The Federal Communications Commission proposed fines totaling more than $200 million on the nation’s largest wireless carriers Friday for selling customer location data to third parties without their consent. T-Mobile faces the steepest fines, with the FCC proposing a penalty of more than $91 million on the Bellevue, Wash, company.

The FCC requires carriers to take “reasonable measures” to protect customers against third parties accessing their data without permission. Based on an investigation, the agency claims that all four carriers sold customer location data to third-party aggregators who then resold the information.

Update: A T-Mobile spokesperson provided the following statement in response to the FCC’s proposed fine.

We take the privacy and security of our customers’ data very seriously. When we learned that our location aggregator program was being abused by bad actor third parties, we took quick action. We were the first wireless provider to commit to ending the program and terminated it in February 2019 after first ensuring that valid and important services were not adversely impacted. While we strongly support the FCC’s commitment to consumer protection, we fully intend to dispute the conclusions of this NAL and the associated fine.

Under the FCC’s proposal, AT&T faces a $57 million fine, Verizon’s is $48 million, and Sprint would be on the hook for $12 million.

T-Mobile and AT&T said they stopped sharing cellular location data in 2019, according to The Wall Street Journal. Verizon said the same in 2018.

“American consumers take their wireless phones with them wherever they go,” said FCC Chair Ajit Pai in a statement. “And information about a wireless customer’s location is highly personal and sensitive. The FCC has long had clear rules on the books requiring all phone companies to protect their customers’ personal information.”

The investigation followed reporting by Motherboard that revealed how bounty hunters are able to locate individual wireless customers using their phone numbers.

Some FCC commissioners, like Jessica Rosenworcel, feel the proposed penalties are too small. She said the FCC’s proposal, “is a day late and a dollar short,” in a tweet.

“It took too long to get here,” she said. “Americans’ privacy and security deserves the highest level of protection. That didn’t happen here.”

Sen. Ron Wyden, a Democrat from Oregon, called the FCC’s plan “laughable” on Twitter. Wyden’s office helped bring the location-sharing practices of wireless carriers to light.

If reports are true, then Ajit Pai has failed to protect consumers at every turn. This issue came to light after my office and dedicated journalists discovered how wireless carriers shared Americans’ locations without consent. He investigated only after public pressure mounted. https://t.co/q8tWE9hAvi — Ron Wyden (@RonWyden) February 27, 2020

The fines the FCC proposed are not set in stone. The carriers will have the opportunity to respond before a final penalty is decided.