T. Scott Cowperthwait Vice President, Law Privacy and Cybersecurity August 3, 2022 Jessica Rosenworcel Federal Communications Commission 45 L Street NE Washington, DC 20554 Dear Chairwoman Rosenworcel, I write in response to your July 19, 2022 letter requesting information about Spectrum Mobile’s consumer geolocation data retention and sharing practices and policies. Charter has a longstanding commitment to protecting the privacy and security of its customers, and Spectrum Mobile likewise values and relies on our customers’ trust. That is why Spectrum Mobile: (1) Provides customers with detailed information about our privacy practices, including how we collect, use, and protect geolocation data; (2) Explicitly requests permission to collect customer geolocation information, and allows customers to opt out or change their location sharing preferences at any time; (3) Restricts the collection of geolocation information, when enabled, to what is necessary to provide and optimize service; and (4) Does not share or sell customer geolocation information with third parties for any purpose, including advertising. These practices reflect our core business objective of providing consumers with the most innovative and superior products and services, while offering transparency about the data we collect and choices about how we use that information to achieve that objective. We hope our responses offer insight into Spectrum Mobile’s limited collection and utilization of customer geolocation information and our efforts to protect the privacy, security, and preferences of our customers. Thank you again for the opportunity to respond to your questions. If you have any questions regarding these responses, please do not hesitate to contact me at Scott.Cowperthwait@charter.com. Sincerely, T. Scott Cowperthwait Vice President, Law - Privacy and Cybersecurity 400 WASHINGTON BLVD., STAMFORD, CT 06902 O 203.705.0827 Scott.Cowperthwait@charter.com 1. Data retention: a. Please describe in detail the geolocation data that Spectrum Mobile collects and/or retains regarding current and/or former subscribers. How is that data collected? For new and current subscribers: Charter launched Spectrum Mobile in 2018 as a Mobile Virtual Network Operator (MVNO), in partnership with Verizon. Under the MVNO agreement, when Spectrum Mobile customers are at home or in range of an out-of-home Spectrum WiFi access point, their mobile traffic offloads to Spectrum WiFi. Conversely, when they are away from home and out-of-range of a Spectrum WiFi access point, Spectrum Mobile customers connect to Verizon’s mobile network for call and data services. When a Spectrum Mobile customer connects using the Verizon mobile network, Verizon sends Spectrum Mobile a daily report of (1) the Verizon cell site Base Station Identifier (BSID) for the cell site used to start the call or data transmission; (2) the Verizon BSID for the cell site used to terminate the call or data transmission; (3) the originating BSID for a 4G LTE or 5G base station; (4) country information; and (5) when a subscriber is roaming internationally, the IP address of the foreign switch. Spectrum Mobile uses this information from Verizon to analyze customer traffic trends, for billing, and to provide troubleshooting and other customer service in the event of service-related issues. Verizon does not share the locations of specific cell sites or the geolocation of devices with Spectrum Mobile. When a Spectrum Mobile device connects using an in-home or out-of-home Spectrum WiFi access point, Spectrum Mobile receives the device’s Media Access Control (MAC) address, the customer’s username (if logged in to the My Spectrum App), which is encrypted, and the Spectrum WiFi access point’s geographical or billing location. If the customer has opted out of device location services, no device geolocation information is shared with Spectrum Mobile. If the customer has opted in to enable location services for Spectrum apps, like the My Spectrum App or Spectrum TV App, or the Android Connection Manager, the device communicates geolocation information with Spectrum Mobile to allow for troubleshooting in the event of a service issue, and to assist in efficiently managing and optimizing network performance. Spectrum Mobile only operates in the US; however, when subscribers use WiFi on a non-US network, Spectrum Mobile receives the country code and IP address of the foreign switch through its agreements with international partners. When subscribers are roaming on a partner WiFi network (e.g. Xfinity WiFi), Spectrum Mobile receives from the partner the country code, foreign (if applicable) switch IP address, network access point IP and MAC addresses, operator name, city name, and venue name information if connected to a specific enterprise network. A partner’s WiFi network may collect data in accordance with the partner’s own privacy policies, as disclosed to customers. 