Fifth Circuit Vacates FCC's Fine of AT&T in Customer Data Case

AT&T seeks review of a Federal Communications Commission forfeiture order. In an internal proceeding, the Commission found that AT&T violated section 222 of the Telecommunications Act by mishandling customer data and fined the company $57 million. AT&T’s petition argues, among other things, that the in-house adjudication violated the Constitution by denying it an Article III decisionmaker and a jury trial. Guided by SEC v. Jarkesy, 603 U.S. 109 (2024), we agree with AT&T. Accordingly, we grant the petition and vacate the forfeiture order.  At issue here is AT&T’s former location-based services program, which it discontinued March 2019. Location-based services give users up-todate information about their surroundings, such as maps and traffic information. They also include services from providers like Life Alert and AAA, which depend upon customers’ locations. While nothing is wrong in principle with providing location-based services, the Commission took issue with how AT&T protected its customers’ location data. To implement location-based services, AT&T contracted with “location aggregators,” who collected customers’ location data. The aggregators, in turn, sold this data to service providers like Life Alert or AAA. Before allowing those sales, however, AT&T would review a service provider’s “use case,” where the provider described why it needed the location data and how it obtained customers’ opt-in consent to use the data. (That the providers—as opposed to AT&T—obtained users’ consent would be important in the Commission’s section 222 analysis.) AT&T’s program also required providers to obtain and document customer consent for every location request. While AT&T reviewed the providers’ consent records daily, it did not verify customer consent before providing access to location data. AT&T also required aggregators to monitor providers and to comply with various security requirements, such as vulnerability scanning and encryption. At the same time, AT&T could cut off access to customer location information at any time.