An investigation by Viceâ€™s Motherboard finds that top telecommunications companies are selling access to customersâ€™ location data to aggregators, who in turn are selling it to other actors - each more unsavory than the last. Eventually, some of the information ends up in the hands of bail bondsmen and bounty hunters. The report is one more piece of evidence in the case for federal privacy legislation that overhauls todayâ€™s â€śnotice and consentâ€ť regime. These rules must cover not only the tech companies at the center of the conversation but also all actors in the information ecosystem.
The companies implicated in this weekâ€™s story - T-Mobile, AT&T and Sprint - promised to stop selling location data to brokers last year. Evidently, the practice persists.
The telecom companies claim they are in the process of restricting sharing and that they require their third-party clients to ask usersâ€™ permission before tracking. Sometimes, this works well: A car repair service, for example, may send a consumer a text before pinpointing where to send roadside assistance.
The trouble is separating the responsible actors - such as those trusty repairmen, or fraud detectors - from the malicious. Persuading companies to do that separating attentively will prove almost impossible as long as privacy regulations stop at notice and consent; the system makes buck-passing far too simple. A carrier, for example, may mandate that its clients acquire consent from users, inform users that their data will reach third parties only with that consent in hand, and then decide its duty to provide notice is done. What the third parties do is their problem.
A privacy framework that established duties of care, loyalty and confidentiality, similar to what Sen. Brian Schatz of Hawaii and other Democratic senators have proposed for online entities, would help.
Ensuring that a comprehensive privacy framework truly is comprehensive will be tricky. expectations must be, too. But Congress must ensure that the same underlying principles of trust apply to all companies.