Blog of Rights

How Long Is Your Cell Phone Company Hanging On To Your Data?

By Allie Bohm, Advocacy & Policy Strategist, ACLU at 10:17am

What do you think about when choosing a cell phone provider? Their prices? Their coverage area? Whether they have spiffy, high-tech phones? Whether their phones work overseas or in the subway? What about how long they retain information about you and under what circumstances they turn it over to law enforcement?

All of the nation's major mobile carriers are retaining their customers' location data for at least a year, according to a chart the Department of Justice (DOJ) developed in 2010 — and that the ACLU of North Carolina received in response to our public records request about local law enforcement's use of cell phone location information. And location info's not all they hang onto. We gave a copy of this document to Wired.com, which has written about it here.

The chart begs the question, shouldn't all cell phone companies reveal their data retention policies and under what circumstances they turn over information to law enforcement in their user agreements or on their websites? And, shouldn't they justify why they are hanging onto information that doesn't serve a business purpose, like the content of your text messages? After all, your phone records are *your records,* and the information they reveal can be strikingly personal — you shouldn't be kept in the dark about who has access to them and for how long.

Especially since some of this information is very interesting and might actually help you choose a cell phone provider. Let's start with location information, or as the chart calls it, "Cell towers used by phone," since that was the topic of our request. According to the document, Verizon keeps that information for a rolling year; Sprint and Nextel keep it for 18-24 months. T-Mobile keeps the information officially for 4-6 months, but "really [for] a year or more." What?! What's that even supposed to mean? Why is there a difference between the official policy and what the company actually does? I can just imagine the conversation with DOJ: "Well, sir, our policy says that we keep cell tower information for 4-6 months. But, if you call the right person and ask nicely/say the secret password, we can usually manage to find that information going back a year or more . . ." Of course, since their policy isn't public, you, the user, would never know.

But, it gets worse. According to DOJ's chart, AT&T/Cingular appears to keep all of its cell tower records since July 2008. How long do they plan to keep this data for? Are they just creating an infinite record of everywhere you've ever been with your cell phone? Do you remember where you were on September 28, 2008? If you have AT&T/Cingular, your phone company may know. And they might tell the cops.

Speaking of telling the cops, the chart is filled with differences between the various cell phone providers in terms of whether and how long they retain each type of information (and consequently whether and how long it is available to law enforcement). For example, Virgin Mobile retains text message content for 90 days (though they do require law enforcement to obtain a warrant to access it). But the real question is why are they keeping text message content for so long — or for that matter, at all? Most of the other providers don't retain it period. Verizon, the other outlier, keeps it for only 3-5 days.

You can find out more by checking out the chart and perusing the Wired story. And, if you'd like your cell phone company to include their data retention policies on their website or in their user agreement, tell them. Most companies provide the opportunity to leave feedback or submit comments via e-mail on their websites. Demand your dotRights, because you shouldn't have to sacrifice your privacy just to use a cell phone.

Learn more about location tracking: Sign up for breaking news alerts, follow us on Twitter, and like us on Facebook.

Statistics image