At least one carrier apparently ran a foul of federal rules about revealing real-time info on consumers’ whereabouts.

At least one US phone company apparently violated federal law in regard to disclosing real-time location data of customers, the Federal Communications Commission said Friday.

FCC Chairman Ajit Pai said in a letter to several members of Congress that the commission’s Enforcement Bureau had reached that conclusion after an investigation and that any violators could face a penalty.

The FCC’s Enforcement Bureau started investigating in May 2018, after news surfaced about carriers selling location data to third parties. Such data can be used for aboveboard purposes like locating a lost smartphone or getting emergency roadside assistance, but it can also be sold to data aggregators who use it for purposes beyond a customer’s control. 

“The negligent attitude toward Americans’ security and privacy by wireless carriers and intermediaries puts every American at risk,” Sen. Ron Wyden said at the time the inquiry was announced.

The month after that announcement, some carriers said they were ending their contracts with location-aggregating companies, but it was subsequently revealed that the practice was still going on.

In January 2019, US lawmakers again pressed the FCC for answers on the sale of consumer location data.

In his Friday letter, Pai said the FCC is committed to enforcing its rules and the Communications Act. In “the coming days,” Pai said, he’ll consult with the other FCC commissioners on the location-data infractions and on notifying the violators about a proposed penalty, through what’s called a Notice of Apparent Liability for Forfeiture. The violators would then have a chance to respond.

“Millions of Americans use a wireless device every day,” FCC Commissioner Jessica Rosenworcel tweeted on Friday. “They didn’t sign up for having their phone location data bought and sold when they signed up for wireless service. But this clearly happened. Now the FCC must hold accountable those responsible.”