In clear violation of Instagram's rules, the San Francisco-based marketing firm Hyp3r was able to operate under the radar for the past year as one of the company's preferred "Facebook Marketing Partners."

"HYP3R's actions were not sanctioned and violate our policies. As a result, we've removed them from our platform. We've also made a product change that should help prevent other companies from scraping public location pages in this way," said an Instagram spokesperson, following a Wednesday cease-and-desist letter sent to the Hyp3r. 

The existence of the profiles is a stark indication that more than a year after revelations that Facebook users' data was exploited by Cambridge Analytica to fuel divisive political ad campaigns, Facebook's struggles in locking down users' personal information not only persist but also extend beyond the core Facebook app. Instagram, which is owned by Facebook but operated as a mostly separate business, has been largely insulated from the privacy backlash and scrutiny that has rocked its parent company.