Long-term Mobile Carrier Call Log Retention Exposes User Privacy

Mobile carriers often retain call and text metadata for years, creating significant privacy risks and large targets for cyberattacks. Even without the actual content of a conversation, the metadata surrounding communications can be used to reconstruct an individual’s daily routines, locations, and personal relationships.

This vulnerability was demonstrated by a massive data breach at AT&T in April 2024, which exposed the communication logs of approximately 109 million customers. The compromised data included phone numbers, call and text counts, durations, and location data from periods in 2022 and early 2023. While AT&T stated the records did not contain call content, names, or Social Security numbers, the metadata itself remains highly sensitive.

The Risk of Metadata Exposure

Mobile networks generate two primary types of records that are frequently retained: Session Initiation Protocol (SIP) messages and Call Detail Records (CDRs).

• SIP messages: These manage the start and end of calls and texts, primarily used for network troubleshooting.
• CDRs: These summarise each session, documenting the participants, duration, and the specific cell site used.

Access to these logs allows for the granular mapping of a user’s life. For instance, patterns in call duration and frequency can reveal medical visits, professional associations, or private social circles. Furthermore, metadata can often be correlated with publicly available information to de-anonymise users.

Data Retention Practices

While many carriers do not explicitly state their retention windows, privacy policies often allow data to be kept for as long as necessary to fulfil service purposes. In 2022, carriers informed the Federal Communications Commission (FCC) that they maintain geolocation data for up to five years, a period far exceeding standard service requirements.

Data retention serves several operational and commercial purposes, including billing, roaming settlement, and network troubleshooting. However, there is also a significant commercial incentive to retain behavioural profiles for use by data brokers and advertising networks.

Growing Threat Landscape

The concentration of long-term logs makes telecommunications providers prime targets for sophisticated actors. The AT&T incident was linked to credential-based thefts affecting Snowflake customers, similar to breaches seen at Ticketmaster and Neiman Marcus. Additionally, the China-linked campaign known as Salt Typhoon has reportedly compromised multiple major US carriers, potentially placing the metadata of millions of citizens at risk.

For high-risk users, such as journalists or legal professionals, the longevity of these records is a critical component of their personal threat model. Data minimisation, the practice of deleting records shortly after they are no longer required for billing, remains one of the most effective ways to reduce the impact of a potential breach.