"They're obviously trying to avoid a hornet's nest of consumer-protection lawsuits," said Chris Hoofnagle, a San Francisco privacy consultant and former senior counsel at the Electronic Privacy Information Center.

"They've written this new policy so broadly that they've given themselves maximum flexibility when it comes to disclosing customers' records," he said.

John Britton, an AT&T spokesman, denied that the updated privacy policy marks a shift in the company's approach to customers' info.

"We don't see this as anything new," he said. "Our goal was to make the policy easier to read and easier for customers to understand."

He acknowledged that there was no explicit requirement in the past that customers accept the privacy policy as a condition for service. And he acknowledged that the 2004 policy said nothing about customers' data being owned by AT&T.

But Britton insisted that these elements essentially could be found between the lines of the former policy.

"There were many things that were implied in the last policy." He said. "We're just clarifying the last policy."