Even if that's so, there is still the issue of "expectation of privacy". If the customer buys AT&T's service and expects a certain degree of privacy (meaning no one can just try and locate where he is with that data, or with who he is talking to, etc), then I think he deserves that kind of privacy.

Ultimately, the citizens can demand laws that state that fact explicitly. There are countries where collection of metadata by authorities in this way is illegal - and not because they didn't try to collect it. They did. It's just that "the people" won the argument, and now they aren't allowed to use the metadata (or at least not in this sweeping way).