$196 Million, Three Circuits and a Supreme Court Ruling: The FCC's Carrier Location Data Fines

The 2024 Forfeiture Orders

On April 29, 2024 the Federal Communications Commission announced fines against AT&T, Verizon, T-Mobile and Sprint for selling access to customers' location information without consent and without reasonable measures to protect it. The four orders, adopted April 17, 2024 and released April 29, finalized Notices of Apparent Liability the Commission had issued on February 28, 2020. Each order found the carrier liable for willfully and repeatedly violating section 222 of the Communications Act and section 64.2010 of the Commission's rules.

The orders ran on a common method. Each identified the location-based services program the carrier operated, counted the third parties with access to customer location data, and treated every relationship that remained open more than 30 days after the New York Times report of May 10, 2018 as a separate continuing violation. The AT&T order describes the base calculation as $40,000 for the first day of each violation and $2,500 for each later day, followed by an upward adjustment the Commission tied to the nature of the violations and the risk of harm.

The assessed amounts total $196,486,875. Two were cut on the record. The Verizon order reduced the proposed figure by $1,417,500 after Verizon showed that two entities included in the count never participated in its program. The T-Mobile order reduced its figure by $11,550,000 to reflect corrected termination dates and eight entities that had been counted twice, which brought T-Mobile's total of third parties from 83 to 75. The press release notes that the law does not permit a forfeiture to increase after the notice stage.

The statutory ceiling mattered to the arithmetic. The AT&T order states the inflation-adjusted limits it applied: up to $204,892 for each day of a continuing violation, and no more than $2,048,915 for any single act or failure to act. Counting one violation per third-party relationship, rather than one failure across the whole program, is what allowed totals in the tens of millions.

Location Data as CPNI

Each order rested on a threshold finding that the location data the carriers sold is customer proprietary network information. Section 222(h)(1)(A) defines CPNI as information relating to the "quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service" that is made available to the carrier "solely by virtue of the carrier-customer relationship." The AT&T order concluded that the data met the first prong because it related to the location of the carrier's commercial mobile service, and the second because a phone connects to the network, and reveals where it is, only because the customer subscribes.

The orders then applied section 64.2010(a), which requires carriers to take reasonable measures to discover and protect against attempts to gain unauthorized access to CPNI, and section 217 of the Act, which deems the act or omission of a carrier's agent to be the carrier's own. The Commission's position was that a carrier could not hand its consent obligations to downstream companies by contract and then treat the resulting failures as someone else's.

The Commission did not reach that conclusion unanimously. According to the D.C. Circuit's account of the orders, Commissioner Carr agreed with the carriers that the information was not CPNI, and Commissioner Simington disputed dividing a single, systemic failure into many continuing violations. Both questions went to the courts.

The Aggregator Programs

All four carriers ran the same model. Each sold access to customer location data to two aggregators, LocationSmart and Zumigo, which resold it to location-based service providers and sometimes to intermediaries that resold it again. The AT&T order counts 88 third parties with access through that chain; the Verizon order counts 67, the Sprint order 86, and the corrected T-Mobile figure is 75. Consent was the downstream provider's job under the contracts. The AT&T order records that the carrier did not verify consent before providing access and instead checked daily that each request was tied to a consent record.

The program that broke the model was run by Securus Technologies, which offered a location-finding service to law enforcement and corrections officials. The AT&T order quotes the government's sentencing memorandum in the prosecution of Cory Hutcheson, a former Missouri sheriff: users certified by checkbox that an uploaded document authorized the lookup, the platform returned the location regardless of what was uploaded, and Hutcheson uploaded documents that included his health insurance policy, his auto insurance policy and pages from sheriff training materials. According to the memorandum he "submitted thousands of Securus LBS requests and obtained the location data of hundreds of individual phone subscribers without valid legal authorization." He pleaded guilty on November 20, 2018.

The Securus service had not been reviewed as an approved use, and the AT&T order states that AT&T could not distinguish its requests from those of the approved inmate-calling service because each came with an identical consent record. The forfeitures were not for the Securus disclosures themselves, which the 2020 notices addressed by admonishment. They were for what each carrier did, and did not do, during the months after May 2018 while the programs kept running.

Jury Trial Challenges After Jarkesy

The Communications Act gives the Commission two routes to a forfeiture. One is a formal hearing under section 503(b)(3). The other, used here, is the notice route in section 503(b)(4): a notice of apparent liability, a written response, and then an order that determines liability and assesses a penalty. A recipient can pay and petition a court of appeals for review on the administrative record, or it can decline to pay. In that case section 504(a) makes the penalty recoverable only in a civil suit by the United States, which "shall be a trial de novo."

