Business
By Anthony Isibor
THE U.S. Federal Communications Commission, FCC, has imposed nearly $196 million in fines against T-Mobile, AT&T and Verizon, for unlawfully sharing customers’ real-time location data.
The penalties, issued against major communication giants, have reignited concerns over how companies collect, share and protect sensitive user information in an increasingly data-driven economy.
Privacy advocates argue that the case highlights a fundamental breach of trust between service providers and consumers, while industry experts say the scandal exposes weaknesses not only in consent practices, but also in the mechanisms used to verify who gains access to sensitive data.
According to Vaidotas Šedys, Chief Risk Officer at oxylabs, the controversy underscores two critical failures: the sale of user data without informed consent and inadequate controls over third parties that ultimately obtained access to the information.
“The issue is that companies sold user data without consent and users were never informed it was happening,” Šedys said. “Situations like this break the transparency contract between a service provider and its users.”
He, however, cautioned that transparency alone is not enough.
“Even when disclosures are in place and all parties appear to be informed, a single bad actor slipping through the vetting process can expose data in ways no privacy policy anticipated,” he explained.
The case has renewed attention on Know-Your-Customer, KYC, procedures, a process commonly associated with financial institutions. but increasingly viewed as essential for technology and data-driven businesses.
Šedys argued that organizations handling sensitive information have an ethical responsibility to thoroughly understand who their customers and partners are and why they require access to specific datasets.
“Missing just one bad actor can bring significant financial and reputational damage,” he said.
To prevent similar incidents, he recommends a three-part KYC framework centered on identity verification, use-case assessment and continuous monitoring.
The first stage involves verifying legal entities, reviewing documentation and conducting background checks through public records and follow-up inquiries. The second focuses on understanding how customers intend to use the data or services being requested and whether those explanations align with legitimate business purposes.
The final component, ongoing due diligence, requires companies to continuously reassess customer activities to ensure their operations remain consistent with previously disclosed intentions.
“Customers may change direction or expand activities over time, so providers should periodically check whether everything remains properly disclosed and compliant,” Šedys noted.
The FCC action is widely viewed as a warning to organizations that monetize customer information or provide access to sensitive datasets through complex third-party arrangements.
Privacy experts say the penalties demonstrate that regulatory scrutiny is increasingly shifting beyond data collection practices to include the broader chain of custody surrounding personal information.
For businesses operating in telecommunications, technology, financial services and data intelligence, the message is becoming clear: obtaining consent is only part of the responsibility. Ensuring that customer data remains protected throughout its lifecycle may prove equally important in avoiding costly regulatory action and preserving public trust.
The case is expected to fuel ongoing debates over data privacy regulations and corporate accountability as governments worldwide seek stronger safeguards for consumer information in the digital age.
A.I
June 5, 2026
Tags: AT&T FCC Federal Communications Commission T-Mobile Verizon