Police are using social networks to spy on you.

On Oct. 11, the US watchdog American Civil Liberties Union revealed that over 500 police forces were accessing user data from Twitter, Facebook, and Instagram using analytics service Geofeedia. According to the ACLU’s public-records request of 63 enforcement agencies, the findings of which were outlined in a recent report, Chicago-based Geofeedia provided police with users’ locations.

Using that information, the documents show that police tracked the 2015 protests in Baltimore following the death of Freddie Gray, and protests a year earlier in in Ferguson, Missouri, after the police shooting of Michael Brown. According to the ACLU report, Geofeedia boasted in emails to law enforcement agencies about “arrangements with Twitter and Instagram” and a “confidential legally binding agreement with Facebook.”

According to the report, Instagram provided Geofeedia access to public posts, while its parent company, Facebook, made available its Topic Feed API. Typically geared at brands and media companies, the topic feed provides a ranked feed of public posts that mention a specific topic, including hashtags, events, or places.

“[Geofeedia] only had access to data that people chose to make public,” a Facebook spokesperson told Quartz. “If a developer uses our APIs in a way that has not been authorized, we will take swift action to stop them and we will end our relationship altogether if necessary.” Both Instagram and Facebook had rescinded GeoFeedia’s access by mid-September.

Twitter has a “longstanding rule” prohibiting the sale of user data for surveillance, as well as a developer policy that bans the use of Twitter data for tracking and monitoring. The company never granted explicit data access to Geofeedia, but the startup was able to scan its database of public tweets via a subsidiary, and was promoting its Twitter-monitoring capability as recently as July 11 . Twitter suspended all of commercial access today.

Baltimore and Ferguson aren’t alone: The ACLU has seen similar surveillance methods being used in Oakland, Denver, Seattle and other US cities. Ozer said social media intelligence firms like Media Sonar and X1 Social Discovery have also provided authorities with public user data.

By shutting off Geofeedia’s access, the companies have made bold statements, says Nicole Ozer, ACLU California’s technology and civil liberties policy director. But they still need to develop “robust auditing measures to make sure their systems aren’t being used for surveillance,” she said. “Telling someone to not do something and making sure that they don’t do it are two very different things.”

While social media companies have invited activists onto their platforms, endorsed Black Lives Matter, and encouraged other social and political movements—and Geofeedia’s surveillance technique isn’t illegal—scouting personal information from these platforms to crack down on US protestors could have a chilling effect on community activism. Surveillance technology has already been proven to disproportionately impact communities of color, Ozer says, and minority groups, in addition to being over-policed, are already bearing the brunt of increased police intrusion into technology.