All four carriers paid and petitioned for review. Each argued, among other things, that a penalty imposed through this process without a jury violated the Seventh Amendment under SEC v. Jarkesy (2024), in which the Supreme Court held that the SEC could not impose civil penalties for securities fraud in its in-house process. Because the carriers filed in three different circuits, the same question was decided three times in 2025.

How the Circuits Ruled

Fifth Circuit, AT&T. On April 17, 2025 a panel granted AT&T's petition and vacated the order, holding that the enforcement procedure violated the Seventh Amendment and Article III. On denying rehearing en banc the court withdrew that opinion and substituted a revised one, filed August 22, 2025 and reported at 149 F.4th 491. Judge Haynes concurred in the judgment only. The court resolved the case on the constitutional ground and stated that it need not reach AT&T's other issues, including whether the Commission had statutory authority and whether the order was arbitrary and capricious. It did not decide whether the location data is CPNI.

D.C. Circuit, Sprint and T-Mobile. On August 15, 2025 the court denied the consolidated petitions. On the jury question it held that it need not decide whether the Seventh Amendment applied, because the statute gave the carriers a jury trial before any legal consequence and they waived it by paying. On the merits it held that "the Commission's interpretation is the best and most straightforward interpretation of the Communications Act: The location information at issue plainly constitutes CPNI." It upheld the per-relationship violation count as a reasonable exercise of discretion, noting in a footnote that the carriers had forfeited any statutory challenge to it by raising it only in cursory fashion.

Second Circuit, Verizon. On September 10, 2025 the court denied Verizon's petition. It concluded that device-location data is statutorily protected, that the liability finding was reasonable, that the forfeiture did not exceed the statutory cap, and that the proceedings did not violate the Seventh Amendment because Verizon "had, and chose to forgo, the opportunity for a jury trial in federal court." On the cap, Verizon had argued that its conduct was at most one failure to act carrying a maximum of about $2 million. The court held that the Act gives the Commission discretion, within the cap, to decide what counts as a violation.

Supreme Court. The Court granted certiorari in the AT&T and Verizon cases on January 9, 2026, consolidated them, and heard argument on April 21, 2026. On June 4, 2026 it decided FCC v. AT&T, Inc., 608 U.S. ___, reversing the Fifth Circuit and affirming the Second. Chief Justice Roberts wrote for eight Justices; Justice Thomas dissented.

The Court held that because forfeiture orders issued under section 503(b)(4) "do not definitively resolve the parties' legal obligations," and the Commission's factual findings are not conclusive, the Commission may issue them without a jury. It pointed to features of the statute: the Commission cannot execute on an order, nonpayment carries no penalty, interest does not accrue, and section 504(c) bars the Commission from using an unpaid order to a party's prejudice. Collection happens only in a trial de novo, so "before a regulated party can be made to pay, the jury gets the last word." The Court distinguished Jarkesy on the ground that SEC penalties were immediately enforceable.

Two things were left open. In footnote 5 the Court noted the carriers' argument that the specific orders misled them into paying, and stated that it expressed "no view on the merits of this argument, what relief may be available to the carriers, or in what proceeding." And Justice Thomas's dissent, observing that the carriers paid more than $100 million before the government took the position that the orders were not binding, would have given the parties an opportunity to proceed under a correct understanding of the law.

What the Record Shows

After June 4, 2026 the Supreme Court dockets record further activity. On the Verizon docket, Verizon filed a petition for rehearing on June 29, 2026, rehearing was denied on August 17, 2026, and judgment issued the same day. On the AT&T docket, judgment issued July 6, 2026, sending the case back to the Fifth Circuit. This article did not retrieve the Fifth Circuit's docket on remand and reports no ruling from that court after the Supreme Court's decision.

Sprint and T-Mobile filed their own petition for certiorari, No. 25-1422, on June 22, 2026, after two extensions. It presents three questions: whether the Court should grant, vacate and remand in light of FCC v. AT&T and the government's concessions there; whether "location" CPNI under section 222 refers only to call-location information rather than other information about a mobile device's location; and whether the number of continuing violations arising from a single failure to act is a legal question for courts rather than one for deference to the Commission. The federal respondents filed a brief in opposition on September 25, 2026. The docket showed no ruling on the petition when it was read for this article.

Read as a whole, the record has settled less than the size of the fines suggests. The Seventh Amendment question is resolved for the Commission's notice-of-apparent-liability process. The CPNI question has been answered by two circuits in the Commission's favor and by no court the other way, but the only court to rule for a carrier did so without reaching it, and the question is now pending in a petition at the Supreme Court. The violation-counting method that produced the totals has been upheld, in the D.C. Circuit on an argument the court treated as forfeited and in the Second Circuit as a matter of delegated discretion. Whether any carrier can recover a payment on the theory the Supreme Court reserved in footnote 5 has not been decided in any document reviewed here.

Frequently Asked Questions