How to stop your cell provider from sharing (some of) your data

Privacy Please is an ongoing series exploring the ways privacy is violated in the modern world, and what can be done about it.

Smartphones are intimate companions: We cradle them in our hands, and hold them close to our chests. They greet us each morning, and whisper in our ears at night. We tell them our secrets.

Unfortunately, when it comes to keeping those secrets, our phones have mixed allegiances. 

On Feb. 23, T-Mobile, which completed its merger with Sprint in April of 2020, announced that it intends to use customers’ “web and device usage data” for third-party advertising. In other words, the mobile provider, which as of the fourth quarter of 2020 had approximately 102 million customers, will share that customer data with a host of unnamed advertisers. 

T-Mobile is not the only cellphone provider that shares its customers’ data. AT&T says it may share customers’ demographic details, among other information, with “advertisers, programmers and networks, social media networks, analytics firms, ad networks, and other similar companies.” Verizon, for its part, says it shares “de-identified information” for ad campaigns and various reporting. 

While the three major mobile providers all insist that customer information is anonymized and, in some cases, aggregated before sharing, time and time again we’ve seen in practice how hard it is to truly de-identify an individual’s personal data. 

What does this look like in practice? In 2017, a journalist and a data scientist presenting at DEF CON demonstrated just how easy it is to de-anonymize supposedly anonymous web-browsing data. Using about 10 URLs or so, the two showed how they were able to link web-browsing histories to real people, including politicians and a Dutch judge. 

This should bother you. 

Your phone, and consequently your mobile provider, know a lot about you. The places you go, apps you use, and the websites you visit potentially reveal all kinds of private information — e.g. religious beliefs, health conditions, travel plans, income level, and specific tastes in pornography. 

Thankfully, there are small steps you can take to stop this data collection and reclaim an ounce of the privacy that, by default, you deserve. 

WATCH: It’s surprisingly easy to be more secure online

What T-Mobile collects and shares, and how to opt out

As the company’s privacy policy makes clear, T-Mobile collects a lot of customer data. 

Some of which, like customers’ names or credit card numbers, is directly tied to the functioning of the service itself. With other collected data, like “information about your interests, preferences, or behaviors,” the link is not as immediately obvious. 

Notably, not only does T-Mobile collect information that you directly provide the company (like your name), and information that’s gathered by means of you using its services (like your IP address), but the company may also “buy or get personal data from other third parties, like social media platforms, analytics providers, and consumer data resellers.”

The company also says that it makes inferences about its customers based on observing their behavior. 

“For example, we may infer that you are looking to purchase a new device based on your browsing activity while using our services, and we may use your IP address to estimate your general location,” explains the T-Mobile privacy policy.  “We may also use this information for advertising purposes.”

OK, so T-Mobile uses your data to target you with ads and further profit off you. But what, specifically, about sharing your data with unspecified third parties? Well, T-Mobile reserves the right to do just that, too. 

“We may also share mobile device identifiers, device and service usage data, and demographics information with third-party advertising partners who may use data to serve ads for T‑Mobile and others as described in the Advertising section,” explains the privacy policy.

When asked what specific companies T-Mobile shares customer data with, a spokesperson declined to provide us with a list.

Notably, T-Mobile lists the information “[it] and others may collect and use for advertising and analytics,” which include “Addresses of websites visited,” “Unique IDs such as device IDs, ad IDs, and cookie IDs,” and “Applications, content, and features used—including how much time you spent using them[.]”

Importantly, the company claims it does make efforts to anonymize the data it shares by, in part, associating it with advertising IDs instead of customer names. 

“When we share data, we only share the audience segment and associated Ad IDs,” explained the spokesperson over email. “We do not share underlying customer broadband or device usage data with third parties. We also do not share information for advertising that directly identifies customers, like name, address, email or precise location information.”

Unique ad IDs, however, can still be quite revealing. Thankfully, there’s a way out of at least some of this. 

The company announced that, as of April 26, it intends to begin using “information we learn from your web and device usage data (like the apps installed on your device) and interactions with our products and services, for our own and 3rd party advertising, unless you tell us not to.” 