2 | P a g e When activating a device with Spectrum Mobile, permission to collect and use consumer geolocation information is explicitly requested, allowing customers to opt in or opt out of sharing it – a preference they may update at any time. If a customer opts in to enable location services, an embedded Connection Manager (on Android devices) or software in the My Spectrum App or Spectrum TV App (on any device) shares geolocation information with Spectrum Mobile for the purposes of diagnosing connectivity issues, and informing network planning and engineering. The information is encrypted and retained for no more than two years in case it is needed for specific troubleshooting reasons. Senior leaders must approve any request and accompanying business purpose to access decrypted geolocation information within the two-year retention period to troubleshoot a specific service issue. After two years, geolocation information is aggregated in a way that cannot be tied to an individual user and stored for up to three years for network planning, usage analytics, and year-over-year comparisons. Spectrum Mobile customers may change their My Spectrum App, Spectrum TV App, or Connection Manager settings, or opt out of location services, at any time, regardless of their device type. For former Spectrum Mobile customers: When a Spectrum Mobile customer terminates service and deletes the My Spectrum App and Spectrum TV App, Spectrum Mobile no longer collects the user’s geolocation information. Spectrum Mobile may retain previously collected geolocation information in limited circumstances for a certain period if required by law, or required for litigation or regulatory investigation. Any geolocation information previously received from Verizon or collected by Spectrum Mobile (through the Connection Manager, My Spectrum App, or Spectrum TV App) is retained for up to two years in encrypted form, and for up to three years in aggregated form, in a way that can’t be tied to an individual user or device. b. Please explain the reasons geolocation data is retained for both current and former subscribers. For devices that have enabled location services, Spectrum Mobile retains limited geolocation information to analyze data utilization and traffic patterns, troubleshoot service issues and manage and optimize our network performance. Spectrum Mobile also receives and retains from Verizon limited reports on call and data transmissions on the MVNO cellular network in order to bill and resolve disputes for customers, none of which contains device geolocation information. Spectrum Mobile does not sell or share geolocation data with third parties for any purpose, including advertising. Any information that we share with service providers supporting Spectrum Mobile is subject to applicable law and governed by contractual terms limiting the use of customer personal information to specific activities required by Spectrum Mobile. c. How long is geolocation data retained for both current and former subscribers? Spectrum Mobile retains geolocation information only so long as the information is needed for a specific business purpose, unless otherwise required by law, litigation, audit or investigation, and, in any event, for no more than two years at the individual level or three years in aggregated form. After two years, 3 | P a g e geolocation information is aggregated to show network usage across a 300-meter area so that it cannot be tied to an individual user; that allows Spectrum Mobile to inform network design, and compare year- over-year network trends. Once the designated time period is reached, the raw and aggregated geolocation information is automatically and permanently deleted. Charter also designates data custodians wherever location information is used or stored to ensure the information is deleted as required. d. Please provide a description of what safeguards Spectrum Mobile uses to protect current and former subscriber geolocation data. Spectrum Mobile protects user geolocation information through a combination of administrative, technical, and physical security practices, including encryption, access controls, and firewalls. Geolocation information is always stored in encrypted form, except when specifically approved for a limited troubleshooting purpose. Access to Spectrum Mobile geolocation information is managed by designated administrators, and through documented access request and approval procedures, using multi-factor authentication, corporate credentials and other role-based authorizations for specific software tools. Charter also maintains a firewall around its applications and internal infrastructure. e. In what country (or countries) is geolocation data stored? All geolocation information is stored in the United States. f. Please share whether and how you disclose your data retention policies to subscribers. Charter provides a series of privacy-related disclosures addressing how it collects and uses customer information, including geolocation information. Spectrum Mobile customers are prompted to accept or decline location data services when installing the My Spectrum App or Spectrum TV App or setting up a Spectrum Mobile Android device; they are also informed of how to change their settings or opt out of location services in the future. Additional privacy disclosures are posted on Charter’s website, available at https://www.spectrum.com/policies/your-privacy-rights. They include a comprehensive, public-facing privacy policy that applies to all Charter retail products, services, websites, and applications, and to consumer interactions with our call centers, stores, and online tools. Additional consumer-facing privacy policies address privacy requirements under specific laws, such as our California Consumer Privacy Policy, or apply to certain services or practices, such as the Company’s Biometric Data Privacy Notice and Internet DNS Privacy Notice. They also include information about how consumers can exercise meaningful choice with respect to how Charter uses their data. g. What is your data deletion policy for current or former subscribers, and how do you dispose of subscriber geolocation data? Charter applies data retention