AT&T, Inc. 50%

OVERALL – 50%

Among telecommunications companies in this Index, AT&T ranked second only to Vodafone. Like Vodafone and Orange, AT&T is a member of the Telecommunications Industry Dialogue and has made explicit human rights commitments on freedom of expression and privacy. While its commitments and disclosures contain significant gaps – the company’s total score came out at 50 percent – it nonetheless discloses more about its policies and practices that affect users’ freedom of expression and privacy than most other telecommunications companies assessed in the Index.

COMMITMENT – 57%

AT&T came in third place among telecommunications companies, behind Vodafone and Orange, in the Commitment category. In general, the company’s commitments are stronger on privacy than on freedom of expression. AT&T did not receive a full score on any indicator in this category, highlighting areas of improvement.

Impact assessment: AT&T received few points on indicator C4, which focused on impact assessment. AT&T’s report to the Industry Dialogue explains why the company does not carry out impact assessments, stating, “Outside of the United States, AT&T primarily serves large enterprise customers, rather than the retail, consumer market. Consequently, the potential impact on users’ privacy or freedom of expression that might be associated with use of our international enterprise services is quite low.”

Ranking Digital Rights takes the position that companies headquartered in the U.S. do, in fact, face risks that affect the freedom of expression and privacy of U.S.-based users. Therefore it is reasonable to expect companies to assess potential risks to freedom of expression and privacy associated with their business. Also, as the company notes in its most recent transparency report, in the past year AT&T expanded its business into Mexico where freedom of expression and privacy risks to Internet users are well documented.

Balance of commitments: In comments submitted to our researchers, AT&T objected to the fact that it lost credit in this category because it lacks disclosure about commitments and practices related to users’ freedom of expression. A company representative stated that, until recently, AT&T provided consumer services only within the United States where, due to strong constitutional free speech protections under the First Amendment, explicit references to a company’s commitments to freedom of expression are not necessary or meaningful for users.

However, the U.S. constitution’s First Amendment applies only to government conduct. It does not explicitly provide protection for issues that arise related to third-party requests made to companies. Provisions of U.S. law do limit companies’ liability for the actions of users, thus enabling them to protect the free expression of their users without fear of retribution or legal action by the government or third parties (e.g., copyright holders). However, neither the law nor the constitution guarantees that a company will consider the impact of its business operations on users’ freedom of expression. It is therefore reasonable to expect companies to proactively make and demonstrate commitments to respect the freedom of expression of all users – including those residing in the United States.

FREEDOM OF EXPRESSION – 42%

Despite the company’s concerns about being judged on freedom of expression, AT&T was second only to Vodafone among telecommunications companies in the Freedom of Expression category.

Transparency about requests for content restriction and enforcement of terms of service: AT&T was the only telecommunications company that received any points for disclosing any data about government requests for content restriction (F7). However the company lost points on several indicators because it does not clearly disclose to users whether or how it enforces its own terms of service and how it responds to private requests, which can include content removal requests from copyright owners. For example, along with other major ISPs, AT&T is a member of the Center for Copyright Information. The CCI website includes information about steps members may take in response to alerts received from copyright owners, including slowing Internet connection speeds and temporarily redirecting users to a landing page. AT&T also publishes a website containing information about CCI participation. However it does not publish data or other information about whether and to what extent it receives or responds to private requests for reasons other than copyright.

Network management: On Indicator F10, which examines network management practices, AT&T received partial credit for disclosing that it prioritizes or degrades content delivery, along with the purpose for doing so. Companies could only receive full credit on this indicator if they disclosed that they do not engage in such practices.

PRIVACY – 52%

AT&T disclosed more about its policies and practices that affect users’ privacy than any other telecommunications company in the Index. It earned leading scores on nine of the 12 privacy-related indicators on which telecommunications companies were evaluated. Nonetheless, its overall score was only a little more than half of the total possible points. Note that because the Index methodology focuses on companies’ own disclosures about their practices, AT&T’s score on privacy-related indicators was not directly affected by media reports based on revelations by the former intelligence contractor Edward Snowden and earlier whistleblower reports about AT&T’s compliance with warrantless NSA surveillance

Handling of user information: AT&T tied with Vodafone in the lead among telecommunications companies on disclosures about the collection of user information (P3), but in the Index overall it trailed 20 percentage points behind Kakao, the leading Internet company. It led the telecommunications cohort on disclosures about the sharing of user information with third parties (P4), albeit with a lackluster score of 48 percent. Its score on user control over information collection and sharing (P5) was 25 percent, tied in a very low lead with América Móvil and Vodafone plus three Internet companies. AT&T lagged behind Vodafone by a wide margin on providing users with access to their own information (P6).

On disclosures about retention of user information (P7), AT&T and five other telecommunications companies failed to receive any credit. In 2013 AT&T submitted a letter to U.S. Senator Edward J. Markey in response to a list of questions about data retention policies and law enforcement requests received. It contained details that were not disclosed anywhere on the company’s own website or in documents directed toward users. Making such information more easily available to users would improve the company’s performance on several of the privacy indicators.

Transparency about requests for user data: AT&T’s overall privacy score was boosted by the fact that it is the only telecommunications company in the Index that publishes a transparency report that includes data on the number of government requests for user data (P11). Nevertheless, the company only received 60 percent of the total possible points on this indicator. In part, this was because its transparency report lacked sufficient detail about national security requests. In company feedback, a representative objected to being penalized “for complying with clear and recently reiterated U.S. laws.” However as previously noted, the Index methodology does not compensate for situations where laws prevent a company from achieving a full score on any given indicator.

On indicators P9, P10, and P11, which examine company disclosures related to third-party requests, AT&T lost points due to a lack of information about whether and how the company receives or responds to private requests for user information. A company representative stated to researchers, “Except in emergency circumstances, we do not provide content of communications or stored data absent proper judicial or government process.” However, there was no evidence that the company publicly discloses this policy in a way that users can see it. In accordance with the Index methodology, we were unable to credit the company for such a policy.

Security: Like Vodafone, AT&T received full marks on the Index’s two security indicators (P12 and P14).