Jump to content

Verizon demo phone MDM data wipe: Difference between revisions

From Consumer Rights Wiki
← Older editNewer edit →
VisualWikitext
No edit summary
Tags: Reverted Mobile edit Mobile web edit
No edit summary
Tags: Reverted Mobile edit Mobile web edit
Line 1: Line 1:
everyone is overreacting to this
everyone is overreacting to this
==Remote factory reset & data loss==
The demo unit did not fix Collery's network problems, but it worked at first. He transferred his data to it & returned his original phone.<ref name="ars" /> After about ten days the phone began repeatedly installing security updates & restarting, & within a few more days it restarted as though it had been factory reset.<ref name="ars" /> Collery could no longer sign in to his Google or Samsung accounts; the device told him he did not have permission & to contact his IT administrator.<ref name="ars" />
His cloud backups turned out to be less complete than he had assumed, so the wipe was not recoverable. In a phone interview he described what was gone:
<blockquote>''I lost everything. Contacts, messages, videos, documents, pictures, everything from patient information to the last video I have with my grandmother before she died.''</blockquote><ref name="ars" />
Cooper Quintin, a security researcher & senior technologist at the Electronic Frontier Foundation, told Ars Technica that the restarts & reset were consistent with Verizon pushing instructions to a group of managed devices at once. He said that with a fleet of demo phones under MDM, ''you're just sending instructions to all the phones,'' & that if Verizon wipes demo units on a schedule, the timing may have been the policy taking effect.<ref name="ars" /> Verizon advised Collery to take the phone to a uBreakiFix store, but a technician there could not recover any data because of the management profile.<ref name="ars" />


==Verizon's response==
==Verizon's response==

Revision as of 01:57, 15 June 2026

everyone is overreacting to this

Verizon's response

Letter to the FCC

After Collery complained to the FCC, Verizon's executive relations department sent the agency a letter dated April 2, 2026, which he shared with Ars Technica. The letter acknowledged the mistake:

We acknowledge the seriousness of the error that led to Mr. Collery receiving a device subsequently identified as a 'demo phone,' which was found to have a Mobile Device Management (MDM) registration linked to Verizon. This procedural lapse has been formally submitted for internal investigation.

[1]

A Verizon supervisor had earlier assured Collery that refurbished phones are like new & pass a 150-point inspection.[1] In the same letter Verizon defended its supply chain to the FCC:

The Executive Office has advised that all Certified devices originate directly from the manufacturer and are designed to meet stringent quality assurance standards.

[1] The letter said Collery had received compensation exceeding $400 before he filed the complaint, that no further credits would be issued, & that the executive office considers this case as resolved.[1] Verizon's only statement to Ars Technica, in the seven weeks after it was contacted, was that it was aware of this customer's concern & working to address it.[1] The carrier did not say who handles its phone refurbishment or how the management profile survived its inspection process.[1]

Refusal to disclose MDM records

Collery asked Verizon for records of what personal information the MDM software had recorded & what commands had been sent to the device. A Verizon executive-relations representative answered by email on May 12, 2026:

I received word back from the Legal team. In order to provide any details about the MDM, we would require a legal order.

[1]

Collery replied on May 13 that the California Consumer Privacy Act requires a business to disclose the personal information it collects about a consumer when the consumer asks for it, & he warned that California's invasion-of-privacy statute provides for damages of $5,000 per violation.[1] The CCPA gives a consumer the right to request that a business disclose the categories of personal information it collected, the sources & purposes, the categories of third parties that received it, & [t]he specific pieces of personal information it has collected about that consumer.[2][3] California Penal Code section 637.2 lets a person injured by a violation of the state's invasion-of-privacy law recover the greater of $5,000 per violation or three times actual damages.[4]

  • California Civil Code section 1798.110 gives a consumer the right to obtain the specific pieces of personal information a business has collected about them.
    California Civil Code section 1798.110 gives a consumer the right to obtain the specific pieces of personal information a business has collected about them.
  • California Penal Code section 637.2 lets a person injured by an invasion-of-privacy violation recover the greater of $5,000 per violation or three times actual damages.
    California Penal Code section 637.2 lets a person injured by an invasion-of-privacy violation recover the greater of $5,000 per violation or three times actual damages.

Consumer response

Verizon offered to waive Collery's remaining device payments to end the dispute, & a representative asked whether that would be enough for him to walk away.[1] He declined. He sent Verizon a formal request for his data under the CCPA, submitted a notice of dispute as a prerequisite to arbitration, & said he was weighing a small-claims case, telling Verizon it was hard to negotiate while the company refused to confirm what information had left his device or who ordered it deleted.[1] The network problems that started the dispute were never fixed. My service is still abysmal, Collery said. I can't even get a GPS signal in front of my building.[1]

See also

References

  1. ↑ 1.00 1.01 1.02 1.03 1.04 1.05 1.06 1.07 1.08 1.09 1.10 Cite error: Invalid <ref> tag; no text was provided for refs named ars
  2. ↑ "California Civil Code section 1798.110". California Legislative Information. Retrieved 2026-06-13.
  3. ↑ "California Consumer Privacy Act (CCPA)". California Office of the Attorney General. 2024-03-13. Retrieved 2026-06-13.
  4. ↑ "California Penal Code section 637.2". California Legislative Information. Retrieved 2026-06-13.
Retrieved from "https://consumerrights.wiki/index.php?title=Verizon_demo_phone_MDM_data_wipe&oldid=57925"