How your mobile carrier makes money off some of your most sensitive data

T-Mobile, AT&T, and Verizon all have personalized advertising programs that sell your data. | John Lamparski/SOPA Images/LightRocket via Getty Images

T-Mobile’s new personalized ad program is invasive — and common.

T-Mobile raised a few eyebrows — and got some unflattering press attention — when the Wall Street Journal reported on its new privacy-invasive ad program. Beginning April 26, T-Mobile says it will use its customers’ web browsing and app usage data to sell targeted ads unless those customers opt out.

It sounds very creepy. No one likes to think that someone is watching and cataloging all the websites they visit. But it’s also a good example of just how much of our data can be and is collected through our mobile devices and how few rules there are for the carriers we’re forced to trust with it.

It’s not really clear what T-Mobile’s new program is or how it differs from T-Mobile’s current personalized ads program. As a T-Mobile customer, I was personally annoyed to discover that I was automatically opted in to this program, which uses data including the apps on my phone and “broadband information” to target ads to me. T-Mobile did not respond to a request for clarification, but said it would share more about its ad partnerships when the new privacy policy takes effect at the end of April.

What T-Mobile is doing isn’t unusual, however, and it’s not new. Verizon and AT&T have been doing this for years. Mobile carriers figured out a long time ago that they have two ways of making money off of their customers: what those customers pay to use their services, and then, what carriers earn by selling the data those paying customers provide as they use those services. The former is clear and obvious to the customer, especially when the monthly bill comes due. The latter is buried under lengthy and confusing privacy policies and account settings, and most customers don’t even know it’s happening.

Here’s how this works: When you use a carrier’s cellular network (LTE, 4G, 5G, etc.), that carrier then knows what sites you visit, mobile apps you use, phone calls you make — basically anything you do over its network, unless you’ve taken measures to obscure it, like using an encrypted messaging service like Signal or a mobile VPN. There are privacy laws that limit some of what your carrier can disclose or use without your express permission (or a court order), but marketing off of data that isn’t attached to personally identifiable information is generally fine. So that’s what they do.

T-Mobile’s new program is notable because it’s more aggressive in the kinds of data it collects and the fact that customers are automatically enrolled in it. Verizon’s and AT&T’s personalized ad programs that use web browsing information — Verizon Selects and AT&T’s Enhanced Relevant Advertising program, respectively — are opt-in.

“Our customers must make an affirmative choice to opt in to our plans that would allow the use of location information or where customers go on the web to serve third-party advertisement,” a Verizon spokesperson told Recode.

But alongside the opt-in programs, Verizon and AT&T also automatically enroll you in their other advertising programs that collect less detailed information.

AT&T has “Relevant Advertising,” which uses your “non-sensitive information” (age range, zip code, gender) to target you with ads, including those served up by its digital and TV ad network, Xandr, which is named after Alexander Graham Bell, who invented phones and surely never saw something like this coming out of them. AT&T also sells your data to third parties to target you with ads.

Verizon has its Business and Marketing Insights and Relevant Mobile Advertising programs. Business and Marketing Insights sells aggregate information to other businesses that might want to know how many Verizon users in a certain demographic go to a website or walk into a store or use an app. Relevant Mobile Advertising uses your general information — pretty much the same stuff as AT&T’s Relevant Advertising program — and also shares that information with its own Verizon Media ad platform and network, which sends targeted ads to websites, apps, even your TV.

In addition to those two programs, Verizon also opts you into sharing your Customer Proprietary Network Information (for example, the calls you make and receive) with its own companies and affiliates to market more Verizon products and services to you. Verizon says it has to obtain your consent to do this, but it also considers you not opting out within a certain amount of time to be consent.

So all of these mobile carriers are still trying to make money off of your data, just less intimate types of it.

As the Wall Street Journal pointed out, Verizon’s and AT&T’s ad operations are far bigger than T-Mobile’s, so maybe T-Mobile is just trying to play catch-up here, and it’s being a little sneaky to get as many users as possible on board. It’s also trying to get its new, post-merger Sprint customers, who previously had to opt in to this kind of data collection and use, on the same page as the existing T-Mobile users.

There is a little bright spot here: These companies claim that they don’t attach your personal information, like your real name or address, to this data. They either just lump you in with a large anonymous pool of customers to use as aggregate data, or they assign a unique identifier to you, attach a bunch of categories based on interests or demographic information inferred from your data to that identifier, and then give that to third-party advertisers to target their ads to. That’s supposed to prevent advertisers from knowing your real identity, but depending on what’s used as an identifier and how specific the data attached to that identifier is, it could be easy enough to re-identify you through it. You just have to trust that T-Mobile (or Verizon or AT&T) and their advertising partners won’t do that.

Unless you live in Maine, these companies don’t have to get your permission to collect a lot of this stuff. They’re not exactly careful with your data either, as demonstrated by the many Federal Communication Commission (FCC) fines these companies have incurred over the years for violating the few privacy rules that do exist.

It doesn’t have to be this way. The Obama-era FCC tried to enact privacy rules that would have required broadband service providers to get users’ permission before sharing certain information, including websites they visit and apps they use. But the Republican-led Congress overturned those rules a few months after Trump took office.

“The FCC needs to revisit this issue ASAP,” Alan Butler, executive director and president of the Electronic Privacy Information Center (EPIC), told Recode.

But the FCC has not revisited this issue yet, so T-Mobile and the others can still collect, use, and profit off of your data for now, while you actually pay them for the privilege. They also give you ways to opt out, so why not use them?

T-Mobile:

On the web: Go to T-Mobile.com > Account > Profile settings > Privacy and Notifications > Advertising & Analytics > Turn off “Use my data to make ads more relevant to me” and “Use my data for analytics and reporting.”

On the T-Mobile app: Go to “More” on the menu bar > Advertising & Analytics > Turn off “Use my data to make ads more relevant to me” and “Use my data for analytics and reporting.”

Verizon

On the web: Go to www.VerizonWireless.com/myprivacy > Select “Don’t share” for Customer Proprietary Network Information, Business & Marketing Insights, and Relevant Mobile Advertising.

On the Verizon app: Go to “More” on the menu bar > Tap the gear icon for Account Settings > Manage Privacy Settings > Switch off Customer Proprietary Network Information, Business & Marketing Insights, and Relevant Mobile Advertising.

AT&T

On the web: Go to AT&T’s “Consent Dashboard” > Relevant Advertising > switch allow use to “No.”

On the AT&T app: Go to “More” on the menu bar > Profile > Data & Privacy > Privacy settings > Relevant Advertising > Switch allow use to “No.”

Also, you might as well check out Verizon’s and AT&T’s “opt-in” personalized ads while you’re at it, just to make sure you haven’t opted in without realizing it via a sneaky pop-up with a lot of fine print (the owners of the AT&T account I used to research this article, for example, had no idea when or how they opted into Enhanced Relevant Advertising). For AT&T, just follow all the instructions above, but click on “Enhanced Relevant Advertising.” For Verizon, follow the instructions above, but click on “Verizon Selects.”

Of course, you can always opt into (or stay opted into) all of these ad programs if you’re happy enough trading some of your most sensitive data for a personalized ad experience, which these companies insist is something customers want. According to a report from AT&T’s Xandr ad platform (consider the source), two-thirds of people surveyed “wish advertisements were more relevant to them and their lifestyle.”

I have never personally met one of those people despite their supposed majority in the population, but apparently they do exist somewhere.

Open Sourced is made possible by Omidyar Network. All Open Sourced content is editorially independent and produced by our journalists.