DC Circuit Affirms FCC Privacy Authorities in Location Data Action Against Sprint/T-Mobile

On August 15, the DC Circuit U.S. Court of Appeals unanimously upheld the FCC’s enforcement orders against Sprint and T-Mobile for the telecommunications companies’ inadequate oversight of data aggregators, resulting in misuse of phone subscriber location information.

In 2024, the FCC issued Forfeiture Orders to Sprint and to T-Mobile amounting to tens of millions of dollars each, following up on the agency’s 2020 Notices of Apparent Liability to the then-two carriers for their role in the widely-publicized shady market of real-time location information brokering. Sprint/T-Mobile challenged the FCC’s authority to take this action, arguing that the agency was trying to police data practices beyond the scope of the privacy authorities granted by Congress and that the agency’s ability to assess monetary penalties was unconstitutional.

EPIC filed an amicus brief in this case in support of the FCC’s privacy authorities, joined by the Center for Democracy and Technology, Electronic Frontier Foundation, Privacy Rights Clearinghouse, and Public Knowledge, emphasizing the unique sensitivity of location data and the clear indications from Congress that the FCC’s authority to regulate Customer Proprietary Network Information (CPNI) includes subscriber location information, even when that phone subscriber is not actively on a phone call. The DC Circuit agreed, holding that: “the Commission’s interpretation is the best and most straightforward interpretation of the Communications Act: The location information at issue plainly constitutes CPNI.”

EPIC filed a similar amicus brief in the Second Circuit in support of the corresponding FCC enforcement action against Verizon.

EPIC regularly advocates for policies that strengthen data security for consumer information, protecting data from unauthorized access and other misuse.