AT&T's own privacy notice discloses collection of broad categories of personal information, including biometric identifiers, browsing and app-usage data gathered via cookies and pixels, and data purchased or obtained from outside sources such as credit reporting agencies, and it discloses that some of this information is shared with non-AT&T advertising companies in ways it characterizes as a 'sale' under certain state laws while stating it does not sell 'Sensitive Personal Information.' As a Delaware-incorporated, publicly traded holding company, AT&T Inc. discloses its corporate structure and subsidiaries in SEC filings, but the company's regulatory record includes multiple FCC enforcement actions and large-scale data breaches between 2015 and 2024 involving customer proprietary information, location data, and Social Security numbers. Two of the largest FCC penalties against AT&T — a 2015 consent decree over call-center data theft and a 2024 fine over location-data sharing — were among the largest data-privacy enforcement actions the agency has issued against a telecom carrier, though the 2024 location-data fine was later vacated on procedural grounds by a federal appeals court.
TRACK RECORD
4 ENFORCEMENT ACTIONS
[2024-09-17]
In September 2024, the FCC announced a $13 million settlement with AT&T resolving an investigation into a January 2023 breach of a third-party cloud vendor that exposed data related to more than 8.9 million AT&T Mobility customers; AT&T also entered a consent decree requiring enhanced vendor oversight and data governance.
In 2024, the FCC reached a $13 million settlement with AT&T over a vendor cloud breach that exposed data of approximately 8.9 million AT&T Mobility customers, requiring AT&T to implement expanded data protection and vendor oversight commitments.
In 2024, the FCC finalized a $57 million fine against AT&T for selling access to customers' real-time location data to aggregators without obtaining valid customer consent, part of a combined $196 million action against major U.S. wireless carriers.
In 2019, the FTC reached a $60 million settlement with AT&T resolving allegations that it misled customers with 'unlimited' mobile data promises while throttling speeds; the order bars AT&T from advertising data plans as unlimited without prominently disclosing material restrictions.
Receipted federal filings: FEC campaign-finance records and LDA lobbying disclosures. A tie is a disclosed transaction or filing, not a claim of influence or wrongdoing.
AT&T SERVICES INC reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Commerce, Science, and Transportation, per LDA Form LD-2.
AT&T SERVICES INC reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Environment and Public Works, per LDA Form LD-2.
AT&T SERVICES INC reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Banking, Housing, and Urban Affairs, per LDA Form LD-2.
AT&T SERVICES INC reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Appropriations, per LDA Form LD-2.
AT&T SERVICES INC reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Energy and Natural Resources, per LDA Form LD-2.
AT&T SERVICES INC reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Agriculture, Nutrition, and Forestry, per LDA Form LD-2.
AT&T SERVICES INC reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on the Judiciary, per LDA Form LD-2.
AT&T SERVICES INC reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Commerce, Science, and Transportation, per LDA Form LD-2.
AT&T SERVICES INC reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on the Judiciary, per LDA Form LD-2.
AT&T's Privacy Notice states that the company collects biometric information such as fingerprints, voice prints, and face scans that may be used to identify individuals.
AT&T Inc.'s SEC Form 10-K filings identify it as a holding company incorporated in Delaware, with its principal executive offices in Dallas, Texas, and disclose that its annual and periodic reports are filed with, or furnished to, the SEC.
An exhibit to AT&T Inc.'s SEC Form 10-K (filed February 18, 2016) lists the company's principal operating subsidiaries and the states in which each is incorporated, including AT&T Mobility LLC, Southwestern Bell Telephone Company, and BellSouth Telecommunications, LLC.
AT&T's Business Customer Privacy Notice for Most of World states that a list of AT&T affiliates and the countries in which they are located is made available to customers via a linked resource.
AT&T Inc.'s 2024 Form 10-K, filed with the SEC, discloses the company's corporate history, including that its subsidiaries merged with incumbent local exchange carriers Pacific Telesis Group in 1997 and Ameritech Corporation in 1999.
AT&T's Website User Privacy Notice states that personal data recipients may include AT&T affiliates and personnel, business partners, third-party service providers, suppliers, vendors, and subcontractors performing services for AT&T.
AT&T's June 2020 Privacy Policy states that the company may have sold each of the disclosed categories of CCPA personal information, as required to be disclosed under California privacy law.
According to a 2024 FCC enforcement finding reported by KrebsOnSecurity, AT&T sold customer real-time location data directly or indirectly to at least 88 third-party entities via data aggregators.
In 2015, the FCC reached a $25 million settlement with AT&T after finding that employees at call centers in Mexico, Colombia, and the Philippines accessed and disclosed personal information, including Social Security numbers, of an estimated 300,000 customers without authorization.
In 2019, the FTC reached a $60 million settlement with AT&T resolving allegations that it misled customers with 'unlimited' mobile data promises while throttling speeds; the order bars AT&T from advertising data plans as unlimited without prominently disclosing material restrictions.
In March 2024, AT&T disclosed that personal information belonging to approximately 73 million current and former customers, including Social Security numbers, had appeared in a dataset on the dark web, and the company stated it had not yet determined whether the data originated from AT&T or one of its vendors.
In 2024, the FCC finalized a $57 million fine against AT&T for selling access to customers' real-time location data to aggregators without obtaining valid customer consent, part of a combined $196 million action against major U.S. wireless carriers.
In September 2024, the FCC announced a $13 million settlement with AT&T resolving an investigation into a January 2023 breach of a third-party cloud vendor that exposed data related to more than 8.9 million AT&T Mobility customers; AT&T also entered a consent decree requiring enhanced vendor oversight and data governance.
In 2024, the FCC reached a $13 million settlement with AT&T over a vendor cloud breach that exposed data of approximately 8.9 million AT&T Mobility customers, requiring AT&T to implement expanded data protection and vendor oversight commitments.
In April 2025, the U.S. Court of Appeals for the Fifth Circuit vacated the FCC's $57 million location-data forfeiture order against AT&T, ruling that the FCC's in-house enforcement process was unconstitutional because it denied AT&T a jury trial.
AT&T agreed to a $177 million class-action settlement covering two 2024 data breaches — one exposing personal data of roughly 73 million current and former customers and a second, Snowflake-linked breach exposing call and text records of nearly all cellular customers — with the settlement pending final court approval.
AT&T's Privacy Notice states that the company uses pixels, cookies, and other similar online tracking technologies to collect web browsing and app information such as advertising IDs, search terms, and ads viewed.
AT&T's Privacy Notice for AT&T Inc. Websites states that the company does not knowingly permit third parties to track users' online activity across third-party websites over time unless the user has given consent, indicating that such cross-site tracking is permitted with consent rather than disabled.