The Possible Privacy Violations of Verizon's Cell Phone Tracking Program

Capitalizing on all the information we put into our cell phones, Verizon Wireless is selling all our app usage and location information to marketers, reports CNET's Declan McCullagh.

Capitalizing on all the information we put into our cell phones, Verizon Wireless is selling all our app usage and location information to marketers, reports CNET's Declan McCullagh. Part of what it calls the Precision Market Insights initiative, Verizon is not only tracking consumers, it is sharing that information with other companies, and possibly linking it to databases with more of your personal information. "We're able to view just everything that they do," Bill Diggins, U.S. chief for the Verizon Wireless marketing initiative, said at an industry conference earlier this year. "And that's really where data is going today. Data is the new oil."

If it sounds creepy, that's because it might not be legal, even though Verizon did the bare minimum to make it sound that way by only selling the information in aggregate and also providing an opt-out feature. Still research by Paul Ohm, a professor at the University of Colorado Law School, who now works at the Federal Trade Commission suggests this might all violate federal wiretapping law because it digs deep into our cell phone transactions, notes McCullagh.* As this stuff gets kind of murky, we spoke with Ryan Calo, an affiliate scholar for the Center for Internet and Society and Assistant law professor at the University of Washington, who explained how exactly this could violate the FTC's privacy guidelines (and also creep you out).

There are a few things that Calo told us to consider in this situation: Anonymity, the ability to opt-out, Verizon's clarity, possible harm, and then the wire tapping issue. Verizon must comply with all of these things, not just one. "Even if you give consumers notice about a particular practice and you permit them to opt-out at least the FTC has been clear that you can't bury the lede," he told The Atlantic Wire. Let's see how the cell phone company did.

Anonymity

What Verizon Is Doing: Verizon has said that it doesn't give these marketers the information of individual customers, but does so in aggregate. For example, if a company wants to know about the behavior of 35 year old white males, they can get the cell phone behaviors of that audience, but not of a specific man in that group.

Does it Pass the Privacy Test? As long as the wireless carrier doesn't give specific URLs to these marketers about your specific behavior and is geared to a general audience, Calo believes that this should be fine.

Opt-Out Option

What Verizon Is Doing: The company does allow users to opt-out of the tracking on the Verizon Wireless websites. Users have to first sign in and head to the My Privacy section of the website. There, the subscriber will apparently find three different boxes to uncheck, as pictured below.

Though, when we went to the site, it did not show up as such, giving us just one "do not track" button to click.

Does it Pass the Privacy Test: Yes, Verizon offers an opt-out option. But the harder it is to opt-out, the more likely it is to violate FTC privacy guidelines. This confusion certainly won't help the wireless carrier's case.

Clarity

What Verizon Is Doing: The company sent out emails to customers informing them of the new policy. It also has a lengthy section on its site explaining the program.

Does It Pass the Privacy Test: Calo compares this to a case in which Sears technically explained everything it did with a similar tracking program, but the FTC came down on it for not giving enough notice to customers.

Harm

What Verizon Is Doing: It claims that the anonymity plus the ability to opt-out avoids incurring any harm on an individual.

Does It Pass the Privacy Test: Not necessarily. "It is totally possible for you to be harmed in a way that implicates privacy, even if the person harming you doesn't know who you are," Calo told us. "Because of Verizon's Precision Market Insights, you end up getting charged more, or end up missing a deal—those are the kinds of things where it doesn't matter where they know who you are." However, he also notes that it doesn't sound like these marketers are using this information for targeted ads, but just to know more about Verizon customers, in which case it's less likely the consumer will be "harmed."

Wiretapping

What Verizon Is Doing: In order to give these marketers this information it is possible Verizon is doing what is called "deep packet inspection." Meaning it giving up more information than we might like. Calo explains it like this: "Verizon has no business figuring out what I'm saying. They need to be able to connect me to Gmail but they don't need to read my communications," he said.

Does It Pass the Privacy Test: If Verizon is indeed doing that deep packet inspection, it could be violate the Wiretap act, says Calo. But, Ryan Radia, associate director of technology studies at the Competitive Enterprise Institute think tank told McCullagh that he thinks the opt-out exonerates Verizon.

*This post originally stated McCullaugh spoke with Paul Ohm. Rather, he was referencing an article he wrote, before he started working at the FTC.