Court Rejects Verizon Claim That Selling Location Data Without Consent Is Legal

An anonymous reader quotes a report from Ars Technica: Verizon lost an attempt to overturn a $46.9 million fine for selling customer location data without its users' consent. The US Court of Appeals for the 2nd Circuit rejected Verizon's challenge in a ruling (PDF) issued today. The Federal Communications Commission fined the three major carriers last year for violations revealed in 2018. The companies sued the FCC in three different courts, with varying results.

AT&T beat the FCC in the reliably conservative US Court of Appeals for the 5th Circuit, while T-Mobile lost in the District of Columbia Circuit. Although FCC Chairman Brendan Carr voted against (PDF) the fine last year, when the commission had a Democratic majority, his FCC urged the courts to uphold the Biden-era decisions. A ruling against the FCC could gut the agency's ability to issue financial penalties. The different rulings from different circuits raise the odds of the cases being taken up by the Supreme Court.

Today's 2nd Circuit ruling against Verizon was issued unanimously by a panel of three judges, and it comes to the same legal conclusions as the DC Circuit did in the T-Mobile case. The court did not accept the carrier's argument that the fine violated its Seventh Amendment right to a jury trial and that the location data wasn't protected under the law used by the FCC to issue the penalties. 'We disagree [with Verizon],' the 2nd Circuit ruling said. 'The customer data at issue plainly qualifies as customer proprietary network information, triggering the Communication Act's privacy protections. And the forfeiture order both soundly imposed liability and remained within the strictures of the penalty cap. Nothing about the Commission's proceedings, moreover, transgressed the Seventh Amendment's jury trial guarantee. Indeed, Verizon had, and chose to forgo, the opportunity for a jury trial in federal court. Thus, we DENY Verizon's petition.' Until 2019, the ruling said Verizon operated a location-based services program that sold customer location data through intermediaries like LocationSmart and Zumigo, who then resold it to dozens of third-party entities. Instead of directly managing consent and notifications, Verizon 'largely delegated those functions via contract' to its partners, a system that came under scrutiny after a 2018 New York Times report exposed security breaches.

One major misuse involved Securus Technologies, which 'was misusing the program to enable law enforcement officers to access location data without customers' knowledge or consent, so long as the officers uploaded a warrant or some other legal authorization,' the ruling said. Verizon argued that Section 222 of the Communications Act only covered call-location data, but the court ruled that device-location data also qualifies as protected customer information.

Read more of this story at Slashdot.