A class action lawsuit has been filed against the four most popular telecommunications companies in the United States – Verizon, Sprint, AT&T, and T-Mobile.  The lawsuit alleges the four industry players “violated customers’ privacy by sharing their data to third party brokers.  In turn, these brokers would then sell the data to bounty hunters, bail bondsmen, debt collectors, and middlemen.”

According to the high-profile complaint, the telecommunications companies routinely shared phone numbers, geolocation data, and other account information with these third parties.  The class action covers approximately 300 million customers ranging from April 30, 2015 and February 15, 2019 spread out between the four companies.

“Through its negligent and deliberate acts, including inexplicable failures to follow its own Privacy Policy, T-Mobile permitted access to Plaintiffs and Class Members’ CPI and CPNI,” the original complaint against T-Mobile specifically reads, referring to “confidential proprietary information” and “customer proprietary network information.”

The class actions centers around whether each company violated section 222 of the Federal Communications Act (FCA), which says that the “companies are obligated to protect the CPI and CPNI of its customers,” and whether the Plaintiff’s and Class Members’ CPNI was accessible to unauthorized parties during the period of time covered.

In January of this year, an investigation by Motherboard revealed the alleged data sharing, and a subsequent report detailed how a bounty hunter was able to track a phone’s location with nothing more than a phone number through third-party services that receive real-time data from the companies at the center of it all.  Motherboard paid a $300 fee for this information.

The Motherboard experimental report reads, “Nervously, I gave a bounty hunter a phone number. He had offered to geolocate a phone for me, using a shady, overlooked service intended not for the cops, but for private individuals and businesses.  Armed with just the number and a few hundred dollars, he said he could find the current location of most phones in the United States.  The bounty hunter sent the number to his own contact, who would track the phone…The contact responded with a screenshot of Google Maps, containing a blue circle indicating the phone’s current location, approximate to a few hundred meters.  Queens, New York. More specifically, the screenshot showed a location in a particular neighborhood—just a couple of blocks from where the target was.  The hunter had found the phone.”

Motherboard also previously reported that as many as 250 bounty hunters had access to AT&T, T-Mobile, and Sprint location data from another company involved in the bail bond industry.  The name of the company was not revealed.  Some of that data included “highly precise assisted GPS data,” which is usually accessible only to 911 responders.

Fifteen U.S. Senators called on the FCC and FTC to conduct an investigation into the four companies and the data selling practice after the Motherboard results broke, leading to the current class action.  The original lawsuits were filed against Z Law, which bills itself as a “consumer protection law firm.”  Attorneys are seeking unspecified damages which will be determined at trial.