At least one U.S. phone company likely broke the law by sharing data that can pinpoint the location of smartphone users, the Federal Communications Commission said Friday.

FCC Chairman Ajit Pai said in a letter to Congress that one or more wireless companies apparently violated federal law and could be subject to penalties. He didn’t name any companies but said the commission would decide soon on enforcement actions, now that the agency has completed an investigation.

The FCC’s enforcement bureau began investigating following 2018 reports that U.S. wireless providers were selling real-time phone location information to outside data aggregation firms without phone users’ knowledge or consent. Location-tracking services can use the data to keep tabs on packages and vehicles or create personalized marketing pitches, but it can also be used by bounty hunters or stalkers to identify the whereabouts of nearly any phone in the U.S. within seconds.

The reports led the four major companies, Verizon, AT&T, Sprint and T-Mobile, to pledge to stop providing users’ location information to data brokers, stepping back from a business practice that had drawn criticism for endangering privacy.

A statement Friday by FCC Commissioner Jessica Rosenworcel said the safety and privacy of millions of Americans was at risk and “it’s a shame that it took so long for the FCC to reach a conclusion that was so obvious.” Rosenworcel is a Democrat; Republicans have a 3-2 majority at the agency.

“For just a few hundred dollars, shady middlemen could sell your location within a few hundred meters based on your wireless phone data,” she said. “It’s chilling to consider what a black market could do with this data.”

Democrats in Congress clashed with Pai on this issue last year, expressing concern in a November letter to the FCC that it was shirking its duty to protect consumer privacy. Pai, a Republican, responded in December that the commission was taking its investigation seriously and said he recognized the importance of the issue to domestic violence victims, victims of sex trafficking and others.