In January 2019, Motherboard journalist Joseph Cox paid $300 to a bounty hunter, a stranger with no law enforcement authority, no badge, and no court order. The bounty hunter located a T-Mobile subscriber’s real-time GPS position using nothing but that person’s phone number. He obtained the location from a data aggregator called Microbilt, which had purchased location data from T-Mobile. This was not a breach. No one hacked anything. It was a commercial transaction. The carrier sold the data, and the aggregator sold access to it. Anyone willing to hand over three hundred dollars could find out where you were standing.
When Cox’s investigation ran in Motherboard on 8 January 2019, it prompted immediate public pledges from AT&T, T-Mobile, Verizon, and Sprint to stop selling location data to aggregators. By the time the FCC completed its formal investigation — years later, in April 2024 — three of the four had not meaningfully done so. The Commission fined AT&T $57 million, Verizon $46.9 million, T-Mobile $31.5 million, and Sprint $12 million (now absorbed into T-Mobile). The combined $148.1 million in penalties represented the largest coordinated FCC privacy enforcement action in the agency’s history.
The fines landed. The practices had already run for years.
What does your mobile carrier know, and does it sell it? Your carrier knows your continuous location (from cell-tower registration), every number you call and that calls you, your data usage, and your device’s permanent IMEI. In 2024 the FCC fined the four major US carriers a combined $148 million for selling real-time location data to aggregators. You can’t stop all of it. But you can opt out of CPNI marketing use, strip carrier-app permissions, use encrypted calls and messages, and (in the EU/UK) file a Subject Access Request. That data also feeds downstream brokers like Acxiom.
What your carrier actually knows about you
No other commercial entity collects quite the same profile as a mobile carrier. Banks know your spending. Google knows your searches. Your carrier knows where your body is, continuously, and who you talk to.
Cell tower triangulation gives carriers your physical location every time your phone registers with the network. That happens constantly, even when you’re not making a call or using data. For smartphones running carrier-integrated location services (which is most of them), this is supplemented by GPS and Wi-Fi-assisted positioning accurate to within a few metres. Your carrier doesn’t just know you were in Manchester on a given Tuesday. It can tell whether you were in a hospital ward or the car park outside.
Call records — every number you dialled and every number that rang yours, with timestamps and call duration — are stored as a matter of course. This metadata is often more revealing than the calls themselves. A pattern of calls to a domestic abuse hotline, an oncologist, or a bankruptcy solicitor tells a story even without a recording. SMS metadata (sender, recipient, timestamp) is similarly retained, though carriers generally do not store message content. Mobile data usage at the domain level is logged for network management purposes. Many carriers historically used deep packet inspection to analyse unencrypted traffic, a practice that drew regulatory scrutiny in the US and UK.
Device identifiers, particularly the IMEI (your handset’s permanent hardware serial number), tie all of this data to a specific device. Even if you change SIM cards or phone numbers, the IMEI links your activity back to the same physical phone.
Law enforcement access to this data runs on a separate track from commercial sharing. Under the Electronic Communications Privacy Act in the US, call records can be obtained with a subpoena — a lower bar than a warrant. The 2018 Supreme Court decision in Carpenter v. United States improved protections for historical cell-site location information, holding that extended location tracking requires a warrant. But the commercial pipeline that Joseph Cox exposed operated entirely outside the law enforcement framework. It moved data from carrier to aggregator to whoever paid, without any legal process at all.
The commercial data pipeline
Carriers describe their location data products using terms like “anonymised,” “aggregated,” and “de-identified.” These descriptions rarely survive contact with technical scrutiny. A 2013 study by Yves-Alexandre de Montjoye at MIT showed that four data points were enough to re-identify 95% of individuals in an anonymised mobile location dataset. The four points: a shop you visited, a station you passed through, a postcode you frequented, and a time. The data carriers sell is not meaningfully anonymous.
The buyers are various. Insurance companies purchase location data to verify accident reports and build actuarial models of driving behaviour. Financial institutions use it for fraud detection — confirming that a customer making an overseas card transaction is actually in that country. Retailers pay for foot traffic analytics: how many people who drove past a Currys also stopped at a competitor? Data brokers sit downstream of all of this, aggregating carrier data with records from other sources and reselling the combined profile.
