AT&T tied with Vodafone as the top-ranked telecommunications company of the 2017 Index. A member of the Telecommunications Industry Dialogue (TID), AT&T made notable improvements in 2016, including conducting a human rights impact assessment of its operations in Mexico, and clarifying of its process for handling private requests for content and account restrictions and user information. Notably, AT&T made strong commitments to freedom of expression and privacy as human rights at the corporate level. However, it had weaker disclosure of actual policies that affect users’ freedom of expression and privacy in practice—as demonstrated by its higher scores in the Governance category compared to its performance in other Index categories. Nonetheless, AT&T disclosed more about its policies and practices that affect users’ freedom of expression and privacy than all other telecommunications companies evaluated, apart from Vodafone. However, new information about Hemisphere, a warrantless surveillance tool created by AT&T and marketed to U.S. law enforcement, raises questions about the company’s commitment to users’ privacy in practice.
AT&T, Inc. provides telecommunications services in the United States and internationally. In 2015, the company expanded its operations to Mexico, after purchasing two Mexican telecommunications companies. The company offers data and voice services to approximately 144 million wireless subscribers in the US and Mexico.
AT&T received the third-highest score in the Governance category among telecommunications companies, behind Vodafone and Orange, and the fifth-highest score of all 22 companies evaluated.
AT&T publicly committed to respect human rights, including freedom of expression and privacy (G1), and provided evidence of senior-level oversight over these issues (G2). AT&T also disclosed it conducted a human rights impact assessment (HRIA) after expanding into Mexico. However, since the HRIA was conducted after AT&T had already entered the market, it received partial credit (G4). AT&T had the fourth-highest score among telecommunications companies on disclosure of grievance and remedy mechanisms (G6). It did not disclose a company-wide grievance mechanism that includes freedom of expression concerns, and aside from its policies on responding to copyright counter-notices, did not reveal its process for responding to freedom of expression or privacy complaints.
AT&T was the second-best scoring telecommunications company in the Freedom of Expression category, behind Vodafone.
Content removal and account restriction requests: AT&T was one of only four telecommunications companies to receive any credit for disclosing its handling of government and private requests to restrict content or accounts (F5-F7). Notably, AT&T was one of two telecommunications companies to receive any credit for publishing data on government requests to restrict content or user accounts (F6). The company improved its disclosures since 2015 by clarifying it does not entertain private requests.
Network management and shutdowns: AT&T disclosed less information than Vodafone on its policies related to network management and shutdowns, but more than most telecommunications companies evaluated. While the company revealed reasons it may engage in network management practices, it did not clearly indicate it will not engage in content blocking/prioritization practices (F9). AT&T provided minimal disclosure on its policies related to network shutdowns (F10). It is unclear whether there are any legal factors prohibiting AT&T from disclosing more about its network shutdown policies, as the U.S. government’s policy on network shutdowns is secret.
Identity policy: AT&T did not disclose that it requires prepaid mobile service users to verify their identity with a government issued ID, making it one of only two telecommunications companies evaluated to receive full credit on this indicator (F11).
AT&T was the highest-scoring telecommunications company in the Privacy category.
Handling of user information: AT&T disclosed more than all other telecommunications companies apart from Vodafone about how it handles user information (P3-P8). Still, it did not fully disclose what types of user information it collects (P3), shares (P4), and why (P5). The company revealed even less information about how long it retains this information (P6), although it was the only telecommunications company to score any points on this indicator. AT&T had a similar level of disclosure as Vodafone on how users can control what information about them is collected and shared (P7) but lagged behind Vodafone on disclosure of users’ ability to obtain all of the information a company holds on them (P8).
Requests for user information: AT&T received the highest score of all telecommunications companies for its disclosure of its process for responding to and complying with government and private requests for user information (P10, P11). AT&T did not indicate whether it notifies users about requests for their information (P12).
Security: AT&T disclosed more than all telecommunications companies about its security policies and was the only one of its peers to receive full credit for disclosure about its internal processes for ensuring that user data is secure (P13). AT&T was also one of only three companies in the entire Index to reveal any information about how it handles data breaches, although its disclosure still fell short (P15).
