What Your Phone Carrier Actually Knows About You

The carrier has a longer record of where you have been, who you called, and what you did online than your phone does. Most of it is sold, shared, or subpoenaed without telling you.

State of Surveillance

TL;DR: Your wireless carrier has a continuously updated record of your phone's location, every number you call or text, every site you connect to, and the device identifiers baked into your SIM and handset. Verizon's published privacy policy lists "call records containing phone numbers you call and receive calls from, sites you visit, text and messaging records, wireless location, application and feature usage."[1] The carrier's stated retention for those records is "as long as they are needed for legal, tax, audit, investigative, and security purposes."[1] Two location-aggregator companies built businesses on the carriers' location feed and both got caught: LocationSmart's website was found in May 2018 to let a visitor pinpoint nearly any US phone "to within a few hundred yards, given only the phone number," with no consent and no authentication, exposing roughly 200 million customer devices.[2] Securus Technologies built a service that could "track the location of almost any phone in the US within seconds" for law enforcement, and a US Marshal was indicted in 2022 for abusing the product to track people he knew.[3] Here is what is in the carrier's file, who has bought it, and what you can do about it.

What Your Carrier Says It Collects

Every Tier 1 US wireless carrier publishes a privacy policy that lists what it collects. They look similar because the network sees similar things. Verizon's full privacy policy, as currently published, runs through a list that begins with what you give it and ends with what its network reads off your phone.

Verizon's policy lists "Contact, billing and other information you provide" including "name, address, email, phone numbers where you can be reached, images, voice recordings, biometric identifiers, date of birth, driver's license number, Social Security Number or Tax Identifier, username and password and payment information."[1] That is the form-fill half of the file.

The network half is where the carrier's record diverges from anything your phone itself shows you. Verizon lists "How you use our services and your devices" as "call records containing phone numbers you call and receive calls from, sites you visit, text and messaging records, wireless location, application and feature usage."[1] Verizon also collects "browsing, searching and buying activities such as your IP address, mobile phone number, device numbers and identifiers, web addresses of the sites you come from and go to next, the date and time of your visit," and "How our network and your devices are working": "traffic flow, speed, capacity, power, quality and environmental conditions."[1]

Location is its own category. Verizon lists "Location of your wireless devices" as "cell tower location information... Wi-Fi, Global Positioning Satellite (GPS) and other location information."[1] That is the second-by-second trail that geofence warrants and aggregator services pull from. EFF's 2009 paper "On Locational Privacy, and How to Avoid Losing it Forever" said the quiet version of the same thing: "It's true that most cell phones provide some amount of tracking information to the carriers as long as they're on" and "this information is quietly collected by ubiquitous devices and applications, and available for analysis to many parties who can query, buy or subpoena it."[5]

The 2018 LocationSmart disclosure is the cleanest proof that the carrier data exists in a form that anyone can buy. LocationSmart's Wikipedia article describes the company, founded in 1995 and originally called TechnoCom Location Platform, as a "location-as-a-service" firm that "provides near real-time location data for smartphones, feature phones, tablets, M2M, IoT, and connected devices on Tier 1 and Tier 2 wireless networks in the U.S. and Canada."[2] Its named carrier partners are AT&T, Verizon Wireless, T-Mobile US, Sprint Corporation, MetroPCS, and U.S. Cellular, plus Rogers Communications, Bell Canada, and Telus.[2] If your phone is on a major US network, LocationSmart's API can be told where it is.

How Long They Keep It

Verizon's published policy gives only a general retention line: "Our policies require that we retain records for as long as they are needed for legal, tax, audit, investigative, and security purposes and then securely delete or destroy them."[1] That is not a number. It is a promise that the records exist until the company decides they are no longer needed.

Carriers keep different categories for different lengths of time, and those categories are not visible from a single policy page. Verizon does not publish a unified retention table, so the practical answer to "how far back can they go" is not something the policy will tell you.

The reason the number matters is what gets subpoenaed. A subpoena can pull call detail records, cell-site records for a given period, or text-message metadata. The subpoena asks for what the carrier still has. The longer the carrier keeps it, the longer the historical window a single subpoena can open.

