AT&T holds onto customer usage data for seven years

Amid an ongoing debate over Internet users' privacy, new documents indicate that AT&T holds onto its customers' location and usage data for seven years – far longer than its rivals.

"There is no conceivable business reason they need that much," Nate Wessler, deputy project director of the Speech, Privacy, and Technology Project at the American Civil Liberties Union (ACLU), told Motherboard.

In comparison, T-Mobile holds onto its own subscriber data – including call records, cell site connection information and text content – for around two years before discarding it. Verizon holds onto such data for one year.

The new information comes from Motherboard, which published a 139-page report from the FBI's Cellular Analysis Survey Team (CAST) dated 2019. The report is essentially a guide for how law enforcement can legally access telecommunications data. Such data – which typically can only be obtained by law enforcement officers through a warrant or court order – is often used in cases involving kidnappings, homicides, missing persons and robberies.

"I've never seen a visualization of it," Wessler, of the ACLU, said of the report published by Motherboard.

Indeed, the details of the report are eye-opening. For example, AT&T retains "cloud storage internet/web browsing" data for one year.

"Like all companies, we are required by law to comply with mandatory legal demands, such as warrants based on probable cause. Our responses comply with the law," AT&T spokesperson Margaret Boles explained to Motherboard.

The report is noteworthy considering it comes just days after the Federal Trade Commission released a report that found that top broadband service providers including AT&T "collect troves of personal data," and that consumers don't have much choice on how that data is used.

"Many internet service providers (ISPs) collect and share far more data about their customers than many consumers may expect – including access to all of their Internet traffic and real-time location data – while failing to offer consumers meaningful choices about how this data can be used," the FTC said of its 74-page report (PDF).

To be clear, the FTC report focused on data used for advertising services rather than law enforcement directives.