Second Circuit Affirms FCC Privacy Authorities over Subscriber Location Data, Similar to Recent DC Circuit Decision

On Wednesday, September 10, the Second Circuit unanimously upheld the FCC’s enforcement order against Verizon for the telecommunications companies’ inadequate oversight of data aggregators, resulting in misuse of phone subscriber location information.

In 2024, the FCC issued a Forfeiture Order to Verizon amounting to more than $45 million dollars, following up on the agency’s 2020 Notice of Apparent Liability to the carrier for its role in the widely-publicized shady market of real-time location information brokering. Verizon challenged the FCC’s authority to take this action, arguing that the agency was trying to police data practices beyond the scope of the privacy authorities granted by Congress and that the agency’s ability to assess monetary penalties was unconstitutional.

EPIC filed an amicus brief in this case in support of the FCC’s privacy authorities, joined by the Center for Democracy and Technology, Electronic Frontier Foundation, Privacy Rights Clearinghouse, and Public Knowledge, emphasizing the unique sensitivity of location data and the clear indications from Congress that the FCC’s authority to regulate Customer Proprietary Network Information (CPNI) includes subscriber location information, even when that phone subscriber is not actively on a phone call. The Second Circuit agreed, holding that the: “customer data at issue plainly qualifies as customer proprietary network information, triggering the Communication Act’s privacy protections.”

EPIC filed a similar amicus brief in the DC Circuit in support of the corresponding FCC enforcement action against Sprint/T-Mobile.

EPIC regularly advocates for policies that strengthen data security for consumer information, protecting data from unauthorized access and other misuse.