Earlier this month, the ACLU published a report alleging that it had obtained public records showing that social media user data such as location tracking, photos and hashtag usage may have been used by law enforcement to monitor activists and protests. ACLU claims that records show that Twitter, Facebook and Instagram provided user data access to Geofeedia, a developer of a social media monitoring program that is marketed to law enforcement agencies as a tool for such tracking. According to the report, law enforcement used the monitoring program to track protests in Baltimore and Ferguson, Missouri.

The ACLU claimed that this particular discovery is just part of the “fast expansion of social media surveillance with little-to-no debate or oversight.” The records seemed to indicate that Geofeedia has helped 500 law enforcement agencies track and respond to crime, and that Geofeedia is far from alone in offering a social media monitoring program: amongst its competitors are other companies such as HootSuite, TweetDeck, and SnapTrends.

In response to the report, which was written about on popular news outlets such as BuzzFeed and the Washington Post, Facebook and Instagram (which is owned by Facebook) cut off Geofeedia’s access to users’ public posts. Twitter also took steps to prevent Geofeedia from accessing information.

While the focus of the ACLU and response from social media companies has been on the right of users to engage in free political and social discourse, the report also sheds light on additional and innovative ways of using social media data as well as the risks to both users who post public information on social media and companies that use that information. When used properly, social media data can provide substantial insight into the daily lives of a vast network of users, and especially when such data is provided voluntarily and made public by the users themselves, it can be difficult to see any inherent danger in using it. But, as the ACLU’s report suggests, certain uses—and sales—of social media data may be legally ambiguous, unethical or even just extremely unpopular. And while all companies work to avoid behavior that exposes them to legal consequences, for social media companies especially, “extremely unpopular” actions can be just as damaging.

The ACLU report provides an important reminder for companies, be they in the social media arena or elsewhere: once shared, it’s near impossible to prevent a data set gathered for one purpose and in one context from being used for other purposes and in other contexts.