Telecom Media Networks: what T-Mobile, Verizon and European carriers can and cannot do with subscriber data

US law treats carrier data in three groups. The privacy notices of T-Mobile and Verizon follow the same split, which makes the rules easy to see in practice.

Two details matter. T-Mobile's opt-in "Personalized Ads and Offers" program uses precise location and broadband domains and "may include" CPNI (T-Mobile privacy notice, last updated 26 June 2026). Verizon's opt-out Custom Experience uses only the first part of each web address, up to the first "/" (Verizon privacy policy, updated October 2026). Both carriers draw the line where the law draws it.

T-Mobile Advertising Solutions, known as T-Ads, sells four things. It sells in-store screens, programmatic out-of-home through Vistar, omnichannel buying through Blis, and audience segments built on T-Mobile data.

In-store retail media. The network covers 35,000 screens across more than 10,000 T-Mobile and Metro stores. In January 2026 T-Ads began testing 3D hologram displays with Samsung in stores in New York, Seattle and other markets (T-Mobile, 12 January 2026). With Vistar it also sells the hardware, software and ad sales a retailer needs to run its own store network. The format is explained in In-store retail media.

Out-of-home and omnichannel. At the time of the deal Vistar ran a marketplace across more than 1.1 million digital screens from nearly 370 media owners, serving more than 3,000 advertisers (T-Mobile, 13 January 2025). Blis adds location-based and cookieless buying across screens. The DOOH platforms are compared in Programmatic DOOH platforms.

Audience segments. Since May 2025, T-Mobile segments built on "app ownership and app engagement" can be bought in Vistar's self-serve DSP, with Blis access announced as coming. T-Ads also sells "near-store" out-of-home within a one-mile radius of its stores, and claims a Google campaign drove a 52% sales lift for Android devices (company claim) (T-Mobile, 6 May 2025).

The data in those segments is the opt-out tier, not CPNI. That is the design choice that lets T-Ads scale: app signals reach most customers, while CPNI-based targeting reaches only those who opt in. The profile T-Mobile Advertising Solutions tracks formats and buying routes.

Verizon sold its media business, Verizon Media, to Apollo in 2021, and it became Yahoo (ATDb). Verizon has not announced a branded media network. A 2026 job listing for a "Senior Director, Advertising and Data Monetization" suggests it is building one (Built In NYC, 2026).

Verizon already runs ad programs, and its privacy policy describes them. "Relevant Online Advertising" targets Fios and Frontier internet customers on other websites, and "Relevant TV Advertising" targets Fios TV viewers (Verizon privacy policy, updated October 2026). Both use Verizon service data plus demographic and interest data from other companies, and customers can opt out. The Custom Experience programs personalise Verizon's own marketing, which "may include ads for Verizon services or third-party products and services sold by Verizon". The planned profile Verizon media network will track any launch.

The statute. A carrier that obtains CPNI by providing a telecommunications service may use or disclose individually identifiable CPNI only in limited cases. It may do so to provide that service or services needed for it, with the customer's approval, or as the law requires (47 U.S.C. 222(c)(1)). CPNI covers the quantity, configuration, type, destination, location and amount of use of a telecom service, plus phone bill information (222(h)(1)). Location from a mobile call needs the customer's "express prior authorization" (222(f)). Aggregate data with identities removed is outside these limits (222(c)(3)).

The FCC rules. Opt-out approval is enough to use CPNI for marketing communications-related services to the customer. For other uses, a carrier needs opt-in approval, and it must keep approval records for at least one year (47 CFR 64.2007). Third-party advertising based on CPNI falls in the opt-in group.

Enforcement. The FCC's 2024 orders concern location data sold through aggregators, not ads, but they show how the rule is read. T-Mobile, for example, sold access to customer location through two aggregators, LocationSmart and Zumigo, until 8 February 2019; the FCC held that this location data "is CPNI" (FCC 24-43).

The carriers challenged the orders in federal appeals courts. We could not confirm the outcome of each appeal by the date of this update, so this page reports the orders only.

