Overview of the Fifth Circuit Appeal
On September 27, 2024, the Federal Communications Commission (FCC) and the United States Department of Justice filed their joint Brief for Respondents in the U.S. Court of Appeals for the Fifth Circuit in AT&T Inc. v. FCC and USA (No. 24-60223). The filing asks the court to deny AT&T's petition for review and uphold a $57,265,625 monetary forfeiture penalty imposed on the carrier for customer proprietary network information (CPNI) violations.
The Commission's underlying enforcement action stems from findings that AT&T failed to maintain reasonable measures to protect customer location data and disclosed customer location information without required consent through its Location-Based Services program.
- Case: AT&T Inc. v. Federal Communications Commission and United States of America, No. 24-60223 (5th Cir.)
- Statutory Provisions: 47 U.S.C. § 222, 47 U.S.C. § 503, 47 U.S.C. § 504
- Regulatory Provisions: 47 C.F.R. § 64.2007, 47 C.F.R. § 64.2010
- Assessed Penalty: $57,265,625
Underlying Facts and Enforcement Background
Until March 2019, AT&T operated a Location-Based Services program that sold access to customer location information to location aggregators, who subsequently resold access to third-party location-based service providers. In total, AT&T provided access directly or indirectly to 88 third-party entities across 84 separate contractual chains.
On May 10, 2018, public reporting revealed that Securus Technologies, a location-finding service provider operating through aggregator LocationSmart, allowed unauthorized location tracking. Former Missouri sheriff Cory Hutcheson submitted thousands of unauthorized location requests from 2014 to 2017 without proper legal process, tracking individuals including a circuit judge and highway patrol officers. Although AT&T terminated Securus's access shortly after the reports, it did not terminate its broader location aggregator program until March 2019.
On February 28, 2020, the FCC issued a Notice of Apparent Liability proposing a $57,265,625 penalty against AT&T. Following written responses, the FCC affirmed the forfeiture order, which AT&T paid prior to petitioning the Fifth Circuit for review under the Hobbs Act.
- Aggregator Model: AT&T relied on downstream contracts with aggregators and service providers rather than verifying customer consent directly.
- Breach Scope: Unauthorized tracking occurred over multiple years using non-compliant documentation such as training manuals and insurance policies in place of legal process.
- Program Termination: AT&T announced the termination of its aggregator program in January 2019 and concluded it in March 2019.
Constitutional Defenses Presented by the FCC and DOJ
In the brief, the FCC and DOJ argue that the statutory forfeiture scheme does not violate the Seventh Amendment, Article III, or the Due Process Clause. The government notes that under 47 U.S.C. § 504(a), AT&T was entitled to a de novo jury trial in federal district court had it refused payment and awaited a Department of Justice collection suit, but instead voluntarily waived that forum by paying the fine to seek Hobbs Act review in the appellate court.
The government further asserts that Section 222 privacy enforcement has no common law analogue from the Founding era and falls squarely within the historic 'public rights' exception governing common carriers and federal radio spectrum licensees.
Responding to non-delegation arguments, the brief states that the choice between issuing a Notice of Apparent Liability under Section 503(b)(4) or initiating a formal administrative hearing under Section 503(b)(3) constitutes executive enforcement discretion guided by the statutory standard in 47 U.S.C. § 154(j).
- Seventh Amendment: Forfeiture recovery under Section 504 provides a trial de novo in district court; regulatory oversight of common carrier spectrum licensees falls within public rights.
- Due Process & Article III: Combination of investigative and notice functions within the agency is standard and does not establish unconstitutional bias.
- Non-Delegation Doctrine: Choice of procedural enforcement paths is an executive function governed by an intelligible principle.
Statutory Authority and Calculation of Forfeiture
The FCC and DOJ argue that wireless location information constitutes CPNI under 47 U.S.C. § 222(h)(1)(A), which explicitly defines CPNI as information relating to the 'location' of a telecommunications service made available by virtue of the carrier-customer relationship. The government rejects AT&T's contention that CPNI is restricted to 'call location' data during active voice calls.
The brief defends the penalty calculation methodology, which treated AT&T's failure to safeguard customer data across 84 separate contractual aggregator and provider relationships as 84 continuing violations. The Commission assessed a base forfeiture of $40,000 for the first day and $2,500 for each subsequent day per violation (excluding a 30-day grace period), yielding a $45,812,500 base amount that was adjusted upward by 25% due to the severity and public safety risks of the violations.
- CPNI Definition: Plain statutory text of 47 U.S.C. § 222(h)(1)(A) encompasses location data obtained automatically via carrier network operation.
- Violation Assessment: Calculated across 84 separate continuous contractual arrangements where CPNI was disclosed without effective safeguards.
- Base Penalty: $45,812,500 base forfeiture with a 25% upward adjustment reflecting culpability, scale, and deterrence for a major carrier.