The FCC’s 2024 enforcement action centred specifically on CPNI, Customer Proprietary Network Information. Section 222 of the Communications Act defines this category to include call records, service details, and associated billing information. Carriers are prohibited from sharing CPNI with third parties without customer consent, subject to narrow exceptions. The Commission found that AT&T, Verizon, Sprint, and T-Mobile had all failed to establish adequate safeguards. They had allowed CPNI to flow to aggregators and downstream buyers in ways the law did not permit. Their internal compliance programmes were inadequate. In some cases, carriers were relying on contractual promises from aggregators that the aggregators were not keeping.
SS7: the infrastructure flaw that’s been there since 1975
Before considering what carriers choose to do with your data, it’s worth understanding a structural vulnerability they cannot easily fix.
Signalling System 7 (SS7) is the set of protocols that allow mobile networks worldwide to communicate. They route calls, verify that a subscriber is reachable on a visited network, and enable roaming. It was designed in 1975. At that time, only a small number of trusted national telecoms operators had access to the system, so authentication wasn’t built in. That assumption has not held.
Today, SS7 access can be legitimately purchased through specialised wholesale carriers. Compromised or corrupt telecom operators in various jurisdictions can also act as back doors into the system. A party with SS7 access can silently query the global network to find which cell tower your handset is registered with. They can intercept SMS messages — including SMS-based two-factor authentication codes. They can redirect calls. They can spoof caller ID. None of this requires physical proximity to you.
Citizen Lab, the University of Toronto research group that investigates digital espionage, documented SS7-based surveillance being sold commercially by the late 2010s. The German magazine Der Spiegel ran detailed reporting in 2014 on how the NSA exploited SS7-adjacent protocols as part of bulk collection programmes. In 2017, the German newspaper Süddeutsche Zeitung reported that SS7 attacks had been used to intercept messages belonging to German parliamentarians. The US Senate Intelligence Committee held hearings on SS7 vulnerabilities in 2017, producing no meaningful legislative remedy.
The protocol still underlies global telecom infrastructure. There is no realistic near-term path to replacing it.
IMSI catchers: surveillance hardware you walk past
IMSI catchers — commercially known as Stingrays, DRTboxes, and other product names sold by Harris Corporation and others — are portable devices that impersonate cell towers. When your phone connects to one, believing it to be a legitimate mast, the device captures your IMSI (International Mobile Subscriber Identity). That number uniquely identifies your SIM card. Higher-capability variants can intercept call content and data traffic.
US law enforcement at federal, state, and local level has purchased these devices extensively. A 2016 investigation by the American Civil Liberties Union identified over 75 agencies in 27 states with confirmed Stingray purchases. That count relied only on documents obtained through public records requests, so it likely undercounts the actual number significantly. The Baltimore Police Department alone used a Stingray over 4,300 times in a seven-year period, largely without obtaining warrants.
The legal status of IMSI catcher use sits in unsettled territory even after Carpenter. That decision addressed historical location data held by a carrier. IMSI catchers operate in real time and capture data before it ever reaches a carrier’s servers. Some law enforcement agencies have argued that this places them outside the warrant requirement. Courts have reached inconsistent conclusions. The Electronic Frontier Foundation maintains a running tracker of known law enforcement IMSI catcher use and relevant case law at eff.org/pages/cell-site-simulators-imsi-catchers.
Private-sector IMSI catcher use — corporate intelligence, stalking, fraud — is illegal in most jurisdictions but technically feasible with equipment that can be purchased on the secondary market.
What the carrier app on your phone is doing
Alongside the network-level data collection, the apps carriers publish for account management conduct their own surveillance.
In 2022, privacy researcher Zach Edwards published analysis showing that several major US carrier apps were running third-party analytics SDKs from advertising companies. These SDKs transmitted device identifiers, behavioural signals, and in some cases location data to advertising networks that had no obvious relationship to managing a phone account. The My AT&T and T-Mobile apps were among those flagged.
The permissions these apps request frequently exceed what account management requires. My AT&T has at various points requested microphone access. Verizon’s app has requested camera access. Contacts access appears in multiple carrier apps. It’s useful for a “find contacts on our network” feature. But that feature does not require the app to retain your contact list on an ongoing basis.
