T-Mobile customers are going to see their privacy policies change in a big way next month, especially if they're former Sprint customers who've been folded into the merged wireless carrier. Users will be enrolled by default unless they actively opt out.
Beginning April 26, a new data-collection program begins that "uses some data we have about you, including information we learn from your web and device usage data (like the apps installed on your device) and interactions with our products and services," according to a T-Mobile privacy notice posted online last month.
- T-Mobile data breach: What got exposed
- The best phone carriers in the United States
- Plus: These dangerous Android apps can hijack your phone — what to do
This personal information, which is more detailed than that gathered by AT&T and Verizon's basic data-collection programs, may be used by third-party advertisers as well as T-Mobile's own advertising.
AT&T and Verizon have other data-collection programs that gather more details about customers and share them with third parties, according to The Wall Street Journal.
The difference is that users have to opt into those programs. Sprint, which is now part of T-Mobile after the two companies merged last year, had a similar program that was also opt-in.
T-Mobile's new program is opt-out, meaning that the data will be harvested and shared unless users take active steps to remove themselves. (We'll show you how below.)
"We've heard many say they prefer more relevant ads so we're defaulting to this [opt-out] setting," an unnamed T-Mobile spokeswoman told The Journal.
The Journal implied that more may be changing for former Sprint customers than for longtime customers of T-Mobile or its prepaid Metro by T-Mobile subsidiary.
We asked T-Mobile for further clarification. The response was:
"This new change enables the delivery of ads based on customer interests. We've updated customers' privacy choices to align with how we're using data moving forward."
How can this data be misused?
T-Mobile's privacy notice spells out that by the time this detailed data gets to third parties, "it is not tied to your name or information that directly identifies you" and that "instead, we tie it to your mobile advertising identifier or another unique identifier."
That sounds nice, but every privacy expert worth their salt knows that advertising IDs on smartphone apps can easily and quickly be traced back to individual people.
"This type of data is very personal and revealing, and it's trivial to link that deidentified info back to you," Electronic Frontier Foundation lawyer Aaron Mackey told The Journal.
At the DerbyCon hacker conference in 2018, Chicago-based researcher Mark Milhouse showed how $100 in smartphone ad buys made it possible to track the physical location of any single person using just advertising IDs.
So what kind of data is T-Mobile collecting?
Ars Technica dug up a T-Mobile web page that spelled out what kind of data "we and others may collect and use for advertising and analytics."
The data set includes:
- "Device IDs [which are often permanent] ad IDs, and cookie IDs"
- "Addresses of websites visited"
- "Types of websites visited"
- "Applications, content and features used"
- "Data and calling features, device type, operating system type, and amount of use"
- "Demographics information inferred from usage and device data and location data"
- "Inferences about your age, household, education, and personal preferences"
- "Information about your general location, sometimes derived from IP addresses and cellular data sessions"
- "Precise location information based on triangulated information from the location of cell towers serving your device, used with your consent for targeted advertising"
It's not clear which of these are used for analytics, which are used for advertising and which are used for both.
How to opt out of T-Mobile's data collection
To opt out of T-Mobile's new data-collection program, T-Mobile customers can use the T-Mobile app, according to The Journal. In the More tab, find "Advertising and Analytics" and toggle off the option to "Use my data to make ads more relevant to me."
T-Mobile users can also go to the T-Mobile website and go to My Account > Profile > Privacy and Notifications > Advertising and Analytics and toggle off "Use my data to make ads more relevant to me."
Former Sprint users need to log into their accounts on the Sprint website, and then dig into their account preferences, find the advertising and analytics preferences and toggle off "Use my data to make ads more relevant to me."
Metro users can use either the MyMetro app or the Metro website, but they need to access the website through a mobile browser. In either one, it's Account > Network and Location Settings and toggle off "Use my data to make ads more relevant to me."
