Google has been sharing user data with a sanctioned Russian company, according to ProPublica

As recently as late June, Google was sharing user data—which could include IP addresses, geographical locations, and details about users’ identity, interests, and search activity—with an advertising company owned by Russia’s largest state bank, according to a report shared with ProPublica.

The company, RuTarget, is based in Moscow and helps broker the sale of digital advertisements to brands and agencies. RuTarget was added to a list of entities sanctioned by the U.S. Treasury on February 24, the day Russian troops invaded Ukraine. U.S. entities are forbidden from doing business with companies on the list.

RuTarget and its parent, the Russia-controlled financial firm Sberbank, were also hit with more aggressive full-blocking sanctions by the U.S. Treasury in April.

But according to a report from digital analytics firm Adalytics, which was cited by ProPublica, there were at least 700 instances after the first sanction in February of Google sharing website- and mobile-app-browsing data with RuTarget, from users across the globe—including in Ukraine, where war has raged for four months. Such data could be used by Russian military and intelligence forces to track people, spy on targets, or triangulate combat zones, experts say.

The sharing occurred even after multiple U.S. lawmakers called for Big Tech companies like Google to audit their advertising business’ compliance with economic sanctions, and warned of the national security risks wrought by such data-sharing. In a bipartisan letter sent last year to Google, Twitter, AT&T, and Verizon, among others, six senators including Ron Wyden, Kirsten Gillibrand, Mark Warner, and Elizabeth Warren wrote that “this information would be a goldmine for foreign-intelligence services that could exploit it to inform and supercharge hacking, blackmail, and influence campaigns.”

A Google spokesperson told the publication that RuTarget had been banned from buying Google ad products in March but had continued to receive user data—used for ad bidding—from the Silicon Valley tech giant. According to ProPublica, Google stopped sharing the data with RuTarget on June 23, after the publication reached out to inquire about the report. The company also said it would take action to block RuTarget from buying Google ads through un-sanctioned third parties in Russia.