and data deletion policies based on the specific business purpose for which data was collected. Spectrum Mobile retains the basic customer account information used to set up service for as long as the customer maintains a Spectrum Mobile account, in order to manage the 4 | P a g e account, service hardware, resolve billing issues, and perform other basic functions to deliver service. Geolocation information is retained in encrypted form for up to two years, after which the data is aggregated and stored for up to three years to inform network design, and to compare year-over-year network trends. Once the designated time period is reached, the encrypted and aggregated geolocation information is automatically deleted permanently. Customers can manage their privacy preferences at any time through their device or app settings, and by visiting the Charter’s Privacy Preferences page, available at http://unsubscribe.spectrum.com. Charter provides both a web form and a toll-free number for California residents, including current and former customers, to request to delete personal information that Charter has collected. Customers can also contact Charter by mail or through their local customer service office with questions about Charter’s privacy practices. h. Do your subscribers have any opportunity to opt out of your data retention policies and if not, why not? Spectrum Mobile customers do not have the ability to opt-out of Charter’s overall data retention policies. However, customers do have the ability to opt out or manage whether Charter collects geolocation information via their mobile devices or through our mobile applications. To the extent required by law, Spectrum Mobile’s policy is to delete the personal information of any subscriber who has submitted a verified deletion request subject to any statutorily defined exceptions and consumers. 2. Data sharing a. Please provide Spectrum Mobile’s process and policies for sharing subscriber geolocation data with law enforcement? Charter’s Legal Response Ops Center (LEROC) redirects Law Enforcement requests for Spectrum Mobile customer geolocation information to Verizon, due to its limited access to geolocation information on its MVNO network. In response to a valid law enforcement request, we currently provide name, billing address, account number, method of payment, and call detail records (e.g., call origination and termination location) for Spectrum Mobile customers. b. Describe the arrangements, agreements, and circumstances in which Spectrum Mobile shares subscriber geolocation data with third parties that are not law enforcement. Spectrum Mobile redirects attorneys in civil litigation, customers requesting their own records, or any other non-law-enforcement third parties to Verizon for any geolocation information requests, due to our limited visibility and access to location information on our MVNO network. Spectrum Mobile does not sell or share customer geolocation information with third parties for any reason, including advertising. 5 | P a g e c. Describe in detail the process by which a subscriber may opt out of the sharing of their geolocation data. Under this opt-out process is that subscriber’s data still shared with third parties? In particular, does the opt-out process allow a subscriber to opt out of the sharing of their geolocation data with all third parties that are not law enforcement? Spectrum Mobile seeks explicit permission from customers to share geolocation information during the device (for Android devices) or My Spectrum App and Spectrum TV App set-up phases; they may opt out or change those settings at any time in their device or App settings. Spectrum Mobile does not sell or share customers’ location information with third parties for any purpose, including advertising. Through the Spectrum Privacy Policy, available online at https://www.spectrum.com/policies/privacy-policy, customers are given instructions for how to change their location sharing settings on their device or through their Spectrum apps at any point. Charter also gives Spectrum Mobile customers the right to opt-out of data sharing, and limits sharing of subscribers’ personal usage information with software service providers involved in providing and engineering our service. Spectrum Mobile does not sell or share customers’ location information with third parties for any purpose, including advertising. d. Are subscribers notified of the sharing of their geolocation information with third parties that are not law enforcement? And if so, how are they notified? Charter notifies customers about geolocation information sharing through its Spectrum Privacy Policy. When customers first use any Spectrum application that collects geolocation information from their mobile device (i.e. the My Spectrum App or Spectrum TV App), Charter requests permission to collect and use that information. Charter also informs customers about how they can change or opt out of their location sharing settings at any time. Charter provides a series of privacy-related disclosures addressing how it collects and uses customers’ personal information, including location information. These disclosures are posted on Charter’s website, available at https://www.spectrum.com/policies/your- privacy-rights. These privacy policies include information about how consumers can exercise meaningful choice with respect to how Charter uses their data. Spectrum Mobile does not sell or share customers’ location information with third parties for any purpose, including advertising. 6 | P a g e 7 | P a g e