Can a telecom operator share customer location data with third parties?

A telecommunications operator in Pakistan should not assume it may freely sell or disclose subscribers' identifiable location data to advertisers or unrelated companies. The legal position depends on the operator's licence conditions, telecommunications regulation, customer terms, the data's sensitivity and the proposed recipient and purpose. Disclosure to an authorised public authority under law differs from monetisation for commercial profiling. The absence of a single comprehensive enacted personal data protection statute, if that remains the position at the relevant date, does not eliminate telecom-sector confidentiality and other applicable obligations.

Define location information precisely

Mobile location data can include cell-tower connection history, call detail records, GPS coordinates, device identifiers and inferred travel patterns. Some information is sufficiently precise to reveal homes, workplaces and personal associations. A dataset described as aggregated may still permit re-identification where movements are unique. Operators should map each dataset, its sources and the identities that can be reconstructed before approving any sharing.

Telecom licence obligations

Telecommunications operators function under the Pakistan Telecommunication (Re-organization) Act, 1996 and their licences and relevant regulations. Licence conditions may protect subscriber confidentiality and limit permissible use of records. A company cannot assume a standard consumer contract overrides mandatory regulatory obligations. The current operative licence and PTA rules should be reviewed before entering a commercial data-sharing arrangement.

Customer consent and purpose

A customer may agree to certain service-related processing without agreeing to location-based advertising by an independent marketing firm. A consent provision should identify the data and specific purpose where law or contract requires it. Bundling broad location monetisation into unreadable terms can invite legal and consumer protection concerns. Meaningful choice and accurate disclosures can reduce risk, although consent does not validate processing prohibited by law.

Network operation versus advertising

Cell-location information can be necessary for routing calls, maintaining service and detecting fraud. Commercial marketing is a different purpose. Using data to improve network capacity does not automatically authorise resale to retailers or data brokers. Contractual permissions and legal duties should be assessed separately for operational analytics and external profiling. Access should be limited to employees and processors who genuinely need the data.

Third-party processors

An operator may engage vendors for network optimisation, billing, analytics or cybersecurity. Such contractors should process information only under authorised instructions with confidentiality and security safeguards. Appointment of a vendor does not automatically make the vendor owner of subscriber information. The outsourcing contract should address purpose, onward disclosure, storage, deletion and audit rights. A telecom operator remains responsible for complying with its own licence conditions.

Aggregation and anonymisation

Population-level movement statistics can have legitimate commercial applications. The legal question is whether the data is genuinely de-identified and whether its use is authorised. Removing names alone may leave device movement trajectories identifiable. Re-identification testing, minimum aggregation thresholds and strict limits on released fields can reduce risk. The operator should not guarantee irreversibility without evidence that the technique actually delivers it.

Precise real-time tracking

Sharing an individual's continuous location with a third-party app presents greater privacy and safety concerns than publishing a broad district traffic statistic. The operator should verify lawful authority and the app's purposes. A business should not grant direct database queries to marketers merely because the subscriber downloaded a location-related app. Specific consent, security and applicable legal safeguards require careful examination.

Government requests

Lawful security or investigative authorities may seek specified subscriber information under their statutory powers and procedures. The operator should verify authenticity, scope and any required authorisation. Compliance with such a demand differs from private commercial disclosure. An authority request cannot be expanded voluntarily to unrelated persons. The company should preserve a record of the legal basis and responsive material supplied.

Constitutional privacy considerations

Article 14 of Pakistan's Constitution concerns the dignity of man and privacy of home, within the constitutional framework. Public-authority access and unreasonable surveillance can raise serious questions of law and fundamental rights. A private telecom contract may not by itself settle all constitutional issues, particularly where the state directs or obtains data. Legal challenges should identify the public actor, statutory power and precise intrusion rather than assert a general absolute right against every data processing activity.

The proposed general data law

Pakistan has considered personal data protection legislation for several years. In March 2026, a contemporary legal guide reported that a comprehensive general personal data protection act had not been enacted. The current status should be rechecked before launch. Businesses should not quote draft obligations as binding enacted law, but should consider evolving standards and foreign law where services target overseas residents.

Foreign data transfers

Location analytics may be processed by overseas clouds or advertisers. The operator should examine licence conditions, contractual promises and any other sector restrictions on cross-border transmission. A foreign recipient's technical sophistication does not substitute for lawful authority to disclose. Data handling agreements should provide security, purpose limitations and a way to respond to valid local regulatory inquiries.

Cybersecurity and internal access

Employees able to query live location or subscriber records hold powerful permissions. Apply role-based access, logging, review and disciplinary controls. The company should not give every customer-support employee unrestricted location tracking. An unauthorised internal lookup can create legal and reputational problems even without an external sale. Incident investigation should preserve actual access logs and customer impact.

Customer complaints

A subscriber discovering unexpected location-based marketing should ask the operator what data was used, by whom and under what stated authority. The complaint should identify messages, dates and apparent recipient. PTA complaints or other legal routes may be relevant depending on the duty breached. A consumer should not assume every advertisement proves the telecom operator sold location records; other apps can collect location independently.

Advertiser claims

A marketing firm may promise that its audience segmentation is anonymous and legally sourced. Before buying it, the advertiser should conduct due diligence concerning data origin and consent. An indemnity may allocate contractual loss but does not automatically legalise an unlawful dataset. The brand should avoid commissioning targeting that relies on unverified sensitive movements or covert individual tracking.

A shopping-mall example

A mobile operator proposes selling anonymised footfall statistics to a mall showing how many devices entered a broad area by hour. The legal analysis should examine true aggregation, contractual and licensing permission and whether individual paths can be recovered. The arrangement differs from providing the mall with each subscriber's name, phone number and detailed visit history.

A private-investigator example

A private detective requests live tower-location records for a spouse suspected of infidelity. The operator cannot assume that a private client's payment and interest create a lawful entitlement. Disclosing sensitive records without proper authority can expose both operator and requester to significant legal concerns. A lawful public authority process is materially different from private surveillance demand.

Opinion and recommendation

Telecom location data must be treated as sensitive subscriber information, with separate analysis of operational use, commercial profiling, outsourcing and lawful government requests. Verify licence conditions, minimise identifiability, secure genuine authorisation and retain audit records. A generic privacy-policy clause does not by itself justify unrestricted disclosure to data brokers.

Principal authorities: Pakistan Telecommunication (Re-organization) Act, 1996; applicable PTA licence conditions and customer confidentiality directions; Prevention of Electronic Crimes Act, 2016; Constitution of Pakistan, Article 14; Contract Act, 1872 and applicable sector requirements.