The Federal Communications Commission fined major wireless carriers AT&T, Sprint, T-Mobile and Verizon nearly $200 million for illegally sharing customer location data without consent. A 2020 investigation revealed that the carriers had been distributing users’ geolocation details to third parties, including to prisons. T-Mobile and Sprint merged after the investigation began.

Despite promising to end these practices in 2018, the FCC said the companies took more than a year to actually stop them.

The carriers sold “real-time location information to data aggregators, allowing this highly sensitive data to wind up in the hands of bail-bond companies, bounty hunters, and other shady actors,” FCC Chair Jessica Rosenworcel said in a statement.

In a statement, AT&T argued that the order is unjustified and lacks legal and factual basis. The company claimed it was unfairly blamed for another company’s violations and that its efforts to rectify the issue were overlooked.

T-Mobile stated that it stopped sharing data with location-based services through third-party aggregators over five years ago. The carrier emphasized its commitment to protecting customer data but called the FCC’s decision incorrect and the fine excessive.

A Verizon spokesperson expressed the company’s dedication to customer privacy, noting that they terminated the offending party, ended the program, and took steps to prevent similar incidents.

The FCC stated that carriers are required to keep customer data private unless they have explicitly obtained user consent.

The carriers have expressed intentions to appeal, disputing the FCC’s findings and the legality of the fines.