Since T-Mobile, Verizon and AT&T use their web browsing, app usage and location data to serve their ads

T-Mobile raised some eyebrows – and caught the attention of the unflattering press – when the Wall Street Journal reported on its new privacy-invasive ad program. As of April 26, T-Mobile says it will use its customers’ web browsing and application usage data to sell targeted ads, unless those customers give up.

It looks very scary. Nobody likes to think that someone is watching and cataloging all the websites they visit. But it is also a good example of how much of our data can be and is collected through our mobile devices and how few rules there are for operators that we are forced to trust.

It is not very clear what T-Mobile’s new program is or how it differs from T-Mobile’s current personalized advertising program. As a T-Mobile customer, I was personally upset to find that I had automatically opted in to this program, which uses data, including my phone apps and “broadband information” to target ads to me. T-Mobile did not respond to a request for clarification, but said it would share more about its advertising partnerships when the new privacy policy goes into effect in late April.

What T-Mobile is doing is not uncommon, however, and it is not new. Verizon and AT&T have been doing this for years. Mobile operators have long discovered that they have two ways to make money from their customers: what those customers pay to use their services, and then what operators earn from selling data paying customers provide as they use these services. The first is clear and obvious to the customer, especially when the monthly invoice is due. The latter is buried in lengthy and confusing privacy policies and account settings, and most customers don’t even know this is happening.

Here’s how it works: when you use an operator’s cellular network (LTE, 4G, 5G, etc.), that operator knows which sites you visit, mobile apps you use, phone calls you make – basically everything you does for your network, unless you have taken steps to obscure it, such as using an encrypted messaging service like Signal or a mobile VPN. There are privacy laws that limit part of what your operator can disclose or use without your express permission (or court order), but marketing data that is not attached to personally identifiable information is generally acceptable. So this is what they do.

T-Mobile’s new program is notable because it is more aggressive in the types of data it collects and in the fact that customers are automatically enrolled in it. Verizon and AT&T personalized advertising programs that use web browsing information – Verizon Selects and AT&T’s Enhanced Relevant Advertising program, respectively – are optional.

“Our customers must make an affirmative choice to opt for our plans that would allow the use of location information or where customers go on the web to serve third-party ads,” a Verizon spokesman told Recode.

But along with the opt-in programs, Verizon and AT&T also automatically sign you up for their other advertising programs that collect less detailed information.

AT&T has “Relevant Advertising”, which uses its “non-confidential information” (age group, zip code, gender) to target its ads, including those served by its digital and TV advertising network, Xandr, which is named after Alexander Graham Bell, who invented phones and certainly never saw anything like that coming out of them. AT&T also sells your data to third parties to target your ads to you.

Verizon has its Business and Marketing Insights and Relevant Mobile Advertising programs. Business and Marketing Insights sells aggregated information to other companies that may want to know how many Verizon users in a particular demographic go to a website or enter a store or use an application. Relevant Mobile Advertising uses your general information – pretty much the same things as AT&T’s Relevant Advertising program – and also shares that information with its own Verizon Media platform and ad network, which sends ads targeted to websites, applications and even your TV.

In addition to these two programs, Verizon also chooses to share its customer’s proprietary network information (for example, the calls you make and receive) with its own companies and affiliates to market more Verizon products and services to you. Verizon says it needs to obtain your consent to do this, but it also considers that you have not given up within a certain period of time to consent.

So all of these cell phone operators are still trying to make money from their data, just less intimate types of them.

As the Wall Street Journal has pointed out, Verizon’s and AT&T’s advertising operations are much larger than T-Mobile’s, so maybe T-Mobile is just trying to catch up here, and it’s being a little stealthy to get the as many users as possible at the edge. It is also trying to place its new post-merger Sprint customers, who previously had to opt for this type of data collection and use, on the same page as existing T-Mobile users.

There is a small positive point here: these companies claim that they do not attach their personal information, such as their real name or address, to that data. They just group you with a large anonymous group of customers to use as aggregate data, or assign you a unique identifier, attach various categories based on interests or demographic information deducted from your data to that identifier, and then provide third-party advertisers where to target your ads. This prevents advertisers from knowing your real identity, but depending on what is used as an identifier and how specific the data attached to that identifier is, it can be easy to identify it again through it. You just have to trust that T-Mobile (or Verizon or AT&T) and its advertising partners will not do that.

Unless you live in Maine, these companies do not need to obtain your permission to collect many of these things. They are also not exactly careful with their data, as demonstrated by the many fines from the Federal Communication Commission (FCC) that these companies have incurred over the years for violating the few privacy rules that exist.

It doesn’t have to be that way. The Obama-era FCC attempted to enact privacy rules that would require broadband service providers to obtain permission from users before sharing certain information, including websites they visit and applications they use. But the Republican-led Congress overturned those rules a few months after Trump took office.

“The FCC needs to revisit this issue as soon as possible,” said Alan Butler, executive director and president of the Electronic Privacy Information Center (EPIC), Recode.

But the FCC has not yet reviewed this issue, so T-Mobile and others can still collect, use and profit from your data for now, while you actually pay for the privilege. They also offer ways to cancel, so why not use them?

Movable tee:

On the Internet: Visit T-Mobile.com > Account > Profile settings > Privacy and notifications > Advertising and Analysis > Disable “Use my data to make ads more relevant to me” and “Use my data for analysis and reporting”.

In the T-Mobile application: Go to “More” in the menu bar > Advertising and Analysis > Disable “Use my data to make ads more relevant to me” and “Use my data for analysis and reporting”.

Verizon

On the Internet: Go to www.VerizonWireless.com/myprivacy > Select “Do not share” for Customer proprietary network information, Business and marketing insights and Relevant mobile advertising.

In the Verizon app: Go to “More” in the menu bar > Touch the gear icon for Account settings > Manage privacy settings > Disable the customer’s proprietary network information, business and marketing insights and relevant mobile advertising.

ATT

On the Internet: Go to the AT&T “Consent Panel” > Relevant Advertising > switch allows use for “No.”

In the AT&T application: Go to “More” in the menu bar > Profile > Private data > Privacy settings > Relevant Advertising > Change to allow use for “No.”

In addition, you can also check out personalized “opt-in” ads from Verizon and AT&T while you’re at it, just to make sure you didn’t activate without realizing it through a sneaky pop-up with lots of fine print (the owners of AT&T account I used to research this article, for example, had no idea when or how they opted for relevant advanced advertising). For AT&T, just follow all the instructions above, but click on “Enhanced relevant advertising”. For Verizon, follow the instructions above, but click on “Verizon Selects”.

Of course, you can always choose to (or remain enabled) all of these ad programs if you are happy enough to exchange some of your most sensitive data for a personalized ad experience, which these companies insist is something customers want. According to a report from AT&T’s Xandr ad platform (consider the source), two-thirds of the people surveyed “want the ads to be more relevant to them and their lifestyle”.

I have never personally met one of these people, despite their supposed majority in the population, but apparently they exist somewhere.

Open source it is possible thanks to the Omidyar Network. All Open Sourced content is editorially independent and produced by our journalists.