Mobile Carriers May Retain Call Logs for Years, Posing Privacy Risks

Summary

A sponsored article explains how retained call metadata can expose relationships and routines, citing AT&T’s 2024 breach. Cape says it deletes different log types within 1–60 days; a Trail of Bits audit found no evidence that two stated retention claims were violated.

Key points

The article says AT&T’s 2024 breach exposed communication logs for 109 million customers, including phone numbers, call and text counts, durations, and location data from 2022–2023.
Call logs can reveal relationships, routines, and locations even without call content or customer names; the article cites Malte Spitz’s reconstruction of his activities from roughly 35,000 records.
The article says carriers’ retention periods are often unclear and cites carrier disclosures that geolocation data was kept for as long as five years.
Cape says its Disappearing Call Logs feature retains SIP messages for 14 days, internal CDRs for one day, billing CDRs for 30 days, and daily totals for up to 60 days.
Cape says it runs its own mobile core and rotates identifiers seen by tower operators, which it says weakens their ability to associate logs with subscribers.
Cape hired Trail of Bits to audit the feature in May and July 2026. The article says the audit found no evidence that CDR deletion or limits on retaining individual customer data violated the two stated claims.

Article Details

Event Type: Telecommunications data breach and call-log retention audit
Impact: In April 2024, AT&T suffered a breach affecting 109 million people, exposing communication logs containing phone numbers, call and text counts, call durations, and location data from May–October 2022 and January 2023. AT&T said the records did not contain call content, customer names, or Social Security numbers. The article notes that retained call metadata can reveal relationships, locations, and routines. Cape says it deletes different record types after periods ranging from one to 60 days; Trail of Bits reported finding no evidence that Cape violated the two retention claims it audited.