Here's How Long Your Wireless Carrier Holds on to Your Location Data

The Federal Communications Commission has shared some significant digits: How many years wireless carriers keep location data about their customers. 

Earlier this summer, FCC Chair Jessica Rosenworcel sent a series of inquiries to carriers and resellers about their data privacy policies, specifying an Aug. 3 deadline for replies. The commission shared their replies last week.

The data point to focus on in each response from a wireless service is how long it keeps historical cell site location information (CSLI), since cell towers have to know your location to provide you with service at all (although one reseller called Invisiv is now marketing a service that changes your phone’s identifier to thwart long-term tracking). 

Until the 2018 Supreme Court ruling in Carpenter v. United States, law-enforcement investigators didn’t need a court-issued warrant to get CSLI from carriers. And this location data remains a non-trivlal privacy risk even with that higher barrier to government curiosity.

AT&T’s response (PDF) reveals that it still holds this data for longer than its two big rivals, specifying “a retention period of no more than 13 months for information that identifies the current or past location of a specific individual’s device and five years for historical call detail records, which include cell site location information.”

AT&T also noted that it has Android smartphone vendors embed IQI software in device firmware that “collects device diagnostic and location data on a passive basis (e.g., when a device powers on or contacts a new cell tower), including latitude/longitude information.”

T-Mobile’s reply (PDF) cites a retention period of “up to 24 months” for CSLI and two years for geolocation data gathered from emergency calls, which it says is mandated by law.

Verizon’s input (PDF), meanwhile, cites a retention term of just one year for CSLI but does not mention a longer period for emergency calls. It further notes ”a small number of Verizon-branded applications for consumer mobile devices that obtain express customer permission to collect device location data provided by mobile device operating systems.”

The basic CSLI periods at the big three match what they’ve disclosed earlier.

Recommended by Our Editors

How to Get Google to Quit Tracking Your Location

Relax: Instagram Did Not Turn on 'Precise Location' to Help People Stalk You

This Privacy Service Tries to Prevent Your Cell-Phone Carrier From Tracking You

The FCC also surveyed a variety of wireless resellers, including Google Fi, Consumer Cellular, and Mint Mobile. Their replies generally answered with versions of “talk to the company whose network we resell, because they get that location data and we don’t.”

Dish Network, however, says it has a two-year retention period for cell-site data from the 5G network it’s building out, while Comcast says it keeps location data from mobile usage on its Wi-Fi hotspots for two years.

“Our mobile phones know a lot about us. That means carriers know who we are, who we call, and where we are at any given moment,” Rosenworcel said in a press release. “This information and geolocation data is really sensitive. It’s a record of where we’ve been and who we are.”

That announcement notes that Rosenworcel has asked the FCC’s Enforcement Bureau to investigate carrier compliance with FCC privacy-disclosure rules and invites wireless customers to share privacy complaints and concerns with the commission.