As described in the following paragraphs, AT&T shares information within our own AT&T companies and affiliates. We also share with non-AT&T companies.

AT&T affiliates. We share information that identifies you personally with our affiliates, such as DIRECTV and Cricket. When we share this information, they must follow this Privacy Notice regarding your info, not just their own policy. This includes the privacy choices you make with AT&T.

AT&T affiliates and non-AT&T companies for advertising and marketing. We may share information with affiliates and other companies to deliver our ads and marketing or to assess their effectiveness. (Learn more about our ad programs and see your choices.)

Non-AT&T companies providing a service. We use suppliers for services like marketing and mailing bills and to support our products. When we share your information with suppliers, we require them to use it only for the intended purpose and to protect it consistent with this notice.

Non-AT&T companies for identity verification. We share your information to protect you from fraud, authenticate your identity, protect your financial accounts and authorize transactions. When we share with companies like your bank for this purpose, we require them to use it only for the intended purpose and to protect it consistent with this notice. (Learn more and see your choices, including your right to decline this service.)

Non-AT&T companies and non-branded affiliates with your consent.  If we have your opt-in consent, we may share your information consistent with your direction.

Non-AT&T companies or entities where authorized or required by law. This can happen when we:

• Comply with court orders, subpoenas, and lawful discovery requests, and as otherwise authorized or required by law. Like all companies, we must comply with legal requirements. You can learn more in our Transparency Report.
• Detect and prevent fraud.
• Provide or obtain information related to payment for your service.
• Route your calls or other communications, like connecting calls or text messages with other carrier networks.
• Ensure network operations and security, defend against legal claims and enforce our legal rights.
• Notify, respond, or provide information (including location) to an appropriate governmental entity in emergency circumstances such as immediate danger of death or serious physical injury.
• Alert the National Center for Missing and Exploited Children to information concerning child pornography if we become aware through the provision of our services.
• Share the names, addresses and telephone numbers of non-mobile phone customers with phone directory publishers and directory assistance services as required by law. We honor your request for non-published or non-listed numbers.
• Provide name and phone number for wireline and wireless Caller ID and related services like Call Trace.

You can manage how we use and share your information for certain activities including advertising and marketing. Here are key examples:

Sharing or selling my personal information. We may share limited information to create, deliver, and measure advertisements for things you might like. This includes targeted advertising, which may be based on personal data obtained from your interactions with other businesses. We also share information in ways that may be considered a sale of information under some state laws, such as exchanging subscriber lists for marketing.

You can ask us to stop at any time, just:

• Visit att.com/PrivacyChoices or our Choices and Controls page page to control if we can share or sell your personal information. 
• Contact us at (866) 385-3193 if you are a California resident.

We recognize and honor the preference signal associated with a Global Privacy Control.

Access, delete and correct your personal information. You can ask to see what personal information we have about you. You can also ask us to delete or correct it.

• Access and Portability. If you want to see the personal information we’ve collected, you can ask us for it. We will describe the categories of info we collect, the specific pieces we’ve collected, the sources of the information, the purposes for collecting, sharing or selling it and the categories of non-AT&T companies with whom we shared it. You can also ask to “port” your data, which means you get a copy that you can take with you.
• Delete. You can ask us to delete your personal information. In keeping with various state laws, please know that we will still keep data needed for things like running the business, security and fraud protection, compliance with legal obligations and marketing our products and services to our own customers.
  
• Correct. You can ask us to correct inaccurate personal information we have about you. We’ll ask you to provide documentation to support the correction and let you know the result.

To access, delete or correct your information, visit our Choices and Controls page. California residents can also contact us at (866) 385-3193. Helpful details about the process can be found at our Data Request Center, including your option to appeal.

We don’t mind if you make access, deletion or correction requests, or ask us not to sell or share information. These are rights under certain state laws, and we have extended their availability to others across the U.S., regardless of where you live. 

As required by California law, you can review information specifically about California requests from the previous calendar year on our California metrics page. We also follow state requirements within California regarding businesses and those that provide work for us.

Personalized and Personalized Plus

AT&T has two programs that use your personal information to help customize your experience. For instance, you might be shown an online advertisement that is more relevant to your interests, rather than a general ad.