What Carriers Share With Data Aggregators

The 2018 LocationSmart vulnerability disclosure is the clearest public record of how the carrier location feed gets passed around. According to the Wikipedia article on LocationSmart, on May 17, 2018, media outlets reported "that the LocationSmart website allowed anyone to obtain the realtime location of any cell phone using major U.S. and some Canadian wireless carriers, to within a few hundred yards, given only the phone number."[2] Approximately 200 million customers may have been exposed. "No consent was required, no opt-out existed, and requests could be made anonymously without authentication, authorization, or payment."[2]

Security researcher Robert Xiao was one of the people who reported it. The Wikipedia article quotes him as saying the "LocationSmart API failed to implement basic checks."[2] LocationSmart "took the vulnerable service offline" and responded with the company "takes privacy seriously."[2] The leak was a bug; the data feed it exposed was not.

Securus Technologies is the second name in the same feed. The Wikipedia article on Securus describes a private technology firm founded in 1986 in Dallas, Texas, originally as TZ Holdings Inc., by Richard Smith. The company renamed itself Securus Technologies in April 2009, is headquartered in Carrollton, Texas, and by 2015 held contracts with 2,600 correctional facilities.[3]

Securus built a location service that was marketed to law enforcement. The Wikipedia article on Securus summarizes the 2018 New York Times report: a Securus product "can be used to track the location of almost any phone in the US within seconds."[3] Both companies sat downstream of the same carrier location feed, reselling it in different forms.

Senator Ron Wyden of Oregon is named in the Securus article as having sent letters to the FCC and to telecom companies, "demanding answers on the controversial surveillance system," after the report came out.[3] Wyden's letters were the opening shot in what became a multi-year FCC investigation and ultimately an enforcement action against the major US carriers.

The 2022 indictment of a US Marshal is the clearest proof that the Securus product was not just paper. The Wikipedia article on Securus reports that a US Marshal "was indicted by the Department of Justice for abusing the product to track people he knew."[3] Securus responded by stating it had discontinued the tool more than four years earlier and permanently shut it off. The product was sold to law enforcement agencies on a non-disclosure basis; the indictment was the public confirmation that the product existed and was being used.

What Police Can Get Without Telling You

The carrier location feed is one half of the surveillance pipeline. The other half is the law enforcement channel, and it is older and broader than the aggregators. Cell-site simulators, an acronym the press shortens to "Stingrays" after the Harris Corporation brand, are a separate channel: hardware devices that pretend to be a real cell tower.

Wikipedia's Stingray entry describes how they extract identifiers: "Extracting stored data such as International Mobile Subscriber Identity (IMSI) numbers and Electronic Serial Number (ESN)" and "The StingRay downloads this data directly from the device using radio waves."[4] The EFF's 2019 whitepaper "Gotta Catch 'Em All: Understanding How IMSI-Catchers Exploit Cell Networks" calls the IMSI "the unique identifier linked to your SIM card" and notes that the card also holds "a secret cryptographic key also stored on the SIM card," which is what the fake tower goes after.[6] The Wikipedia article on Stingray states the scale of it plainly: "all cell phones in the vicinity connect to the StingRay regardless of the cell phone owner's knowledge."[4]

Stingray use by police is governed by a different set of rules than the carrier-side aggregator sales. Federal and many state police departments sign non-disclosure agreements with the FBI and with Harris Corporation that prevent them from disclosing the use of the devices, even to defendants in criminal cases. The Wikipedia article on Stingray notes that Florida police "used such devices at least 200 additional times since 2010 without disclosing it to the courts or obtaining a warrant" and that "NDAs require police to 'notify the FBI' of any records requests."[4] The technique predates Carpenter; the law is still catching up.[7]

The legal baseline is Carpenter v. United States, decided June 22, 2018, which held that "accessing seven days of CSLI constitutes a Fourth Amendment search."[7] Carpenter was a narrow ruling and does not cover every channel: shorter windows, real-time location, IMSI catchers, and aggregator sales each have different statutory hooks. The carrier-side data described above is collected under the carrier's terms of service, not under a court order, and the terms of service let the carrier sell or share it under conditions the policy describes.

