How T-Mobile, Verizon and AT&T use your web browser, app usage and location data to serve you advertising

T-Mobile raised a few eyebrows – and received unflattering press attention – when the Wall Street Journal reported on its new, invasive advertising program. Beginning April 26, T-Mobile says it will use its customers’ web browser and app usage data to sell targeted ads unless those customers object.

It sounds very scary. Nobody likes to think that someone is watching and cataloging all of the websites they visit. But it’s also a good example of how much of our data can be collected through our mobile devices and how few rules there are for the carriers we have to trust.

It’s not really clear what T-Mobile’s new program is or how it differs from T-Mobile’s current personalized advertising program. As a T-Mobile customer, I was annoyed personally to find that I was automatically signed up for this program, which uses data including the apps on my phone and “broadband information” to target me. T-Mobile didn’t respond to a request for clarification, but said it would report more on its advertising partnerships when the new privacy policy goes into effect in late April.

What T-Mobile is doing, however, is neither unusual nor new. Verizon and AT&T have been doing this for years. Cellular operators discovered long ago that there are two ways they can make money with their customers: what these customers pay to use their services, and what the cellular operators earn from selling the data the paying customers provide when they use these services. The former is clear and obvious to the customer, especially when the monthly bill is due. The latter is buried under lengthy and confusing privacy policies and account settings, and most customers don’t even know it’s happening.

Here’s how it works: if you’re using a cellular carrier’s (LTE, 4G, 5G, etc) cellular network, that carrier knows what websites you visit, use mobile apps, make phone calls – basically anything you do over their network, be it because, you’ve taken steps to disguise it, like using an encrypted messaging service like Signal or a mobile VPN. There are privacy laws that restrict some of what your wireless operator can disclose or use without your express permission (or a court order), but marketing data that isn’t related to personally identifiable information is generally fine. So that’s what they do.

The new program from T-Mobile is characterized by the fact that it is more aggressive in the type of data collected and customers are automatically registered in it. Verizon and AT & T’s personalized advertising programs that use web browser information – Verizon Selects and AT & T’s Enhanced Relevant Advertising program, respectively – are opt-in.

“Our customers must make a positive decision about our plans to use location information or where customers can go online to serve third-party advertisements,” a Verizon spokesperson told Recode.

But next to the opt-in programs Verizon and AT&T also automatically sign you up for their other advertising programs that collect less detailed information.

AT&T has “Relevant Ads” that use your “non-sensitive information” (age group, zip code, gender) to target you with advertisements, including those served by its digital and television advertising network, Xandr, named after Alexander Graham Bell, who invented telephones and who has certainly never seen anything like it. AT&T also sells your data to third parties in order to address you with advertising.

Verizon has its business and marketing insights and relevant mobile advertising programs. Business and Marketing Insights sells aggregated information to other companies who may want to know how many Verizon users in a particular demographic are visiting a website, entering a store, or using an app. Relevant Mobile Advertising uses your general information – pretty much the same as AT & T’s Relevant Advertising program – and also shares that information with its own Verizon Media advertising platform and network, which sends targeted advertisements to websites, apps, and even your TV.

In addition to these two programs, Verizon also chooses to share your customer network information (such as calls you made and received) with its own companies and affiliates in order to bring more Verizon products and services to you. Verizon says that this requires your consent, but they also consider not opting out within a certain amount of time as consent.

So all of these cellular carriers are still trying to make money from your data, just less intimate types of it.

As the Wall Street Journal pointed out, Verizon and AT & T’s promotional activities are far bigger than T-Mobile’s, so maybe T-Mobile is just trying to catch up here, and it’s a little sneaky trying to get as many users on the Blackboard. It is also trying to bring its new Sprint customers after the merger, who previously had to opt for this type of data collection and use, on the same page with the existing T-Mobile users.

There’s a little bright spot here: these companies claim that they don’t append any personal information like your real name or address to this data. They either just toss you together with a large anonymous pool of customers to use as aggregated data, or they assign you a unique identifier, assigning that identifier to a number of categories based on interests or demographic information obtained from your data and then give them to third party advertisers to target their ads to. This is to prevent advertisers from knowing who you are, but depending on what is used as the identifier and how specific the data attached to that identifier is, it can be easy to re-identify you. You just have to trust that T-Mobile (or Verizon or AT&T) and their advertising partners don’t.

Unless you live in Maine, these companies don’t need your permission to collect many of these things. They don’t actually handle your data, either, as evidenced by the many Federal Communication Commission (FCC) fines these companies have imposed over the years for violating the few existing privacy laws.

It doesn’t have to be like that. The Obama-era FCC attempted to enact privacy regulations that would have required broadband service providers to obtain user permission before disclosing certain information, including which websites they visited and the apps they used. But the Republican-led Congress lifted those rules a few months after Trump took office.

“The FCC needs to reconsider this issue as soon as possible,” Alan Butler, executive director and president of the Electronic Privacy Information Center (EPIC), told Recode.

But the FCC hasn’t taken up this issue yet, so T-Mobile and the rest of the time can still collect, use, and benefit from your data for the time being while you actually pay for the privilege. They also give you ways to log out, so why not use them?

T-Mobile:

On the Internet: Go to T-Mobile.com > account > Profile settings > Privacy and notifications > Advertising & Analysis > Uncheck “Use my data to make ads more relevant to me” and “Use my data for analytics and reports.”

In the T-Mobile app: Go to “More” in the menu bar > Advertising & Analysis > Uncheck “Use my data to make ads more relevant to me” and “Use my data for analytics and reports.”

Verizon

On the Internet: Go to www.VerizonWireless.com/myprivacy > Choose Don’t Share for proprietary customer network information, business and marketing insights, and relevant mobile advertising.

In the Verizon app: Go to “More” in the menu bar > Tap the account settings gear icon > Manage privacy settings > Turn off proprietary network intelligence, business and marketing insights, and relevant mobile advertising.

AT&T

On the Internet: Go to AT & T’s “Consent Dashboard” > Relevant advertising > switch the usage to “No”.

In the AT&T app: Go to “More” in the menu bar > profile > Data privacy > Privacy settings > Relevant advertising > Switch Allow Use to “No”.

Or, if you’re at it, check out the personalized “opt-in” ads from Verizon and AT&T just to make sure you haven’t signed up without seeing a sneaky pop-up with lots of fine print (For example, the owners of the AT&T account I used to research this article had no idea when or how they opted for enhanced relevant advertising). For AT&T, just follow all of the above instructions, but click on “Enhanced Relevant Advertising”. For Verizon, follow the directions above, but click Verizon Selects.

Of course, you can always opt (or stick with) all of these advertising programs if you want to trade some of your most sensitive data for a personalized advertising experience that these companies insist on, what customers want. According to a report by AT & T’s Xandr advertising platform (see source), two-thirds of respondents would like “advertising that would be more relevant to them and their lifestyle”.

I have never met any of these people personally, despite their supposed majority in the population, but apparently they are somewhere.

Open Sourced is made possible by the Omidyar Network. All open source content is editorially independent and is produced by our journalists.