# Monetizing network and location analytics without crossing the line
In 2019, several major US carriers were caught selling customers' real-time location data to third-party brokers, some of which resold it down a chain that ended with bounty hunters and stalkers. The fallout was severe: the FCC (Federal Communications Commission, the US telecom regulator) eventually proposed nearly 200 million dollars in fines across the largest operators. The lesson stuck. Location data is one of the most valuable assets a carrier holds, and one of the fastest ways to destroy customer trust.
This lesson is about the narrow, profitable path between those two facts.
Every phone constantly talks to the network. To route calls and data, the operator always knows roughly which cell tower you are near. That means carriers passively collect two things no app can match:
Unlike an app that only sees its own users, a carrier sees a large, representative slice of the whole population. That scale is the product.
The buyers are rarely interested in individuals. They want patterns.
The 2019 scandals were not about aggregate analytics. They were about selling individual, identifiable, real-time location. That is the bright line.
Everything defensible in this business depends on one idea: aggregation and anonymization. Instead of "device 4471 was at this coffee shop at 9:02am," you sell "an estimated 3,200 people visited this shopping district on Saturday, 60 percent from within 5 kilometers."
The re-identification risk is real. A widely cited study by de Montjoye and colleagues found that four location points are often enough to uniquely identify an individual in a mobility dataset. You can read a summary of that work in this Nature Scientific Reports paper.
That is why "we removed the names" is never enough.
Serious operators use layered protection, not a single trick.
k-anonymity. Never report a group so small that individuals stand out. A common rule is a minimum count threshold: suppress any cell where fewer than kkThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.Voir la définition complète → people (say, 25 or 50) appear. If only three people visited a rural clinic on Tuesday, you show nothing.
Spatial and temporal blurring. Report by neighborhood and by hour, not by exact coordinate and second.
Differential privacy. A mathematical technique that adds carefully calibrated statistical noise so that the presence or absence of any single person cannot be detected in the output, while the overall pattern stays accurate. It is the current gold standard for aggregate statistics.
Here is the intuition in a tiny snippet:
import numpy as np
def private_count(true_count, epsilon=1.0):
# Laplace mechanism: noise scaled to privacy budget epsilon.
# Smaller epsilon = more noise = more privacy.
noise = np.random.laplace(loc=0, scale=1/epsilon)
return max(0, round(true_count + noise))
# A district had 3200 visitors; released figure is fuzzed:
print(private_count(3200, epsilon=0.5))The buyer still learns "about 3,200 visitors." No one can learn whether you, specifically, were one of them.
Carriers rarely sell raw data anymore. The reputational and regulatory cost is too high. Instead, the market has shifted toward safer structures.
The common model is a product, not a feed. The carrier processes everything internally and sells a dashboard or a report: "footfall trends for this retail corridor," "origin-destination flows for this metro area." The underlying data never leaves the operator.
Telefonica has run a unit along these lines, and several European operators offer similar mobility-insights products aimed at retail and public-sector clients. (Product names and scopes change often, so confirm current offerings directly.)
A clean room is a secure environment where two parties (say a carrier and a retailer) combine their data to answer a specific question without either side seeing the other's raw records. The retailer learns "did my campaign lift store visits?" without ever receiving a list of who visited. This structure is now central to privacy-conscious advertising.
During COVID-19, several operators shared aggregated mobility data with governments and researchers to track movement and model outbreak spread. Done transparently and in aggregate, this built goodwill rather than eroding it. It is a useful template: aggregate, purpose-limited, publicly explained.
Vérification des acquis
1. What fundamentally distinguishes carrier location data from the location data collected by a typical mobile app?
2. Based on the lesson, what was the actual 'bright line' that carriers crossed in the 2019 scandals?
3. A transit agency wants to redesign bus routes and study commuting patterns across a city. Why is carrier mobility data an appealing option for them?
4. Select ALL correct answers about the types of buyers for carrier location analytics and what they seek.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers describing why location data is described as a double-edged asset for carriers.
Sélectionnez toutes les réponses correctes.
Technology alone does not keep you out of trouble. The 2019 carriers had contracts and policies too; they just did not enforce the downstream chain. Governance is where deals live or die.
The fatal 2019 mistake was losing sight of where data went after the first sale. Best practice now:
Even aggregated data can be sensitive if it reveals visits to a place of worship, a hospital, a protest, or an abortion clinic. Many operators now maintain suppression lists for sensitive points of interest. This is both an ethical and a legal necessity in several jurisdictions.
Rules vary sharply by region:
A single global process built to the strictest standard is usually cheaper than maintaining many.
Before launching any location-data productdata productA data asset managed like a product, with an owner, defined users, guaranteed quality, and measurable business value.Voir la définition complète →, ask:
1. Could any single person be re-identified from the output? If maybe, add aggregation or noise.
2. Did users clearly agree to this specific use? If not, stop.
3. Would this look defensible on the front page of a newspaper? If not, redesign it.
That third question would have stopped most of the disasters in this field.