“Survey: Mobile App Privacy Fears Continue to Escalate”

That’s the title of a story yesterday.

So you might ask: Well, isn’t the Federal Communications Commission the cop on the beat? The answer may surprise you: Because of the tsunami of deregulation carried out over the last few years, the FCC’s power to do anything about abuses of consumer privacy in the wireless world is murky at best – and arguably non-existent. The Commission deregulated wireless data services on the assumption that competition would protect consumers. Now we have the worst of both worlds: No real competition and no protection.

Here’s how this works. Congress has clearly said that “telecommunications carriers” are not permitted to disclose “consumer proprietary network information” (CPNI) – and that includes location information. With the exception of emergencies, or in cases where the consumer has given consent to disclosure, the ban is flat and absolute.

There are (at least) two enormous holes in this ban.

The first is that CPNI is information generated in the course of the relationship between the consumer and the carrier. The definition doesn’t cover the zillions of applications that people download from others onto their smartphones.

The second enormous, gaping hole is that the FCC has labeled data (non-voice) services provided by wireless providers as “information services” – that’s the deregulatory move. They’re not the “telecommunications services” covered by Congress’s language.

So if you’re just making a phone call using a handset, the CPNI rules probably work and protect your location information. But if you’re using some app that relies on GPS data (using that same handset), the CPNI rules don’t apply. There is little or nothing you can do about third-party access to your location information – or any other private information – unless the app provider has affirmatively deceived you about the privacy protections it provides (thus triggering protection by another federal agency, the Federal Trade Commission).

The FCC issued a recent report about all this (pdf here) that focuses on industry best practices and carefully does not assert that the Commission has any power to actually do anything.

Meanwhile, Verizon and AT&T are the undisputed giants of the US wireless world. They collectively account for 64% of the invested capital in the wireless industry and more than 90% of free cash flow. They have huge advantages of scale and scope – more spectrum, more customers, more everything – over any potential competitors. That’s not a very competitive picture.

And these same carriers are now pointedly telling the FCC not to think of protecting the privacy of smartphone users. They’d prefer to see codes of conduct developed by industry groups with the assistance of the Department of Commerce.

Now, that may work fine if violation of those codes of conduct can give rise to liability. But in the meantime there is no protection for consumers in place.