Public records obtained by the Georgetown Law Center on Privacy and Technology provided the first proof that ICE had sought such scans, which were conducted in Utah, Vermont and Washington.

All three states — which offer driving privileges to immigrants who are in the U.S. illegally — agreed to the ICE requests, according to documents shared with The Associated Press on Monday and first reported by The Washington Post.

“States asked undocumented people to come out of the shadows to get licenses. Then ICE turns around and uses that to find them,” Alvaro Bedoya, the center’s director, said Monday.

ICE spokesman Matthew Bourke did not directly address written questions, including whether the agency used the scans to arrest or deport anyone.

“During the course of an investigation, ICE has the ability to collaborate with external local, federal and international agencies to obtain information that may assist in case completion and prosecution efforts,” Bourke said in a written response. “This is an established procedure that is consistent with other law-enforcement agencies.”

At least two cases in Utah and one in Washington state appeared to involve immigration enforcement, but the vast majority of requests from ICE in Utah were from its Homeland Security Investigations division, which has a limited role in immigration enforcement.

The documents for Vermont and Washington involved just a handful of records. The Utah document obtained by Georgetown was a ledger with details on more than 1,800 cases spanning two years of requests from multiple agencies, including other states, the FBI and the State Department.

The use of facial-recognition by state, federal and local law enforcement agencies has grown over the past decade as an FBI pilot project evolved into a full-scale program.

Twenty-one states and Washington, D.C., let the FBI access their drivers’ license and identification photos, according to a Government Accountability Office report published last month. The report said the FBI currently has access to 640 million photos — including for U.S. visa applicants — with more than 390,000 photos searched for matches since 2011, the year the agency augmented its fingerprint database with facial analysis.

Privacy concerns over the burgeoning use of facial recognition are on the rise as public awareness of the virtually unregulated practice grows. San Francisco and Somerville, Massachusetts, have in recent weeks become the first U.S. cities to ban the use of facial recognition by their police and city agencies. Amazon and has come under fierce criticism for providing facial recognition tech to law enforcement.

One major concern of activists is that the technology could be abused in the Trump administration crackdown on immigration. Shankar Narayan, director of the technology and liberty project at the American Civil Liberties Union in Washington, said federal agencies “are seeing a huge opportunity to use technologies … to enforce immigration statutes in a way that was never intended.”

In July 2017, Georgetown researchers filed Freedom of Information Act requests with every state seeking documents on how they responded to requests for facial recognition information from Law enforcement agencies, Bedoya said.

Many states ignored or denied the requests. Utah, Vermont and Washington provided useful responses.

In Utah, ICE asked to search the database containing license images 49 times between October 2015 and November 2017, said Department of Public Safety spokeswoman Marissa Cote. No search warrant or subpoena was required, but all searches involved potential criminal suspects, she said.

State officials are not always informed if ICE catches a suspect, though the agency has been informed in some cases where a suspect was identified, including heroin trafficking, narcotics smuggling and credit-card identity theft, Cote said.

The state does not run searches for people whose only infraction is living in the country without proper documentation, Cote said.

But Democratic state Rep. Angela Romero called the searches “government overreach” with the potential to spread fear.

“For me, it’s the federal government accessing information without the legislature’s knowledge or permission,” she said.

A spokeswoman for Vermont’s Republican governor, Phil Scott, said Vermont officials stopped sharing facial-recognition information with federal immigration authorities in May 2017.

In Washington state, the Department of Licensing said it has not received a facial-recognition request since 2017 and noted that as of 2018, all requests must be court ordered.

Jaime Smith, a spokeswoman for Gov. Jay Inslee, said “at no point do federal agencies have access to that database.”

“We really want to make clear that we’re not going to allow the federal government to commandeer the use of our state resources to use as part of their immigration effort.”

A law that Inslee signed earlier this year broadly prohibits local law enforcement agencies from asking about immigration status or place of birth unless directly connected to a criminal investigation.

More must-read stories from Fortune:

—Why Hong Kong is protesting —and may do so again

—Black women voters will be central to the 2020 election, experts predict

—Trump reportedly wants tanks on the National Mall on July 4

—Supreme Court redistricting decision could reshape politics

—This 31-year-old just torpedoed Italy’s relationship with EU partners

Get up to speed on your morning commute with Fortune’s CEO Daily newsletter.