The Right to Be Forgotten in The Context of Mobile Number Recycling

Abstract: Mobile phone number recycling, the process of reassigning deactivated numbers to new users after a designated period, is a necessary practice for managing the limited pool of available numbers in the face of growing demand. While efficient for mobile network operators, this process can leave residual links between the recycled number and its previous owner’s digital footprint. These leftover risks can lead to the new owner receiving calls, messages, or notifications intended for the former owner of such mobile numbers, creating issues relating to privacy and security, such as identity theft and fraud. The aim of this work is to review security and regulatory provisions relating to mobile phone recycling, identifying gaps and proffering solutions to further protect privacy in this aspect.

Mobile number recycling, privacy, information security

1. European Parliament. (2016). Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union. (EUR-Lex) [Google Scholar] [Crossref]

2. Federal Communications Commission. (2021). Reassigned Numbers Database. (fcc.gov) [Google Scholar] [Crossref]

3. Lee, K., & Narayanan, A. (2021). Security and privacy risks of number recycling at mobile carriers. Proceedings on Privacy Enhancing Technologies, 2021(4), 108–128. (Author preprint). (recyclednumbers.cs.princeton.edu, Princeton University) [Google Scholar] [Crossref]

4. Manatt, Phelps & Phillips, LLP. (2021, December 16). Reassigned Number Database up and running. (Notes TCPA "safe harbor" linked to RND queries). (manatt.com) [Google Scholar] [Crossref]

5. NANPA. (2019). p-ANI Activity and Projected Exhaust Report (and related exhaustion projections). (nanpa.com) [Google Scholar] [Crossref]

6. Nigerian Communications Commission. (2019). Numbering Plan Regulations. (Dormancy / quarantine requirements before reassignment). (Vanguard News) [Google Scholar] [Crossref]

7. Ofcom. (2021). Mobile number recycling (FOI response) — indicates typical UK dormancy windows (often ~3 months to a year) and operator discretion. (www.ofcom.org.uk) [Google Scholar] [Crossref]

8. EUR-Lex. (2002). Directive 2002/58/EC (ePrivacy Directive). (EUR-Lex) [Google Scholar] [Crossref]

9. Hussain, S. R., Chowdhury, O., Mehnaz, S., & Bertino, E. (2019). Privacy attacks to the 4G and 5G cellular paging protocols using side-channel information (ToRPEDO). NDSS. (NDSS Symposium, syed-rafiul-hussain.github.io) [Google Scholar] [Crossref]

10. Singla, A., Hussain, S. R., Chowdhury, O., Bertino, E., & Li, N. (2020). Protecting the 4G and 5G cellular paging protocols against security and privacy attacks. Proceedings on Privacy Enhancing Technologies, 2020(1), 126–142. (Pet Symposium) [Google Scholar] [Crossref]

11. NIST. (2020). SP 800-63B: Digital Identity Guidelines — Authentication and Lifecycle Management. (and 2024 draft update). (csrc.nist.gov, NIST Publications) [Google Scholar] [Crossref]

12. ENISA. (2021). ENISA Threat Landscape 2021 (and SIM-swapping advisories). (enisa.europa.eu) [Google Scholar] [Crossref]

13. GSMA. (2021). Mobile Telecommunications Security Landscape 2021 (notes SMS/SS7 weaknesses relevant to 2FA). (GSMA) [Google Scholar] [Crossref]

14. AP News. (2024). FCC fines wireless carriers for sharing user locations without consent (nearly $200M total). (AP News) [Google Scholar] [Crossref]

15. Wired. (2019). Holes in 4G and 5G networks could let hackers track your location. (Coverage of ToRPEDO and related flaws). (WIRED) [Google Scholar] [Crossref]

16. RND (Administrator site). (n.d.). Reassigned.us — service portal for RND queries. (reassigned.us) [Google Scholar] [Crossref]

17. Manatt, Phelps & Phillips, LLP. (2017). Reassigned numbers: Commenters embrace database, split on safe harbor. (FCC NOI coverage). (manatt.com) [Google Scholar] [Crossref]

18. Meta. (2022). About Custom Audiences from customer lists. (Phone numbers accepted for audience matching). (Medium) [Google Scholar] [Crossref]

19. Clearcode. (2023). How phone numbers are used in digital advertising. (Explains hashed identifiers and matching). (gdpr-info.eu) [Google Scholar] [Crossref]

20. Gryphon.ai. (2024). Understanding the Reassigned Numbers Database and why it matters to compliance. (Explainer). (gryphon.ai) [Google Scholar] [Crossref]

21. The Hacker News. (2021). New study warns of security threats linked to recycled phone numbers. (Popular write-up of the Princeton results). (The Hacker News) [Google Scholar] [Crossref]

22. Commsrisk. (2021). Research shows recycling phone numbers threatens privacy. (Industry coverage of the study). (commsrisk.com) [Google Scholar] [Crossref]

• Advanced Techniques for Fake News Detection on Twitter Using NLP and AI: A Comprehensive Review
• Review of Self Compacting Geopolymer Concrete Using Slag Sand as Fine Aggregate
• Performance of Local Construction Contractors – Case Study of Registered Contractors in Monrovia, Liberia
• Cross-Cultural Perspectives on Innovation Management in Multinational Organizations
• Modeling of Reaction Between Dissolved Oxygen (DO) And Biological Oxygen Demand (BOD) in Degradation River