Cybersecurity Policy Report, FCC Defends Fine Against Verizon for Selling Location Information, (Jan 31, 2025)

By Paul Kirby

The FCC has defended its decision to impose a nearly $47 million fine against Verizon Communications, Inc., “for illegally sharing access to customers’ location information without consent and without taking reasonable measures to protect that information against unauthorized disclosure.”

On 3-2 votes over the dissents of Republican Commissioners Brendan Carr and Nathan Simington, the Commission took the action last year (CPR, April 29, 2024). In all, the FCC adopted forfeiture orders fining T-Mobile US, Inc. (including Sprint), AT&T, Inc., and Verizon nearly $200 million.

The orders against T-Mobile and AT&T are on appeal at the D.C. and Fifth Circuits, respectively.

“The Commission properly concluded that the statutory definition of ‘customer proprietary network information’ includes the customer location data at issue here. Section 222 of the Communications Act expressly covers ‘location’ information, and Verizon customers share that information with Verizon solely because they must do so to use the services they purchase from it, not for some unrelated reason. Verizon’s effort to restrict CPNI to only ‘call location information’ is at odds with its own prior practice as well as with the statute itself, which defines CPNI to include all ‘location’ information while using the narrower phrase ‘call location information’ elsewhere,” the FCC said in a Brief for Respondent, Verizon Communications, Inc., v. FCC, No. 24-1733 (2nd Cir. Jan. 17, 2025).

“The Commission’s conclusion that Verizon failed to protect its customers’ location information is reasonable and well-supported by the record,” the FCC added. “‘[T]he record not only shows that Verizon did not have reasonable protections in place prior to [the] 2018 New York Times article detailing the Securus/Hutcheson breaches, but also that Verizon failed to promptly address its demonstrably inadequate CPNI safeguards after [the] Securus/Hutcheson disclosure,’” the FCC added, quoting from its order.

The FCC also said that its “forfeiture procedures did not deprive Verizon of any Seventh Amendment jury-trial right because Verizon had the opportunity to demand a de novo jury trial in a Section 504(a) enforcement suit before the government could make it pay the forfeiture. Instead, it waived that opportunity by electing to pay the penalty and seeking direct review in this Court instead. In any event, the Seventh Amendment provides no jury-trial right for claims that, like those here, involve public rights, rather than private rights with a common-law analogue.”

Meanwhile, the oral argument in the appeal filed by AT&T in the Fifth Circuit is scheduled for Monday, while the T-Mobile oral argument in the D.C. Circuit is scheduled for March 24.

News: FederalLegislation DataPrivacy LitigationEnforcement