customers' location data

The Electronic Frontier Foundation is suing AT&T and two data aggregation services over the sale of customers' location data. In a lawsuit filed Tuesday in US District Court for the Northern District of California, the EFF alleges that AT&T sold customers' real-time location data to credit agencies, bail bondsmen and other third parties "without the required customer consent and without any legal authority."

AT&T -- along with Verizon, T-Mobile and Sprint -- came under fire earlier this year after a Motherboard story revealed that major mobile carriers were selling customer location data to third parties. Carriers offered location data for legitimate services, such as fraud prevention and emergency roadside assistance, but the information was frequently abused by data buyers to track people. AT&T in January said it would cut off all location aggregation services by March.

The lawsuit, filed on behalf of three AT&T wireless customers, also singles out data aggregators LocationSmart and Zumingo. In the suit, the EFF alleges that AT&T violated the Federal Communications Act, the California Unfair Competition Law and the California Consumers Legal Remedies Act, and that all three companies violated the California Constitutional Right to privacy.

Watch this: AT&T 5G network has some of the fastest speeds we've seen

09:40

An AT&T spokesman said the carrier plans to fight the lawsuit.

"The facts don't support this lawsuit," a spokesman said in an emailed statement Tuesday. "Location-based services like roadside assistance, fraud protection, and medical device alerts have clear and even life-saving benefits. We only share location data with customer consent. We stopped sharing location data with aggregators after reports of misuse."

LocationSmart offered a similar response. 

"LocationSmart will fight this lawsuit because the allegations of wrongdoing are meritless and rest on recycled falsehoods," the company said in an emailed statement. "LocationSmart's API platform facilitates life-saving and other vital location-based services, which require end-user consent."

Zumigo didn't respond to a request for comment. The EFF also didn't immediately respond to a request for additional comment.

Originally published July 16, 10:15 a.m. PT.
Update, July 18: Adds comment from LocationSmart.