Google has agreed to pay nearly $392 million in a settlement with 40 states over allegations that the company tracked people through their devices after location tracking had been turned off, a coalition of state prosecutors announced on Monday.

Authorities said, since at least 2014, Google broke consumer protection laws by misleading users about when it secretly recorded their movements. It then offered the surreptitiously harvested data to digital marketers to sell advertisements, the source of nearly all of Google’s revenue.

“For years Google has prioritized profit over their users’ privacy,” said Oregon Attorney General Ellen Rosenblum, who led the probe along with Nebraska. “They have been crafty and deceptive.”

Attorneys general say the payout is the largest-ever multistate privacy settlement.

Location data, often obtained by law enforcement in criminal investigations to identify suspects, is an important part of Google’s advertising business. State investigators called it “the most sensitive and valuable personal information Google collects,” noting that it helps target people with ads based on their vicinity.

As part of the deal, Google committed to a number of changes that will make the company’s location-tracking practices more clear, including showing users more information when they turn location tracking on or off and providing a detailed rundown of the location data Google routinely collects on a webpage consumers can access.

A spokesman for Google said in a statement to NPR that the practices outlined by prosecutors are old and have since been revamped.

“Consistent with improvements we’ve made in recent years, we have settled this investigation which was based on outdated product policies that we changed years ago,” said Google Spokesperson José Castañeda.

In a blog post following the settlement, Google said it now allows people to use Google Maps in so-called Incognito mode, preventing location data from being saved on someone’s account.

The states’ settlement over online privacy comes while lawmakers in Washington dither on passing a comprehensive data privacy legislation in the U.S.

Despite support from both parties for passing a national privacy law, Congress has failed to act, lagging behind data protection laws in Europe.

That has left individual states to pass their own online privacy protections. Five states, California, Colorado, Connecticut, Utah and Virginia, have enacted comprehensive consumer data privacy laws, according to the National Conference of State Legislatures.

State prosecutors used Monday’s settlement to call on lawmakers in Washington to pass nationwide data protections.

“Until we have comprehensive privacy laws, companies will continue to compile large amounts of our personal data for marketing purposes with few controls,” Oregon AG Rosenblum noted in a statement.

The state prosecutors said they launched the investigation after reporting by the Associated Press in 2018 revealed that many Google services on Android devices and iPhones kept saving users’ location data even after location tracking had been turned off in privacy settings.

Last month, Google settled a lawsuit with authorities in Arizona for $85 million stemming from similar allegations that the tech giant deceptively deployed location tracking on phones in order to provide advertisers with data on consumers.