Mobile carriers can retain detailed records of calls, texts and data sessions for years, creating a significant privacy risk if that information is exposed. These records may reveal who a person communicates with, where they spend time and how their daily routine is structured.
The risk became clear in April 2024, when AT&T disclosed a breach involving communication logs from 109 million customers, including current and former subscribers. The affected data covered phone numbers, call and text counts, call durations and location information from May through October 2022 and January 2023.
AT&T said the records did not include call content, customer names or Social Security numbers. However, metadata can still be highly revealing. Call Detail Records typically indicate who participated in a communication, when it occurred, how long it lasted and, in many cases, which cell site was used. Separate signaling records help carriers manage and troubleshoot calls and messages.
Taken together, this information can expose close relationships, identify likely homes and workplaces, and reconstruct recurring patterns. Metadata may also be combined with public information to determine identities. The article cites Malte Spitz, who obtained approximately 35,000 records from his telecom provider in 2011 and used them to reconstruct several years of activity.
Long retention periods make these records attractive targets. Carrier privacy policies often describe retention as lasting as long as necessary for stated purposes, without specifying a precise period. In 2022, carriers told the FCC that some geolocation data could be retained for up to five years. Telecom data has also been targeted in major breaches and can be used for behavioral profiling, advertising, data brokerage and government requests.
The central privacy argument is that information deleted shortly after use cannot be stolen years later. Cape, the mobile carrier featured in the source, says it limits the data collected and automatically deletes call and text metadata. Its stated retention periods are 14 days for SIP messages, one day for internal Call Detail Records, 30 days for billing records and up to 60 days for daily usage totals.
According to Cape, SIP messages are retained temporarily to investigate network problems before being converted into internal records and deleted. Daily totals cover the number of calls, SMS and MMS messages, plus the amount of data used in a day. Billing records supplied by partner networks are kept for up to 30 days to allow billing disputes.
Cape also says it rotates network identifiers to reduce the ability of tower operators and partner networks to link their logs to individual subscribers. The company hired Trail of Bits to review its retention system in May and July 2026. The published attestation found no evidence that records were kept beyond the stated policy or that Cape extracted and retained individual customer information from CDRs beyond daily totals.
The source argues that retention practices should be considered part of a person’s threat model, particularly for journalists, executives, security professionals and anyone communicating with doctors, lawyers or confidential contacts. Reducing the amount of data held by a carrier limits what can be exposed in a future breach.
Sources: BleepingComputer.