U.K. grocer Morrisons, ad-buying behemoth GroupM and other marketers and agencies are testing never-before-available data from cellphone carriers that connects device location and other information with telcos' real-world files on subscribers. Some services offer real-time heat maps showing the neighborhoods where store visitors go home at night, lists the sites they visited on mobile browsers recently and more.

Under the radar, Verizon, Sprint, Telefonica and other carriers have partnered with firms including SAP, IBM, HP and AirSage to manage, package and sell various levels of data to marketers and other clients. It's all part of a push by the world's largest phone operators to counteract diminishing subscriber growth through new business ventures that tap into the data that showers from consumers' mobile web surfing, text messaging and phone calls.

SAP's Consumer Insight 365 ingests regularly updated data representing as many as 300 cellphone events per day for each of the 20 million to 25 million mobile subscribers. SAP won't disclose the carriers providing this data. It "tells you where your consumers are coming from, because obviously the mobile operator knows their home location," said Lori Mitchell-Keller, head of SAP's global retail industry business unit.

There is a lot of marketer interest in that information because it is tied to actual individuals. For the same reason, however, there is potential for resistance from privacy advocates.

WPP units such as Kantar Media and GroupM's Mindshare have "kicked the tires" for three years on Consumer Insight 365, testing and helping develop applications for the service, said Nick Nyhan, CEO of WPP's Data Alliance. The extensive time spent so far partly reflects "high sensitivity to not doing something that would be too close for comfort from a consumer point of view," Mr. Nyhan said.

The service also combines data from telcos with other information, telling businesses whether shoppers are checking out competitor prices on their phones or just emailing friends. It can tell them the age ranges and genders of people who visited a store location between 10 a.m. and noon, and link location and demographic data with shoppers' web browsing history. Retailers might use the information to arrange store displays to appeal to certain customer segments at different times of the day, or to help determine where to open new locations.

"It used to be that this data was a lot harder to come by," said Ross Shanken, CEO of LeadID, a lead generation analytics firm. In a previous position at data firm TargusInfo 2008 and 2010 he nonetheless partnered with "a very large telco" to validate names, addresses and phone numbers for data appending.

Too risky for the E.U.?
To protect privacy, SAP receives non-personally-identifiable, anonymized information from telcos, and only provides aggregated information to its clients to prevent reidentification of individuals. Still, sharing and using data this way is controversial. Nearly all the players exploring the burgeoning Telecom Data as a Service field, or TDaaS for short, are reluctant to provide the details of their operations, much less freely name their clients. And despite privacy safeguards, SAP is focused on selling its 365 product in North America and the Asia-Pacific region because it cannot get the data it needs from telcos representing consumers in the E.U., where data protections are stricter than in the U.S. and elsewhere.

But the rewards may outweigh the possible tangles with government regulators, consumer advocates and even squeamish board members.

The global market for telco data as a service is potentially worth $24.1 billion this year, on its way to $79 billion in 2020, according to estimates by 451 Research based on a survey of likely customers. "Challenges and constraints" mean operators are scraping just 10% of the possible market right now, though that will rise to 30% by 2020, 451 Research said.

"If I was a CEO of any telecom operator in the U.S., I would be saying to myself I can do the same," said Michael Provenzano, CEO and co-founder of Vistar Media, which teams up with mobile operators to provide anonymized and aggregated data for targeting digital out-of-home ads based on consumers' comings and goings. "That's going to be something these guys are talking about in the boardroom."

Perhaps the most prominent recent moves in the burgeoning TDaaS realm are Verizon's $4.4 billion acquisition of AOL in May, followed by its purchase of mobile ad network Millennial Media for $238 million in September. Many saw the AOL buy as a means for Verizon to turn its data into a viable business, in part because AOL provides ad-tech infrastructure and marketer relationships that Verizon lacks.

The level of authenticated information derived from Verizon and other mobile operators is seen as potentially more valuable than some other consumer data because it directly connects mobile phone interactions to individuals through actual billing information. "We're talking about linking a household and a billing relationship with a human being," said Seth Demsey, CTO of AOL Platforms.

Verizon's Precision Market Insights division previously stumbled in its attempts to aggregate and package mobile data to help marketers target consumers and measure campaigns. Sprint's similar Pinsight Media division and AT&T's AdWorks—which segments and targets TV audiences—have not fared much better, according to observers.

But lackluster results from going it alone have driven telcos toward companies that can facilitate cashing in on data. Along with SAP on the marketer-facing side, others including HP and IBM have stepped in to help phone carriers on the back-end data management and analysis side.

When Spanish operator Telefonica embarked on its Dynamic Insights offering, it partnered with consumer insights firm GfK to help package the telco's mobile data for clients including U.K. food purveyor Morrisons. The grocery chain used the service to garner anonymized data connecting consumer demographic data to location visits.

Some of these data relationships have long histories. SAP America owns Sybase, a subsidiary it bought in 2010 that serves as a technology hub for multiple mobile carriers and counts Verizon as a partner. The Sybase business has provided "deep relationships with mobile operators around the globe," said Rohit Tripathi, global VP and general manager of SAP Mobile Services, in an email.

AirSage, another firm that has tight integrations with mobile operators, supplies data to municipal planners, retail store developers and city tourism boards. The company integrated its technology with telecom companies in the 1990s to enable 911 call support services. More recently it has signed data deals with Verizon Wireless and Sprint. "Our solution is actually plugged into the network behind the firewall of the carrier," said Ryan Kinskey, director of business development and sales at AirSage. Device IDs tracked by AirSage are anonymized, he added.

Verizon and Sprint declined to comment for this story. AT&T and T-Mobile said they don't share consumer or location data with SAP, Sybase, AirSage or Vistar.

Why the secrecy?
Insiders say phone carriers exploring data-sharing businesses are tight-lipped because they don't want to reveal too many details to competitors, but fear of consumer complaints is always lurking in the background.

"The practices that carriers have gotten into, the sheer volume of data and the promiscuity with which they're revealing their customers' data creates enormous risk for their businesses," said Peter Eckersley, chief computer scientist at the Electronic Frontier Foundation, a privacy watchdog. Mr. Eckersley and others suggest that anonymization techniques are faulty in many cases because even information associated with a hashed or encrypted identification code can be linked back to a home address and potentially reidentified by hackers.

Unlike other types of location tracking, such as beacon technologies that work only with mobile apps that people have agreed to let track them, many services employing telco data require no explicit opt-ins by consumers. Companies like SAP instead rely on carriers' terms and conditions with their subscribers, calling acceptance of the terms equivalent to opting in. Verizon's privacy policy, for example, says that information collected on its customers may "be aggregated or anonymized for business and marketing uses by us or by third parties."

Ultimately, for mobile operators, these relationships could reap substantial income from the data generated by subscribers who already account for their primary revenue streams. The telcos do not break out revenue derived from their data-related sales in their quarterly earnings reports, so just how much money they're making from these deals is not known.

SAP will "effectively share the revenue back with the operator, so they get to make money from data that they're basically not utilizing or under-utilizing today," former SAP Mobile President John Sims said at an industry conference in Las Vegas in 2013 as the company introduced Consumer Insight 365.

"The mobile operators don't want to reveal this," said Mr. Tripathi, the SAP Mobile Services executive. No matter how much telcos and their partners stress that the data is anonymized and aggregated, he said, "they are fearful people will take this and twist it into something that it isn't."