Broadband sits outside. Congress repealed the FCC's 2016 broadband privacy rules in April 2017 (Public Law 115-22). In January 2025 the Sixth Circuit held that broadband providers offer an information service and set aside the FCC's 2024 reclassification (Ohio Telecom Ass'n v. FCC, 2 January 2025). In practice, browsing data is governed by state law. Verizon's policy cites the Maine Broadband Internet Access Service Customer Privacy Act, effective 1 July 2020 (Verizon). T-Mobile says it will not use Maine broadband customer data without permission.

The rules. The ePrivacy Directive is stricter than US law for network data.

Traffic data may be used for marketing a carrier's own electronic communications services, or to provide value-added services, only with the subscriber's prior consent, which can be withdrawn (Directive 2002/58/EC, Art. 6(3)). Location data other than traffic data may be processed only if anonymised or with consent for a value-added service (Art. 9). Reading or storing data on a device needs consent unless strictly necessary (Art. 5(3)).

The UK copies Articles 6 and 9 in PECR regulations 7 and 14. GDPR applies on top. The cookie rules are covered in GDPR, ePrivacy and the TCF.

The pending change. The EU's Digital Omnibus proposal of November 2025 is still being negotiated. The Council's text moved the cookie rules back into ePrivacy Article 5(3), and there was no adopted text on 9 November 2026 (Taylor Wessing, 2026). Progress is tracked in the EU Digital Omnibus tracker.

Utiq. Deutsche Telekom, Orange, Telefónica and Vodafone set up Utiq in March 2023 to sell identity, not ads. Utiq activates only if two conditions hold. The visitor consents on a participating website, and they use a connection from a participating operator (utiq.com, accessed 9 November 2026).

Brands and publishers receive a randomised "consentpass" signal with no directly identifiable data, and users withdraw consent in one click through "consenthub". Utiq says it does not access telco data, track or profile users (company statement). It reached 70 million users across six markets in November 2025 and partnered with The Trade Desk in June 2026 (PPC Land, 18 November 2025; Utiq, 1 June 2026).

The table states what the rule text says for each use. It is a map, not advice; facts such as the data source and the notice wording change the answer.

Carrier media has no purchase ledger of its own outside phones and plans. In-store screens can be tied to device sales in the carrier's stores, which is the basis for T-Ads' Android lift claim. Out-of-home and omnichannel campaigns rely on location panels, exposure matching and partner data, with results reported by the platform. For brands that want sales proof outside telecom, the answer is a clean room with a retailer or bank partner.

1. T-Mobile, "T-Mobile Enhances Marketing Capabilities and Expands Advertising Solutions with Close of Vistar Media and Announcement of Blis Acquisitions" (5 March 2025). https://www.t-mobile.com/news/business/t-mobile-advertising-acquires-blis-and-closes-vistar-media
2. T-Mobile, agreement to acquire Vistar Media (13 January 2025). https://www.t-mobile.com/news/business/t-mobile-to-acquire-vistarmedia-dooh-advertising
3. T-Mobile, "T-Mobile Advertising Solutions Unveils New Capabilities on the Heels of Vistar and Blis Acquisitions" (6 May 2025). https://www.t-mobile.com/news/business/t-mobile-advertising-solutions-unveils-new-capabilities
4. T-Mobile, "T-Mobile Advertising Solutions and Samsung Partner to Explore Next-Generation In-Store Retail Media Innovation" (12 January 2026). https://www.t-mobile.com/news/business/t-mobile-advertising-solutions-and-samsung-partner-on-next-gen-in-store-retail-media
5. T-Mobile, Privacy Notice (last updated 26 June 2026). https://www.t-mobile.com/privacy-center/our-practices/privacy-policy
6. Verizon, Privacy Policy (updated October 2026). https://www.verizon.com/about/privacy/full-privacy-policy
7. ATDb, Verizon profile (Verizon Media sale, 2021). https://www.theatdb.com/companies/verizon
8. Built In NYC, Verizon "Senior Director, Advertising and Data Monetization" (2026). https://www.builtinnyc.com/job/senior-director-advertising-and-data-monetization/10445972
9. Cornell LII, 47 U.S.C. § 222 (current). https://www.law.cornell.edu/uscode/text/47/222
10. Cornell LII, 47 CFR § 64.2007 (current). https://www.law.cornell.edu/cfr/text/47/64.2007