You can choose to participate or not – and it’s never a problem if you change your mind. You are automatically enrolled in the Personalized program, but you can always opt out. You must opt in to join Personalized Plus. Choices for both programs can be made at att.com/PrivacyChoices.

Here is a comparison of the programs:

*If you live in certain states, we won’t collect, use, store or share your sensitive personal information for marketing and advertising unless you join Personalized Plus. This includes information like ethnicity and racial origin. The states are Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia.

If you join the Personalized Plus program, it is an extension of the Personalized program, and you will be enrolled in both. Regardless of your selection to participate in either program, you are always in control of the sharing or selling of your personal information, see the “Your privacy choices and controls” section.  And if you choose not to allow the sharing and selling of your personal information, you will be enrolled only in portions of Personalized Plus that don’t sell or share your information externally.

More choices and controls

Customer Proprietary Network Information (CPNI). CPNI is information related to the telecommunications services you purchase from us, such as which subscription plan you have and details about who you called. Your phone number, name and address are not CPNI. It is your right and our duty under federal law to protect the confidentiality of your CPNI.

You can choose whether we use your CPNI internally for marketing – such as helping to offer you new services and promotions. 

You can opt out at att.com/cpni/optout. You can also call us any time at (800) 315-8303 and follow the prompts. Or you can talk to a service representative at (800) 288-2020 (consumer) or (800) 321-2000 (business).

We don’t share CPNI outside of our AT&T affiliates, agents and suppliers without your consent except for court orders, fraud detection, providing service, network operations and security, aggregate (grouped) information that doesn’t identify you personally and as otherwise authorized by law.

If you choose to restrict our use of CPNI, it won’t affect your services. We keep your choice until you change your mind, which you can do at any time. Keep in mind, even if you restrict use of your CPNI, you may still get marketing from us.

Identity verification. Non-AT&T companies like your bank may receive limited information from us to help protect your accounts from fraud, verify your identity and make sure it’s really you authorizing a transaction. We do not allow these non-AT&T companies to use your information for any purpose except supporting those services. You are generally enrolled through the non-AT&T company, but you can stop at any time through us. Text “STOP” to 8010 to turn off Identity Verification, or text “RESUME” to restart. Or manage your choices at att.com/PrivacyChoices.

Contact preferences. We like to tell you about offers and programs that may interest you. You can manage how we do that. Keep in mind that we still may need to contact you with service and non-marketing messages. Please visit Contact Preferences for more information and links.

We keep your information as long as we need it for business, tax or legal purposes. We set our retention periods based on things like what type of personal information it is, how long it’s needed to operate the business or provide our products and services, and whether it’s subject to contractual or legal obligations. These obligations might be ongoing litigation, mandatory data retention laws or government orders to preserve data for an investigation. After that, we destroy it by making it unreadable or indecipherable.

We work hard to safeguard your information using technology controls and organizational controls. We protect our computer storage and network equipment. We require employees to authenticate themselves to access sensitive data. We limit access to personal information to the people who need access for their jobs. And we require callers and online users to authenticate themselves before we provide account information.

No security measures are perfect. We can’t guarantee that your information will never be disclosed in a manner inconsistent with this notice. If a breach occurs, we’ll notify you as required by law.

Information about you may be shared or transferred if AT&T is part of a merger, acquisition, sale of company assets or transition of service to another provider. Information could also be shared in the unlikely event that our business became insolvent, bankrupt or put into receivership.

We update this Privacy Notice as necessary to reflect business changes and satisfy legal requirements. We post a prominent notice on our websites of any material changes. We give you reasonable notice before any material changes take effect.

We don’t use our business customers’ user information for marketing or advertising, except to market business products and services, including apps and devices. However, we may use our relationship with you to qualify you for certain deals on consumer products and services. You can call the toll-free number on your bill to see whether your current products and services are billed as business or consumer.

We don’t knowingly collect personal information from anyone under 13 without parental notice, and we get parental consent where appropriate. We also won’t contact a child under 13 for marketing purposes without parental consent. However, if we are not aware that a child is using a service or device purchased by an adult, we may collect the information and treat it as the adult’s. (See your privacy choices.)

We don’t have knowledge that we sell the personal information of anyone under 16. If we collect personal information that we know is from anyone under 16, we won’t sell it unless we receive affirmative permission to do so. If a child is under 16 and at least 13, the child may provide the permission.