Users have meaningful recourse here. On both iOS and Android, you can open Settings → Privacy (or Privacy & Security on iOS) and review which permissions each carrier app holds. Microphone, camera, and contacts access can be revoked without breaking the app’s ability to pay your bill, check your data usage, or manage your plan. Location access can be set to “only while using” rather than “always” if you want store-finder functionality without continuous background tracking.
The position in Europe
EU residents benefit from a regulatory framework that, at least in principle, treats carrier data as sensitive by default.
The ePrivacy Directive (Directive 2002/58/EC) predates GDPR and specifically addresses the processing of communications data, including location data derived from network activity. Under the Directive, processing traffic and location data for purposes beyond delivering the communication requires explicit consent. Commercial sharing of location data without consent is not permitted.
In practice, enforcement has been uneven. The German Federal Network Agency (Bundesnetzagentur) and French regulator ARCEP have both issued guidance restricting commercial location data sharing. But the major carriers have faced fewer headline fines in Europe for this practice than in the US. Part of this reflects the different structure of European telecom markets; part reflects the pace of regulatory investigations.
In the UK, the ICO has issued guidance on telecommunications data under its post-Brexit data protection framework, which mirrors GDPR in most material respects. The ICO’s position is that location data from mobile networks constitutes personal data and that its commercial use requires a lawful basis. Subject Access Requests directed to UK carriers must be answered within one calendar month.
For EU and UK subscribers, a Subject Access Request to your carrier is a practical starting point for understanding what they hold. Carriers are data controllers for this purpose and are obliged to provide a copy of personal data they process. The request costs nothing and must be fulfilled within 30 days under GDPR, one month under UK GDPR.
What you can actually do about this
The options are real, even if none of them are comprehensive.
Opt out of CPNI sharing for marketing. US carriers are required by the FCC to allow customers to opt out of using CPNI for marketing purposes. This does not cover law enforcement requests or all commercial uses, but it’s a start. AT&T’s opt-out form is at att.com/ecpnioptout. Verizon’s is at verizonwireless.com/privacy/cpni. T-Mobile requires a call to customer service — they do not publish a direct URL for this, which is itself a friction choice. If you’re outside the US, check your carrier’s privacy centre for an equivalent mechanism; EU carriers are required to provide one under ePrivacy rules.
Strip back carrier app permissions. On your phone, go to Settings → Privacy and remove microphone, camera, and contacts access from any carrier app. Keep location on “while using” if you use store-finder features; revoke it entirely if you don’t.
Use end-to-end encrypted calls and messages for sensitive communications. Signal encrypts both call content and message content. WhatsApp encrypts content but retains more metadata. Either one makes carrier-level content interception irrelevant for those conversations, though carrier call and SMS metadata remains available when you use native dialling.
Disable Wi-Fi calling if you want reduced location fingerprinting. Wi-Fi calling routes voice calls through your internet connection rather than the cellular network. That reduces the tower-triangulation data generated. It’s a marginal measure, but it removes one of the continuous location signals your phone emits.
Review your account for unauthorised additions. SIM swapping is one of the more damaging attacks that exploits carrier data systems. A fraudster convinces a carrier to transfer your number to a new SIM they control. Checking your account periodically for lines, extra SIMs, or plan changes you didn’t make costs nothing and catches this early.
File a Subject Access Request if you’re in the EU or UK. Formally asking your carrier what they hold about you does two things. It produces a concrete record you can review. And in aggregate, it creates administrative work for carriers that makes data maximalism less profitable.
The fines the FCC levied in 2024 were the largest the agency had imposed for privacy violations. They were also, for AT&T, roughly 0.2% of the company’s 2023 annual revenue of $122.4 billion. Whether enforcement at that scale changes commercial incentives is an open question. The practices Joseph Cox documented in 2019 reflected a broader pattern. Someone could buy real-time location for $300 through a chain of commercial transactions. It was an industry where the financial rewards of location-data trading vastly exceeded the perceived regulatory risk. Whether the 2024 fines shifted that calculus will become apparent only when the next investigation is published.
Want to see what data about you is already circulating online? Walk through an example exposure report →. It’s an interactive example, not a live scan of your own data. KnytX Shield isn’t live yet; join the waitlist to run yours at launch.