Court rejects Verizon claim that selling location data without consent is legal

"Instead of providing notice to customers and obtaining or verifying customer consent itself, Verizon "largely delegated those functions via contract," the court said. This system and its shortcomings were revealed in 2018 when "the New York Times published an article reporting security breaches involving Verizon's (and other major carriers') location-based services program," the court said."

"Verizon claimed that Section 222 of the Communications Act covers only call-location data, as opposed to device location data. The court disagreed, pointing to the law's text stating that customer proprietary network information includes data that is related to the location of a telecommunications service, and which is made available to the carrier "solely by virtue of the carrier-customer relationship." "Device-location data comfortably satisfies both conditions," the court said."

"As for Verizon's claim that the FCC violated its right to a jury trial, the court said that "Verizon could have gotten such a trial" if it had "declined to pay the forfeiture and preserved its opportunity for a de novo jury trial if the government sought to collect." Instead, Verizon chose to pay the fine "and seek immediate review in our Court.""

Verizon delegated customer notice and consent functions to third parties by contract, creating oversight gaps. Security shortcomings emerged after a 2018 New York Times report on location-based services breaches. Securus Technologies misused the program to allow law enforcement access to location data without customer knowledge or consent when officers uploaded legal authorization, and a Missouri sheriff accessed data with no legal process because Securus did not review documents. The court interpreted Section 222 to cover device-location data as customer proprietary network information related to telecommunications location and available solely via the carrier-customer relationship. Verizon paid the FCC forfeiture and thereby did not preserve a de novo jury trial.

Read at Ars Technica