The Federal Communications Commission will seek hundreds of millions of dollars in fines from America’s four largest wireless companies after company officials apparently lied to Congress and regulators about ending the lucrative sale of customer locations to third parties in early 2019.

The Wall Street Journal reported the FCC has sent Notices of Apparent Liability to Verizon, AT&T, T-Mobile, and Sprint accusing the companies of continuing to sell the real-time locations of customers after telling Congress they would stop.

The companies allegedly routinely sold personal customer data to middlemen companies that had very few controls over who ultimately received that information. Clients included private investigators, debt collectors, police agencies, and even potentially ex-partners engaged in stalking. Customers have never been clearly informed that their location data was subject to resale to third parties, and privacy concerns were immediately raised after revelations data aggregators LocationSmart, Inc., and Zumigo, Inc., were selling data to inappropriate entities and individuals.

After being exposed in early 2019, all four carriers promised to end or curtail the practice, but an FCC investigation found carriers were not being forthright.

In January, FCC Chairman Ajit Pai disclosed the practice because of ongoing oversight by the House Energy and Commerce Committee, which had demanded an investigation by the FCC early last year. In a letter to the Committee, Pai wrote that the agency found U.S. carriers “apparently” broke the law by continuing to sell location data.

“I am committed to ensuring that all entities subject to our jurisdiction comply with the Communications Act and the FCC’s rules, including those that protect consumers’ sensitive information, such as real-time location data,” Pai wrote.

Too little, too late, according to Rep. Frank Pallone (D-N.J.), who chairs the Committee.

(Image by Brad Jonas originally for Pando.com)

“Following our longstanding calls to take action, the FCC finally informed the Committee today that one or more wireless carriers apparently violated federal privacy protections by turning a blind eye to the widespread disclosure of consumers’ real-time location data,” Pallone said in a statement in January, 2019. “This is certainly a step in the right direction, but I’ll be watching to make sure the FCC doesn’t just let these lawbreakers off the hook with a slap on the wrist.”

Today’s revelations infuriated Sen. Ron Wyden (D-Ore.) who tweeted:

“Ajit Pai has failed to protect consumers at every turn. This issue came to light after my office and dedicated journalists discovered how wireless carriers shared Americans’ locations without consent. He investigated only after public pressure mounted.”

Consumers often unwittingly share their real-time locations with cell phone providers whenever their phones are switched on and connected to a cellular or Wi-Fi network. Carriers have developed a lucrative business reselling that information to third parties, typically data aggregators that combine location information with data collected from other companies and sell it on. Buyers often include law enforcement agencies and private investigators, but one reporter found it simple as an individual to get real-time data about his location by paying $300 to a data aggregator. Privacy advocates worry that stalkers could easily track their victims through such services, with victims unaware their own cell phone company betrayed their location in return for money.

A Notice of Apparent Liability demands a written response from a targeted individual or company to explain why they should not be subject to the monetary penalty specified in the letter. Many companies win significant reductions or fine waivers through negotiations with the FCC. The Journal reports that so far, the FCC has not been willing to offer settlements, but that could change as carriers try to negotiate a settlement through the agency’s administrative process.

The article does not specify the exact fines targeted for each carrier. AT&T and Verizon have more than adequate financial resources to pay almost any fine in full. But a multi-million fine against T-Mobile and Sprint could complicate the final agreement between T-Mobile and Sprint to merge, which is expected to happen in the coming weeks. Under the revised merger agreement, both companies agreed to split any expenses related to liabilities up to $200 million, leaving Sprint investor-owner SoftBank responsible for the rest.