What This Means For You

The asymmetry is the point. The carrier's file is built without effort on your part: the radio on your device maintains the connection, the network timestamps the connection, and the location is computed at the cell-tower level whether or not you have location services enabled. EFF's 2009 paper put it bluntly: "this information is quietly collected by ubiquitous devices and applications, and available for analysis to many parties who can query, buy or subpoena it."[5]

What the carrier shares with whom is governed by the policy you accepted at activation. The 2018 LocationSmart disclosure showed that the policy did not prevent the carrier data from being sold in a form that anyone could query without authentication.[2] The 2022 US Marshal indictment showed that the law enforcement channel was not gated by a warrant in every case.[3] Neither fact is in dispute; both came out of public reporting and a federal indictment.

You cannot opt out of the network seeing your phone. You can, however, change how much of the resulting record is uniquely identifiable. The EFF paper notes that "there are currently no immediate steps one can take to defend themselves against these devices."[6] Turning off Wi-Fi and Bluetooth, using a faraday bag, or powering the phone off all close the channel at the device. None of them change the carrier's record of past connections.

What You Can Actually Do

None of these steps hides the trail that already exists in the carrier's file. They shrink the new trail.

Turn off Wi-Fi and Bluetooth when you are not using them. Verizon's policy lists "cell tower location information... Wi-Fi, Global Positioning Satellite (GPS) and other location information" together.[1] Wi-Fi scans are a separate location signal that carriers and aggregators correlate with cell-site data. On iPhone and Android, both radios can be disabled from the control center; on Android, the location setting can be turned off device-wide.

Read the carrier's privacy policy at the granular level. Verizon's policy gives you toggles for "Do Not Sell or Share My Personal Information" and other rights under California and similar state privacy laws.[1] The toggle does not stop the carrier from collecting the data, but it does opt you out of certain sales and shares. Whether the toggle means what you think it means depends on the carrier's California Notice at Collection, which is linked from the same page.

Audit which apps have location permission. Carrier location is independent of app location, but Verizon's policy lists "application and feature usage" alongside wireless location.[1] Apps with "Always" location permission can tag your phone's location in real time and ship it to the app vendor. Switch to "While Using" or "Never" for any app that does not need it.

Use a password manager and unique credentials. The carrier account is the one password that can move your number to a new SIM, so it deserves a unique password and a hardware security key.

File a FOIA or public-records request if you are a target. The standard tool for confirming what is in your file is a request to the agency you suspect has it. Cell-site location, geofence warrants, and pen-register orders all produce records that can be requested after the fact. The 2018 Carpenter ruling gives defendants a constitutional right to challenge the acquisition of historical cell-site records; the right runs to the defendant, not the broader public.[7]

Treat the carrier's record as part of your threat model. If you are a journalist, organizer, attorney, or anyone whose movements are part of your work, the carrier's record is a primary source for adversaries with a subpoena or a warrant. The defenses are the same defenses as for any other surveillance: compartmentalize, encrypt, and assume the carrier's record will be read by anyone who asks politely enough.

The Honest Takeaway

Your wireless carrier collects a detailed, continuously updated record of your phone's location, your contacts, your call and text history, and your internet destinations. Verizon's own published policy lists those categories.[1] Two of the largest resellers of that record have been caught in the act: LocationSmart, whose 2018 flaw let any visitor query the location of any phone on a major US carrier without authentication,[2] and Securus, whose near-real-time law enforcement tool drew a federal indictment in 2022.[3] The Stingray hardware layer pulls the same identifiers directly off phones in range.[4][6]

There is no setting that turns off the carrier's record. The defenses that exist are about shrinking what is collected, hardening the device, and reducing the value of the record to anyone who reads it. The Constitution now treats seven days or more of historical cell-site records as protected.[7] The carrier's record can be longer than that, and how it is shared has been public since 2018.

Sources

  1. Verizon, Full Privacy Policy (consumer wireless section)
  2. Wikipedia, LocationSmart (company history, 2018 vulnerability disclosure, named carrier partners)
  3. Wikipedia, Securus Technologies (history, 2018 NYT report, 2022 US Marshal indictment, Senator Wyden)
  4. Wikipedia, Stingray phone tracker (IMSI/ESN extraction, NDA regime, Florida 2010 disclosure)
  5. EFF, On Locational Privacy, and How to Avoid Losing it Forever (August 2009)
  6. EFF, Gotta Catch 'Em All: Understanding How IMSI-Catchers Exploit Cell Networks (June 28, 2019)
  7. Supreme Court of the United States, Carpenter v. United States, No. 16-402 (June 22, 2018)

Published: October 15, 2026