CONFIDENTIAL – EXEMPT FROM DISCLOSURE August 3, 2022 VIA EMAIL Jessica Rosenworcel Chairwoman Federal Communications Commission 45 L Street N.E. Washington, D.C. 20554 RE: Ultra Mobile and Mint Mobile – Policies regarding Geolocation Data Dear Chairwoman Rosenworcel: On behalf of UVNV, Inc. d/b/a Ultra Mobile (“Ultra Mobile”) and Mint Mobile, LLC (“Mint Mobile,” and together with Ultra Mobile, the “Companies”), we write in response to your July 19, 2022, letter requesting information about Ultra Mobile and Mint Mobile’s consumer data retention policies for geolocation data and their policies regarding sharing of that data with third parties. We appreciate the opportunity to address these important consumer safety and privacy issues with the Commission. Ultra Mobile and Mint Mobile are mobile virtual network operators (“MVNOs”) that operate on the T-Mobile USA network. The Companies provide customers with affordable, high quality wireless service. As noted in Ultra Mobile and Mint Mobile’s Privacy Policy: Location-Based Services - We use location information to route wireless communications and to provide 911 service, which allows emergency services to locate your general location. We may disclose, without your consent, the approximate location of a wireless device to a governmental entity or law enforcement authority when we are served with lawful process or reasonably believe there is an emergency involving risk of death or serious physical harm. Depending on your device, you may also be able to obtain a wide array of services based on the location of your device (for example, driving directions, enhanced 411 Directory Assistance or search results, etc.). These data services, known as Location-Based Services (“LBS”) are made available by us and other entities, usually via applications. These services use various location technologies and acquire location data from various sources. These applications and services use various location technologies (including Global Positioning Satellite (“GPS”), Assisted GPS (“AGPS”), cell ID and enhanced cell ID technologies) to identify the approximate location of a device, which is then used in conjunction with the application to enhance the user’s experience (for example, to provide driving directions, to provide enhanced 411 Directory Assistance or search results, etc.). LBS may, or may not, involve any interaction with or dependency on our supplier’s network, and location-based services may or may not look to our network to obtain location data. Where our network supplier allows third parties the capability of accessing data about your location that is derived from our supplier’s network, our network supplier requires those third parties to PAGE 2 observe specific privacy and security protections consistent with this policy. It is important that you understand the location capabilities and settings of your device, and that you carefully read and understand the terms under which these services are provided – whether by us or another entity. You should carefully review the privacy policies and other terms of third parties with whom you have authorized the sharing of your location information, and you should consider the risks involved in disclosing your location information to other people. Where we provide a location-based service, you will receive notice of the location features of the service and collection of location data is with your consent. You will be provided options for managing when and how such information should be shared. Within the wireless telecommunications ecosystem, there are several consumer-facing main players, including hardware and device manufacturers (e.g. Apple iPhone), network operators and service providers (e.g. T-Mobile, Mint Mobile, Verizon, etc.), and third-party app publishers/providers (e.g. Instagram, TikTok, etc.). Each have their own, independent data collection, retention and sharing policies and practices. The scope of the Companies’ responses below is limited to Ultra Mobile’s and Mint Mobile’s own practices regarding data collection, retention and sharing. The following are the Companies’ response to your specific inquiries about data retention and sharing of geolocation data: Data retention a. Please describe in detail the geolocation data that Ultra Mobile and Mint Mobile collect and/or retain regarding current and/or former subscribers. How is that data collected? The Companies have only one touchpoint that collects minimal geolocation data: the account management apps (which provide account-related information and features only). During the account activation process, to determine network availability and quality around the consumer’s location, we provide the option of either (i) manually entering address and zip code, or (ii) after opting in and consenting, allowing us to use GPS to understand geolocation. After receiving consent on the GPS option, only basic longitude and latitude data are collected for the purposes of identifying network availability and phone number procurement during the initial activation process. This data is transferred as part of the payload package when the subscriber interacts with our account management systems. The data is captured in secure