Instagram today terminated a relationship with an advertising partner after it was discovered to be collecting data from user accounts, the latest in a long line of privacy failures involving parent company Facebook Inc.

The company in question, San Francisco-based Hyp3r Inc., is alleged to have created tools that allowed it to collect public Instagram data, including user posts, profile information and location data. The data included the same information from Instagram Stories, a feature where posts disappear after 24 hours.

Hyp3r is said to have primarily used Instagram’s official application programming interface to obtain the bulk of the data, an apparent violation of Instagram’s policies, though Hyp3r itself denies it. It would appear that Hyp3r was also scraping some data as well. Access to data from the Stories feature is not available through Instagram’s API.

“HYP3R’s actions were not sanctioned and violate our policies,” Instagram said in a statement.  “As a result, we’ve removed them from our platform. We’ve also made a product change that should help prevent other companies from scraping public location pages in this way.”

Business Insider reported that Hyp3r got away with obtaining the data through the API due to “a combination of configuration errors and lax oversight by Instagram.”

That the API provided the ability for Hyp3r to obtain data begin with, a function that has seemingly been changed per Instagram’s statement, would appear to be more intentional than an error and one seen before with the infamous Cambridge Analytica case on Facebook. Cambridge Analytica was found to have exploited Facebook APIs to download the data of millions of Facebook users, resulting in a scandal that saw Facebook investigated, sued and in some cases fined.

Discussing the scraping aspect of the allegations against Hyp3r, Steve Black, professor of law at Texas Tech University, told SiliconANGLE that web scraping has been a topline cyberlaw issue for several years.

“There are cases out of the 9th Circuit Court that have tried to hold web scraping as a copyright violation,” Black explained. “But if the information is online and publicly accessible, law officials can sometimes overlook the practice. In this heightened state of data privacy advocacy and with a more educated consumer, those sentiments from law officials could change.”

Still, he added, the fact is that “if we as consumers are willing to give our data to a company like Instagram or Facebook that posts it publicly online and has a history of data misuse, we shouldn’t be the least bit surprised to see our data used in all kinds of ways we’re not aware of.”

Image: Hyp3r