The ACLU announced Tuesday that Facebook, Twitter, and Instagram gave Chicago-based company Geofeedia access to user information that helped law enforcement agencies monitor and target activists of color. Emails between law enforcement and reps for Geofeedia reveal the company’s “special access” to the social media sites, even referring to a “partnership” with Instagram and Facebook. In response to the findings, all three sites—Facebook, Instagram, and Twitter—have terminated Geofeedia’s access to their data.

Geofeedia is location-based social media monitoring that provides real-time data on social media users in a specified area. Users first select an area to target:

Then, Geofeedia sources all social media activity within the targeted area from social media sites. Though the posts initially appear as dots on the map, they can be interacted with to reveal the content of each individual post:

With this data, you can then monitor specific keywords—and the people using them—in any given place. Keywords like “rally,” “protest” or “march” can be tracked, along with hashtags like #BlackLivesMatter or #FreePalestine. Even emojis are tracked on the service. Geofeedia users have real-time access to a social media user’s location, profile, and even other people using the same tag within the area.

As uncovered by the ACLU, Twitter, Instagram, and Facebook have all provided Geofeedia with varying levels of access to this data, which it then used as a bargaining chip when negotiating with law enforcement. There are no exact numbers on how many people were targeted, but as discussed in a Geofeedia “case study,” they were directly involved in the Baltimore Police Department’s response to the Freddie Gray protests. Calling it a “stroke of luck” that the BPD renewed their Geofeedia contract only days before the protests, the study reveals that law enforcement used facial recognition software to identify specific protestors from social media photos. They then matched that information to outstanding warrants and arrested protestors “directly from the crowd.”

Nicole Ozer, the Technology & Civil Liberties Policy Director of the ACLU of California, requested records from 63 police departments across California and found that there are startlingly few processes in place to alert social media users as to how their data is being used:

We found no evidence in the documents of any public notice, debate, community input, or lawmaker vote about use of this invasive surveillance. And no agency produced a use policy that would limit how the tools were used and help protect civil rights and civil liberties.

The Washington Post reports that Geofeedia provides 500 law enforcement agencies with surveillance data, specifically boasting that the company has been “monitoring for protests” with “several DAs from around the country.” One email between Geofeedia and police says a product feature “covered Ferguson/Mike Brown nationally with great success.”

In response, Facebook, which owns Instagram, said Geofeedia only had access to data people had already made public:

Its access was subject to the limitations in our Platform Policy, which outlines what we expect from developers that receive data using the Facebook Platform. If a developer uses our [user data] in a way that has not been authorized, we will take swift action to stop them and we will end our relationship altogether if necessary.

Twitter responded as well, though they did not explain the exact nature of their relationship with Geofeedia:

Based on information in the @ACLU’s report, we are immediately suspending @Geofeedia’s commercial access to Twitter data. — Policy (@policy) October 11, 2016

Facebook and Twitter both release annual transparency reports detailing how often they release information directly to either local police or federal authorities. However, proprietary data sourced via a third party seemingly falls outside of official requests, thus leaving a blindspot in terms of the “transparency” that both companies have said they value.

“Facebook and especially Twitter have built their brands on the backs of Black users,” said Brandi Collins, campaign director of online racial justice organization Color of Change in a statement. “CEOs Mark Zuckerberg and Jack Dorsey have openly courted activists and organizations in the Movement for Black Lives to engage with their platforms. This makes each of their involvement with social media surveillance tools used against Black activists all the more disturbing.

In joint letters to both Facebook and Twitter, the ACLU, Center for Media Justice, and Color of Change have called on both companies to advance new reforms. They seek an end to data access for surveillance software, more comprehensive transparency policies, and an audit of third-party developers for privacy compliance. In the meantime, Geofeedia’s CEO has agreed to a meeting with ACLU representatives at an unspecified point in the future.

Most troubling is that Geofeedia is just one part of an entire economy of mass surveillance tools that source similar location-based social media information. Dataminr, MediaSonar, X1 Social Discovery, and Dunami, all have similar scanning, keyword filtering, and real-time geolocation features. Whether these services are collaborating with law enforcement for mass-surveillance has not been revealed, but the conversation on privacy and fears of police overreach continues.