logs and is stored in raw format in a data lake, without transformation or persistence in tables accessible via the data warehouse. b. Please explain the reasons geolocation data is retained for both current and former subscribers. The minimal longitude/latitude data is collected and retained for the purposes of (i) determining network availability and quality around the consumer’s location, (ii) phone number procurement and assignment, and (iii) to assist in troubleshooting if a subscriber using the account management app encounters an issue. Because the data has not been formatted or extracted into a usable format, it is currently fulfilling no other use cases. PAGE 3 c. How long is geolocation data retained for both current and former subscribers. We retain geolocation data for 18 months, across both existing and former subscribers. d. Please provide a description of what safeguards Ultra Mobile and Mint Mobile use to protect current and former subscriber geolocation data. The geolocation data is stored encrypted at rest with access managed through a secure virtual private network. e. In what country (or countries) is geolocation data stored? United States. f. Please share whether and how you disclose your data retention policies to subscribers. We are as transparent as possible in our collection and use of certain data. Our privacy policies are located at https://www.mintmobile.com/privacy-policy/ and https://www.ultramobile.com/privacy-policy/ . g. What is your data deletion policy for current or former subscribers, and how do you dispose of subscriber geolocation data? In accordance with FCC rules, we recently extended our retention policy for curated (addressable) data to six (6) years for all subscribers. For critical data, such as the log files that contain geolocation data, we retain for 18 months. After these periods are up, we permanently discard all data. h. Do your subscribers have any opportunity to opt-out of your data retention policies and if not, why not? As part of our continuous efforts to provide consumers options around their own data management, we offer several touchpoints for consumers to manage what we do with their data. Consumers can call (888) 777-0446 or go through our online process. Both options allow for delivery of copies of consumer data or complete deletion of all data records. Data sharing a. Please provide Ultra Mobile and Mint Mobile’s process and policies for sharing subscriber geolocation data with law enforcement? Law enforcement requests come in the form of requests for Call Detail Records. There is a process in place for management of the requests to ensure they are authentic. The Call Detail Records are network operator generated and do not have precise geolocation data but do have the network operator’s tower identifiers and relative signal strength to those towers. Our network provider does NOT disclose tower location information to us. Our assumption is that law enforcement has the ability to triangulate subscriber location via the combination of information we provide and the information they receive from the network operator. PAGE 4 b. Describe the arrangements, agreements, and circumstances in which Ultra Mobile and Mint Mobile share subscriber geolocation data with third parties that are not law enforcement. None. The enhanced 911 process provides subscriber geolocation from the cell phone in the event of a 911 call, but it is not controlled by Ultra or Mint Mobile. Neither Ultra nor Mint Mobile provide geolocation data to any third parties. c. Describe in detail the process by which a subscriber may opt out of the sharing of their geolocation data. Under this opt-out process is that subscriber’s data still shared with third parties? In particular, does the opt-out process allow a subscriber to opt out of the sharing of their geolocation data with all third parties that are not law enforcement? Ultra Mobile and Mint Mobile do not share geolocation data with third parties. Subscribers cannot opt out of enhanced 911 sharing to emergency services and it is not controlled by Ultra or Mint Mobile. d. Are subscribers notified of the sharing of their geolocation information with third parties that are not law enforcement? And if so, how are they notified? Ultra Mobile and Mint Mobile do not share geolocation data with third parties. The Companies request that these responses be kept confidential to the full extent provided by all applicable laws and regulations, including protection from disclosure pursuant to the Freedom of Information Act. As the Commission appreciates, disclosure of such confidential information concerning the Companies’ practices for the protection of consumer geolocation data and other sensitive information could compromise security and cause injury to the Companies. Should any disclosure outside the Commission be contemplated, the Companies request sufficient advance notice to address the same. Ultra Mobile and Mint Mobile are grateful for the opportunity to address their policies and procedures relating to retention and sharing of geolocation data with the Commission, and the Companies would welcome Commission suggestions for enhancing best practices. Sincerely, /s/ Linda G. McReynolds