It’s 2018 and the latest technology industry craze is a fad that gripped middle schoolers in the year 2000: scooters.

VCs near and far are throwing their expendable investment dollars at companies like Spin, Bird, and Lime, which plop scooters onto busy streets in the hopes that pedestrians will use them to get to their destinations slightly faster. (Spoiler: They do.) All of these companies have attracted high-profile venture backers–including Alphabet, Uber, and Andreessen Horowitz–and at least two of the companies are said to be worth over a billion dollars.

As you may have guessed, it’s not just about the scooters. The real thing that makes the Silicon Valley elite weak at the knees is data–especially when it’s in aggregate and vacuumed up with abandon. According to the ACLU, this is exactly what these scooter startups are doing.

A new blog post from the organization’s Northern California branch analyzes all of the data-collection practices of Spin, Bird, and Lime. To put it mildly, these companies’ policies all seem a bit reckless. For example, all three startups have persistent user tracking, meaning they are following users’ every move from the time they use the scooter until the end of the session. As the ACLU writes, this means it will know if you’re going to a “political protest, or to a religious service, or to see a medical specialist.” And, of course, these companies are keeping this data for an undisclosed amount of time while reserving the right to share it with third parties.

Perhaps more egregious are the companies’ policies on government intrusion. Instead of requiring a warrant, Spin, Bird, and Lime all say that they may hand over personal user information to the authorities on a “good faith belief” that they must do so. In short, if the FBI asks them for data and doesn’t present official documentation from a judge, they may hand it over. The ACLU writes that by taking this mealymouthed approach, “scooter companies are increasing the risk that their growing database of rider photos will end up in the hands of government entities looking to bolster surveillance capabilities.”

With privacy scandals in the news almost daily, digital rights advocates have been calling on tech companies to more clearly explain their data policies and terms of service. With the Cambridge Analytica scandal, where millions of Facebook users’ personal data was unknowingly collected by a third party, the onus was placed on the platform to be less opaque. The ACLU writes that all three scooter companies should be more upfront with their privacy policies, as a way to prove transparency and build user trust.