If someone successfully deanonymizes the data, would that make AT&T liable for damages? You really don't need that many bits of entropy to accurately identify someone.

relevant: http://33bits.org/