The American Civil Liberties Union revealed that it shares data with a company it regularly criticizes for privacy blunders: Facebook. 

The civil liberties group quietly revealed the new details about its data sharing on Thursday as part of an update to its online privacy statement. In the update, the ACLU says it shares data with “communications platforms” including Facebook to deliver content to people who may be interested and to target specific users with digital ads.

That data includes people’s names, email addresses, phone numbers, country of residence, and ZIP codes, the ACLU told Fortune. The organization collects that data from people who visit its website to, for example, sign up to join ACLU distribution lists, buy something, or make a donation.

When the ACLU shares personally identifiable information with third parties, its says it only does so in a “secure manner” and with the “promise” from the third party that it keeps that data “confidential and use it only for the purpose of carrying out the functions we have engaged it to perform,” its privacy statement reads.

But Ashkan Soltani, a technology consultant who says he performed a privacy audit for the ACLU last summer, said the practice goes against everything that the ACLU stands for.

“These relationships fly against the principles and public statements of the ACLU regarding transparency, control, and disclosure before use, even as the organization claims to be a strong advocate for privacy rights at the federal and state level,” Soltani tweeted on Friday after drawing public attention to the ACLU’s latest privacy policy disclosure.

The ACLU said it shares information with Facebook because its members are more likely to get their news and take action from posts on Facebook and other digital services rather than after reading mail or newsletters.

“The ACLU must often work with companies that we are actively challenging to improve their own policies and practices,” the organization said in a statement. “We mitigate [Facebook’s] dangers by turning over only that data … necessary to reach our constituents on its platform.”

The group said that users can now opt out of having their data shared with third parties. It didn’t directly address why it waited until now to tell users about the data sharing.

The news about the data sharing comes as the ACLU, which pitches itself as a defender of personal freedoms, continues to strongly champion Internet privacy. The organization regularly criticizes corporations for “spying” on their users. It also has publicly condemned Facebook for leaving data for up to 87 million users vulnerable to being taken by data analytics firm Cambridge Analytica ahead of the 2016 U.S. presidential election. 

The ACLU has spent more than $5 million in Facebook ads since May 2018, according to data from Facebook’s ad library, a searchable repository of ads on the service. Over the same period, the organization has spent an addition $500,000 on more than 1,100 Google ads. 

Catherine Crump, director of the Samuelson Law, Technology & Public Policy Clinic at the University of California at Berkeley School of Law, suggested that the ACLU’s financial staff is responsible for the data sharing and not the organization’s legal team, which litigates privacy cases. The two groups don’t always work in tandem, said Crump, a former ACLU attorney, according to her LinkedIn profile.

“There was always a tension between what happened on the 17th floor (where the advocacy lawyers were) and what happened on the 18th and 19th floors (where the finance people were located),” Crump tweeted on Friday. “I’m not terribly surprised by that part.” 

For several years, the ACLU has made digital privacy part of its mission. On its website, the group, for example, criticizes how corporations use people’s data, saying companies “sell to the highest bidder.”

“We shouldn’t have to choose between using new technologies and keeping our personal information private,” the ACLU website says about privacy. “The ACLU works to promote a future where technology can be implemented in ways that protect civil liberties, to limit the collection of personal information, and to ensure that individuals have control over their private data.”