The US Federal Communications Commission (FCC) prepared to crack down on US operators after concluding they broke the law by selling customer location data, despite the companies voluntarily ending the practice almost two years ago.

FCC chairman Ajit Pai told Congress he planned to issue a document recommending penalties for unspecified violations “in the coming days”. The move comes in response to an investigation from technology news website Motherboard in 2018, which found third parties were able to improperly access mobile subscriber location data sold by operators to brokers.

US operators put a stop to the practice after a report by the news site.

Pai said an “extensive investigation” into the incident concluded “one or more wireless carriers apparently violated federal law,” adding punishment would be forthcoming.

In a statement, Commissioner Jessica Rosenworcel slammed the FCC for being slow to respond to an issue which put “the safety and privacy of every American” with a mobile phone at risk.

“Millions and millions of Americans use a wireless device every day and didn’t sign up for, or consent to, this surveillance. It’s a shame that it took so long for the FCC to reach a conclusion that was so obvious.”