AT&T Says Customers Can’t Sue the Company for Selling Location Data to Bounty Hunters

AT&T is arguing that its customers can’t sue the company for selling location data to bounty hunters, according to recently filed court records. AT&T says the customers signed contracts that force them into arbitration, meaning consumers have to settle complaints privately with the company rather than in court. The filing is in response to a lawsuit filed by the Electronic Frontier Foundation (EFF).

The news shows the hurdles consumers are faced with when trying to claim compensation from telecos and other tech giants that have arguably abused access to their data, including ultimately selling it to people without authorization to handle such information.

"The plaintiffs have an uphill battle," Deborah Hensler, Director of Law and Policy Lab at Stanford University, said.

The issue circles around mandatory arbitration; that is, forcing consumers to settle complaints privately with the company rather than in court.

"Each time they entered into a new Wireless Customer Agreement with AT&T, they [the plantiffs] not only agreed to AT&T's Privacy Policy but also agreed to resolve their disputes with AT&T—including the claims asserted in this action—in arbitration on an individual basis," AT&T's filing from last week reads. When the plaintiffs, who are AT&T customers, accepted AT&T's terms and conditions when, say, purchasing a new phone, they also agreed specifically to the arbitration clause, AT&T argues.

The Arbitration Agreement on AT&T's website reads, "AT&T and you agree to arbitrate all disputes and claims between us. This agreement to arbitrate is intended to be broadly interpreted."

The class action lawsuit filed on behalf of AT&T customers came after multiple Motherboard investigations into the sale and abuse of phone location data. In January, Motherboard obtained the real-time location of a T-Mobile phone in Queens, New York, after paying a bounty hunter source $300. The data broker firm that provided access to that data, called Microbilt, also sold location information on Sprint and AT&T phones. Shortly after, Motherboard then reported that a company called CerCareOne had sold T-Mobile, AT&T, and Sprint to around 250 bounty hunter customers.

In response, all of the telecos stopped selling the data. On top of that multiple lawyers filed class action lawsuits over the sale of phone location data, including the EFF and legal firm Pierce Bainbridge, which is the case this AT&T filing stems from. T-Mobile has used a similar argument in its own cases around phone location data too.

"In general courts have upheld the application of mandatory arbitration clauses in consumer contracts that preclude litigating in court and typically also preclude any form of group proceeding in arbitration, meaning each claimant must proceed individually. In these sorts of small claims, the requirement to proceed individually further weakens the plaintiffs' position," Hensler said.

But other courts have recently ruled that AT&T's argument has holes, meaning there may still be ways of consumers to sue the teleco giants for this and similar violations.

Adam Gutride from law firm Gutride Safier LLP, which sued AT&T in another instance over roaming fees, told Motherboard in an email "In our case we persuaded the Ninth Circuit U.S. Court of Appeals that AT&T Mobility’s arbitration clause is unenforceable. That is because the arbitration clause would prevent consumers from obtaining a 'public injunction' to stop illegal conduct." (The EFF lawsuit seeks an injunction to stop AT&T from selling location data again.)

Gutride said AT&T is seeking a review from the 9th Circuit, and if that fails will go to the Supreme Court.

Depending on the company, it can be possible to opt-out of arbitration clauses at the start of a contract. But of course that requires the consumer being aware of the issue in the first place.

"If consumers carefully read [the] fine print they will find out how they can opt-out of the arbitration requirement. Most of course don't notice or pay attention to this, in which case their attempts to overcome the arbitration requirement subsequently are significantly weakened," Hensler said.

Correction: due to an editing error, an earlier version of this article named Adam Gutride as Alan Gutride. Motherboard regrets the error.

Subscribe to our new cybersecurity podcast, CYBER.