Your cell phone provider is probably selling access to your real-time location, Fast Company reports.

That’s the takeaway from a still-developing story that all started when a former police sheriff used a cellphone-locating service meant to track prisoners to find people who aren’t inmates—according to a chilling report in the New York Times. His alleged targets included a judge and members of the State Highway Patrol, and he reportedly tracked their phones without a warrant.

Securus Technologies is the company in the crosshairs of a letter from Senator Ron Wyden of Oregon to the FCC demanding that the agency investigate the company’s practices. The Electronic Frontier Foundation explains:

Securus is one of the largest providers of telephone services to jails and prisons throughout the country and its technology enables inmates to make collect and prepaid calls to others outside of the facility—at outrageous, unnecessarily high prices. As part of that provision of service, Securus collects location information on everyone called by a prisoner. Securus has used its ability to collect this information to build an online portal that allows law enforcement to obtain the real-time location data of any customer of the country’s major cellphone carriers—not just people who call or receive calls from a prisoner. Worse, Securus doesn’t even check whether law enforcement requestors actually have legal authority to access the data in the first place, before sharing this private location information.

Securus claims this location information is meant to identify and interdict planned importation of contraband into jails and prisons and coordinated escape attempts, and to respond to amber alerts. But that doesn’t explain why it should be getting access to the real-time location information of virtually anyone with a cellphone.

Telecom companies are required by law to keep call location information for use in emergencies. But the same law obligates them to keep the data confidential. FCC regulations expressly prohibit the sharing of call information except where required by law, for purposes of providing cell phone service, or with the customer’s consent.