That last clause is an important one: “… unless you tell us not to.”

Although you may need to tell the company more than once, as T-Mobile is kind enough to inform us,

“If you opted-out of a previous T‑Mobile or Sprint advertising program, that setting will not apply,” warns the privacy policy. “You must opt-out again.”

Luckily, it’s pretty easy to do just that. 

To instruct T-Mobile to not use your web usage data for advertising purposes, you first need to sign up for a T-Mobile ID. 

Once you’ve done that:

1. Log in to your account. 

2. Click through “My account” > “Profile” > “Privacy and Notifications” > “Advertising & Analytics” 

3. Toggle off the option that says “Use my data for analytics and reporting”

4. Toggle off the option that says “Use my data to make ads more relevant to me”

This should opt you out of T-Mobile’s dating sharing program. (Sprint and Metro by T-Mobile customers have different opt-out links.)

What AT&T collects and shares, and how to opt out

Much like other carriers, AT&T collects a substantial amount of data on its 182 million customers. However, the specifics of what the Dallas, Texas-based company gathers and shares are unique. 

We asked AT&T directly what third parties the company shares customer information with. A spokesperson, Jim Kimberly, declined to provide that information. Instead, he wrote that the company makes its policies clear to any and all. 

“We are transparent with customers about how we use data, and we provide customers with choices and control that lets them opt in to certain programs and say no to others,” he wrote. “Our Privacy Policy provides information about data collection, use and sharing, and our Privacy Center provides choices to customers for control of their data.”

According to that privacy policy, there are numerous types of customer data which AT&T collects and shares — for a variety of purposes ranging from legal requirements to advertising. When it comes to the latter, the company breaks it main wireless data collection down into three programs: Relevant Advertising, Enhanced Relevant Advertising, and External Marketing and Analytics. 

Each program, detailed in the aforementioned privacy policy, collects a different set of data for different purposes.

For the Relevant Advertising program, AT&T collects customer data “like your TV viewing, your location, or information about the apps you use or the websites you visit to place you into demographic or interest categories like ‘sports enthusiast’ or ‘coffee lover.'” 

AT&T says that it may share with third parties customer data like “device information, information from companies like our advertising partners, and demographic information like your age range, gender and ZIP code.”

Notably, the company says that when it shares this data, it combines it with a device ID like an advertiser ID. Advertiser IDs, when combined with commercially available third party databases, are able to be linked back to real-world names. 

To opt out of Relevant Advertising:

1. Log in to your AT&T account at the Manage Your Privacy Choices page

2. Under “Control how we use your data” select “Relevant Advertising”

3.  Scroll down and under “Allow use,” toggle the option to “No”

“Two things happen when you opt out here,” explains AT&T. “AT&T won’t deliver Relevant ads to you, and we won’t help others, such as ad networks put you in interest groups, either.”

As the name might suggest, the Enhanced Relevant Advertising program involves even more customer data than the Relevant Advertising program. AT&T says that, if you participate, it may share the following information with third parties: “TV viewing, Web browsing, app usage, location, call detail records, and other Customer Proprietary Network Information[.]” 

Location data alone, as the New York Times reported in a blockbuster 2019 story, is often enough to identify individuals. And your TV viewing habits are surprisingly revealing, as well.

Importantly, AT&T says this program is opt in — meaning you have to affirmatively decide to participate. Even so, it’s worth double checking to make sure you never accidentally toggled a “yes” at some point in the past. 

To affirmatively opt out of the Enhanced Relevant Advertising program:

1. Log in to your AT&T account at the Manage Your Privacy Choices page

2. Under “Control how we use your data” select “Enhanced Relevant Advertising”

3.  Scroll down and ensure nothing is toggled to “Yes” 

4. If you are the account owner and there are multiple phone lines on your plan, select the “Restrict User” option — this will make sure the other phones numbers can not be opted in 

The External Marketing & Analytics Reports is an entirely separate beast, but worth opting out of as well. The company says the program combines “your anonymous data” with the “anonymous data of others to create reports that inspire and inform better customer experiences.” 

