I think in this case it's made worse by the wording "selling X Y" as a substitute for "selling Y to X" being relatively rare and in this case both X and Y being compound words (surveillance company and user data).
So not only is it a crash blossom in the sense that it's ambiguous whether it's [surveillance] [company user data], [surveillance company] [user data] or [surveillance company user] [data], but it could also be read as [surveillance company user data]. There are at least four possible ways to attempt to parse the sentence and the only one that makes sense relies on unusual phrasing.
ACLU exposes Facebook and Twitter for selling user data to a surveillance company
The way I read it the first few times I thought they sold user data of a company, for surveillance.