Privacy alert: Your phone records for sale

By Liz Pulliam Weston

You can't turn around these days without discovering some new way that your privacy is being invaded. Egregiously.

But the recent furor over "pretexting" and the sale of consumer phone records on the Internet is missing a couple of important points.

Yes, less-than-ethical companies posed as consumers or even phone company employees to get copies of people's phone records -- whom they've called, when they called, plus the names and addresses associated with various cell and landline numbers. The practice is called pretexting because these companies get the records based on the pretext that they're someone they're not.

And yes, the records thus purloined could be purchased for about $100 a pop on any one of at least 40 Internet sites.

Growing outrage, however, recently led to the following actions:

• Sweeps by the Federal Trade Commission shut down many of the sites or caused them to stop advertising for new business. Meanwhile, the Federal Communications Commission said it had subpoenaed about 30 sites as part of its investigation.

• The FCC also demanded carriers prove they were protecting consumer information from the data brokers, and took steps to fine two carriers, AT&T and Alltel, $100,000 each for violating data protection rules.

• Not to be outdone, several carriers have filed civil lawsuits against various data brokers. Verizon Wireless, Cingular Wireless, T-Mobile USA and Sprint Nextel have all launched such suits. So have several states, including Florida and Illinois.

• Congress is mulling new legislation, which has a pretty good shot at becoming law, to clearly ban the practice. (Pretexting to obtain financial records was outlawed by the Gramm Leach Bliley Act in 1999, but there's no similar federal law regarding phone records.)

No one's out to get you … yet

In any case, the chances of your own records being collected and sold this way were frankly pretty slim. The brokers typically didn't collect records wholesale; they waited for customers to provide them with a phone number (and a valid credit card) before conning the phone companies out of the data. So unless you were involved in a messy divorce, corporate espionage or a lawsuit, chances are good that nobody wanted to buy your data through these brokers.

"We believe there are three (categories) of buyers," said Chris Hoofnagle, senior counsel for the Electronic Privacy Information Center, which brought the practice to the government's attention last summer. "The jealous spouse ... who wants to see who his wife has been talking to. ... Employers investigating business espionage, seeing whom their employees are talking to. ... And (parties involved in) litigation."

(You also might have been at risk if you were a public figure. To prove a point, blogger John Aravosis in January wrote about how he obtained three days' worth of Gen. Wesley Clark's cell phone calls for $89.95. Wesley was a former U.S. presidential candidate. Earlier, Maclean's magazine bought the records of Canada's federal privacy commissioner, Jennifer Stoddart.)

The real threat: your phone company

What's received scant attention in all the hoopla, and what should perhaps concern you more, is the perfectly legal sale of your phone records, by your own phone company, for marketing purposes.

In most states, your carrier can hawk your records after sending you a notice -- perhaps buried among the other flyers stuffed in with your bill. If you don't object within 30 days or so, your data is fair game.

The marketers likely are more interested in your calling patterns than exactly who you're talking to and for how long, Hoofnagle said. So they're not judging you for calling QVC more often than you call your folks, but they may think you're a good target to buy lots more heavily hyped junk. If you make lots of international calls, you might be identified as a potential buyer of travel insurance or money transfer services.

It's unclear how much of this data-selling is going on. Hoofnagle believes most carriers sell the data, but the two major telecom groups -- the United States Telecom Association and CTIA-The Wireless Association -- insist they don't know. A few states, including California and Washington, were worried enough about it to pass "opt in" laws, which require carriers to obtain customers' permission before selling their records. Corporations hate "opt in," because they know few consumers who have a choice will agree to have their private information sold to strangers.

4 ways to keep private calls private

The heads of the FCC and the FTC have proposed a solution: ban the commercial sale of phone records by third parties entirely and force carriers to inform their customers when their personal information is used for marketing.

While we're at it, let's also outlaw pretexting altogether. The other issue that's missing in most of the coverage of phone record sales is that data brokers, private investigators and skip-tracers manage to get their hands on all kinds of non-public data, from utility bills to medical records to cable and satellite statements, by pretending to be someone they're not.

If you're concerned about your private data, consider taking the following steps:

• Opt out. Call your carriers and tell them not to sell, release or share your records, also known as "customer proprietary network information" or CPNI.

• Password-protect your phone accounts. You can ask your phone carriers not to release information to anyone who doesn't know the password. (You'll probably have to agree that if you forget the password yourself, you'll go to the carrier in person to reset it.)

  Get the latest from Liz Pulliam Weston. Sign up to receive her free weekly newsletter.

  Preferred format:

  HTMLPlain Text

  Learn more about newsletters

• Consider losing the details. If you don't need records of whom you called and when, you can ask your carrier not to provide those details in your bills and to instead include just summaries.

• Contact your U.S. senators and representatives. If you don't know who they are, you can use the database here. Push for bans on commercial sales of phone records, and on pretexting to obtain non-public data, whatever the source.

Liz Pulliam Weston's column appears every Monday and Thursday, exclusively on MSN Money. She also answers reader questions in the Your Money message board.