Metro by T-Mobile is T-Mobile US, Inc.'s prepaid wireless brand (formerly MetroPCS), sold through T-Mobile-owned and operated retail stores and metrobyt-mobile.com. Metro publishes no separate privacy policy of its own; its privacy-policy page states customers should consult T-Mobile's privacy center 'for full information,' meaning Metro subscribers are governed by T-Mobile's company-wide privacy notice, which covers CPNI, third-party-sourced and purchased data, cookies/pixels/mobile-ad-ID tracking, and sharing with third-party advertising partners subject to a Do Not Sell/GPC opt-out rather than a blanket no-sale commitment. T-Mobile's FY2025 Form 10-K names Metro by T-Mobile as one of its three flagship brands. In September 2024 the FCC required T-Mobile, at the parent level, to overhaul its data-security practices as part of a consent decree resolving multiple 2021-2023 data-breach investigations, alongside a $31.5 million settlement -- a company-wide enforcement action that applies to Metro's parent, not a Metro-specific incident.
TRACK RECORD
1 ENFORCEMENT ACTION
[2024-09-30]
The FCC's Enforcement Bureau published a Consent Decree (DA-24-860, released September 30, 2024) titled 'In the Matter of T-Mobile US, Inc.' resolving multiple data-breach investigations by requiring T-Mobile to improve corporate governance, undergo third-party assessments, and strengthen identity and access management -- a company-wide (parent-level) enforcement action covering breaches from 2021-2023 and paired with a $31.5 million settlement, applicable to all T-Mobile US brands including Metro by T-Mobile.
T-Mobile's company-wide privacy notice -- which governs Metro by T-Mobile since Metro publishes no separate policy -- states T-Mobile collects Customer Proprietary Network Information (CPNI) from wireless voice communications use, and separately discloses that it 'may also buy or get personal data from other third parties, like social media platforms, analytics providers, and consumer data resellers,' using this data for product improvement, marketing, and advertising.
Metro by T-Mobile's own privacy-policy page (published December 21, 2019) publishes no independent privacy policy; it directs visitors to T-Mobile's privacy center, stating 'For full information on our privacy policy, visit our privacy center at https://www.t-mobile.com/privacy-center/our-practices/privacy-policy,' confirming Metro is governed by, and administratively folded into, T-Mobile's own privacy program.
T-Mobile US, Inc.'s Form 10-K for fiscal year 2025, filed with the SEC on 2026-02-11, states that T-Mobile provides services, devices, and accessories across its 'flagship brands, T-Mobile, Metro by T-Mobile and Mint Mobile,' through T-Mobile and Metro by T-Mobile owned and operated retail stores and websites including www.metrobyt-mobile.com, confirming Metro's status as a wholly disclosed T-Mobile US (NASDAQ: TMUS) brand in mandatory SEC filings.
T-Mobile's privacy notice governing Metro states T-Mobile 'may also share mobile device identifiers, device and service usage data, and demographics information with third-party advertising partners who may use data to serve ads for T-Mobile and others,' and separately describes recognizing Global Privacy Control (GPC) signals to 'opt you out of the sale of your personal information' -- an opt-out mechanism rather than a blanket no-sale commitment.
The FCC's Enforcement Bureau published a Consent Decree (DA-24-860, released September 30, 2024) titled 'In the Matter of T-Mobile US, Inc.' resolving multiple data-breach investigations by requiring T-Mobile to improve corporate governance, undergo third-party assessments, and strengthen identity and access management -- a company-wide (parent-level) enforcement action covering breaches from 2021-2023 and paired with a $31.5 million settlement, applicable to all T-Mobile US brands including Metro by T-Mobile.
The App Store privacy label for T-Mobile's official 'myMetro' app (Metro by T-Mobile's account-management app) discloses that Identifiers are 'used to track you across apps and websites owned by other companies,' and that Location (precise and coarse), Identifiers (User ID, Device ID), Diagnostics, Contact Info (physical address, phone number), and Contacts are linked to the user's identity for the developer's advertising/marketing and analytics purposes.
The same T-Mobile privacy notice states it automatically collects 'unique identifiers like cookie IDs, device IDs including mobile advertising IDs, Internet Protocol (IP) address, and media access control (MAC) address collected through tracking technologies like web beacons, pixels, and other tracking technologies,' and separately states it may share mobile device identifiers, usage data, and demographics with third-party advertising partners who serve ads 'for T-Mobile and others.'