I got a private IPv6 only on AT&T cell when I checked a couple of years ago (to be clear, not a public one with inbound-deny). Will check again.

Edit: Ok not sure what to make of this now. On an iPhone rn so it's tricky, the Net Analyzer app says I have 5 2600:s on cell, which should be the public range, but my public IP according to test-ipv6.com is a different 2600: from all the above. Wonder if those 5 are actually the EPC.

There's an HN comment about them using NAT: https://news.ycombinator.com/item?id=23025344 and this forum thread https://wirelessjoint.com/viewtopic.php?p=25357

There's an old Reddit thread where someone said at first there's no NAT, but then realized there is https://www.reddit.com/r/ATT/comments/8k680y/cellular_public...