What AT&T does with your data

What it collects and does with your data

• FCC found AT&T sold access to customer location data to aggregators that resold it.
• AT&T notice: customers are automatically enrolled in Personalized (uses app data, purchased demographic data including ethnicity, advertising partner data, automated decision-making); Personalized Plus (opt-in) adds precise location, CPNI, and ISP web browsing. AT&T says it shares information in ways that may be a sale under state law, such as exchanging subscriber lists for marketing.
• AT&T privacy notice lists collection of biometric information such as fingerprints, voice prints, and face scans.

Sensitive data

• precise location
• CPNI (call records)
• ISP web browsing (Personalized Plus)
• biometrics (disclosed collection)
• purchased ethnicity data

Enforcement and litigation

3 matters in the research. Where the research says alleged, pending, or settled without admitting wrongdoing, so does this page.

• FCC forfeiture about $57 million; Fifth Circuit vacated it (Seventh Amendment); Supreme Court reversed 8-1 and remanded on 2026-06-04. Status: fine restored in principle; remand proceedings in Fifth Circuit. Amount: $57.3 million.
• FCC consent decree over Jan 2023 vendor cloud breach (about 9 million wireless customers). Status: final. Amount: $13 million.
• Consumer class settlement for 2024 breaches ($149M dark web data set, $28M Snowflake call records of about 110M customers), In re AT&T Inc. Customer Data Security Breach Litigation, No. 3:24-md-03114 (N.D. Tex.). Preliminary approval 2025-06-20; final approval hearing held 2026-01-15; the MDL was reassigned to Judge Sidney A. Fitzwater on 2026-08-17. No final approval order on the docket as of 2026-09-25; the settlement website says the court has not yet decided. Status: pending final approval. Amount: $177 million.

Who else holds your data

Organizations holding a copy of your data, as the research counts them: at least 5. AT&T, aggregator, reseller, end buyer (historical); plus the 2024 Snowflake exfiltration.

Third parties: 8 disclosed recipient categories. Eight sharing categories in the notice: affiliates, suppliers, advertising/marketing companies, identity verification, with consent, legal, metrics/insights/research, location services.

Data brokers linked to AT&T

None. The research documents no flow between AT&T and a data broker.

Data practices score

8 of 15. Five components, each 0 to 3. How the score works

Sells or shares

3

Enforcement

3

Retail media scale

0

Sensitive data

1

Opt-out friction

1

Estimated emissions for one person

Research gaps

• AT&T ad revenue.
• Remand status after Supreme Court decision.