The privacy policy adds that “this information may be combined with other information, such as demographic information or an identifier like a device ID or ad ID.” Again, it’s worth mentioning that, in combination with commercially available databases, advertising IDs can be tied back to real names. 

To opt out of External Marketing & Analytics Reports:

1. Log in to your AT&T account at the Manage Your Privacy Choices page

2. Under “Control how we use your data” select “External Marketing & Analytics Reports”

3.  Scroll down and under “Allow use,” toggle the option to “No” on your phone number, and, if you have one, any number on your family plan

What Verizon collects and shares, and how to opt out

Verizon, like other major carriers, collects customer data and in some instances shares some version of it with third parties. 

The company’s privacy policy attempts to detail what, exactly, Verizon collects and what it shares, but does so in mostly broad strokes. We reached out to Verizon directly and asked, in part, for a list of companies that Verizon shares customer data with. We received no response.

Where it does get specific, Verizon makes it clear that it collects some information, like cell tower location information. However, it also collects other information the purposes of which are, shall we say, less intuitive. 

Verizon says it may collect “demographic and interest data,” for example, as well as “how you use our websites and apps[.]”

The latter, it turns out, entails a lot: “information about your browsing, searching and buying activities; IP address, mobile phone number, device numbers and identifiers, web addresses of the sites you come from and go to next, screen recordings, browser and operating system information, platform type, connection speed and other attributes.”

Verizon, like its competitors, shares customer data — in some form — with third parties. 

“We also share de-identified information with companies to assist with the delivery of advertising campaigns or aggregate reports,” the privacy policy states. 

When it comes to sharing customer data, the “Business and Marketing Insights program,” “Relevant Mobile Advertising” program, and “Verizon Selects program” are of particular note. The former, according to Verizon, “helps companies understand consumer behaviors in aggregate.”

Notably, Verizon insists that the “information we use and the insights we develop do not identify you individually and may be shared with third parties.” The company provides the following example of what that looks like in practice: “This program also may share location information with others in a way that does not personally identify you to develop additional aggregate insights, such as traffic reports.”

Sharing a person’s location data without in turn identifying that person, while possible, is extremely difficult in practice, as a 2019 report from the New York Times demonstrated. 

To opt out of the Business and Marketing Insights program:

1. Log in to your Verizon account

2. Under “Personal” select “Account” > “Account Settings” > “Privacy Settings” > “Change settings

3. Scroll down until you see the “Business & Marketing Insights” section

4. Select “Don’t use” where it asks “May we use your information for Business and Marketing Insights?”

5. Make sure to hit “Save Changes”

The Relevant Mobile Advertising program, as described by Verizon, “uses your postal and email addresses, certain information about your Verizon products and services (such as device type), and information that you provide or we get from other companies (such as gender, age range, and interests).”

Verizon attempts to reassure its customers by noting that “We do not share information that identifies you in this program outside of Verizon other than with vendors and partners who do work for us.” Which, hey, that’s good. But you should just opt out, anyway. 

To opt out of Verizon’s Relevant Mobile Advertising program:

1. Log in to your Verizon account

2. Under “Personal” select “Account” > “Account Settings” > “Privacy Settings” > “Change settings”

3. Scroll down until you see the “Relevant Mobile Advertising” section

4. Select “Don’t participate” where it asks “Do you want to participate in Relevant Mobile Advertising?”

5. Make sure to hit “Save Changes”

Also, while you’re there, go ahead and opt out of sharing your Customer Proprietary Network Information (CPNI). The option to do so is likewise under Change Settings. 

The Verizon Selects program, like AT&T’s Enhanced Relevant Advertising program, is opt in. Which is a good thing, as it collects a staggering amount of customer information including, but not limited to, location information, “web addresses of the sites you visit,” demographic info, and advertising IDs.

Don’t opt in (and make sure you’ve haven’t in the past). 

Whether your phone carrier is T-Mobile, AT&T, or Verizon, opting out of the these programs will take only moments. It’s a small but meaningful step to reclaiming your privacy. Do it.