You're right: the big carriers don't have much incentive to deploy this -- yet. We think deployment will come through three paths: 1) virtual operators (MVNOs) can differentiate themselves by offering PGPP-based privacy-enhanced service, 2) big carriers (MNOs) will want to (eventually) claim that they are doing the right thing on privacy and jump on board, and 3) new regulations (in various U.S. states and post-GDPR rules that are being drafted) are stipulating that location data is private so it's better to not have it rather than have to prove that it's being handled properly.

Better GDPR enforcement would be an incentive.

The GDPR introduces the principle of data minimisation which means that you must collect the least amount of data possible to deliver a particular service (unless the user consents to sharing more which should be opt-in, you can’t force them or use dark patterns to make them opt-in).

But considering even basic violations that are trivial to rectify such as the Facebook SDK or Google Analytics being everywhere are not punished, there is no chance they’d go after cell carriers.