Google has agreed to a $391.5 million settlement with 40 states -- including New York, New Jersey and Connecticut -- in connection with an investigation into how the company tracked users’ locations, state attorneys general announced Monday, calling it the largest multistate privacy settlement in U.S history.

The investigation by the states, which officials said was spurred by a 2018 Associated Press story, found that Google continued to track people’s location data even after they opted out of such tracking.

“This $391.5 million settlement is a historic win for consumers in an era of increasing reliance on technology. Location data is among the most sensitive and valuable personal information Google collects, and there are so many reasons why a consumer may opt-out of tracking,” Connecticut Attorney General William Tong said in a statement. Connecticut will receive more than $6.5 million from the settlement.

The AP reported that many Google services on Android devices and iPhones store your location data even if you’ve used a privacy setting that says it will prevent Google from doing so. Computer-science researchers at Princeton confirmed these findings at the AP’s request.

Storing such data carries privacy risks and has been used by police to determine the location of suspects.

The AP reported in 2018 that the privacy issue with location tracking affected some two billion users of devices that run Google’s Android operating software and hundreds of millions of worldwide iPhone users who rely on Google for maps or search.

The attorneys general who investigated Google said a key part of the company’s digital advertising business is location data, which they called the most sensitive and valuable personal data the company collects. Even a small amount of location data can reveal a person’s identity and routines, they said.

Google uses the location information to target consumers with ads by its customers, the state officials said.

The attorneys general said Google misled users about its location tracking practices since at least 2014, violating state consumer protection laws.

As part of the settlement, Google also agreed to make those practices more transparent to users, including showing them more information when they turn location account settings on and off and keeping a webpage that gives users information about the data Google collects.

"Our investigation found that Google continued to collect this personal information even after consumers told them not to. That is an unacceptable invasion of consumer privacy, and a violation of state law,” Tong's statement went on to say. “People deserve to have greater control over—and understanding of—how their data is being used."

In May of this year, Connecticut passed the Connecticut Data Privacy Act—one of the first comprehensive consumer privacy laws in the country, providing Connecticut consumers baseline privacy rights, including the right to access, delete, and stop the sale of their data. The Connecticut Data Privacy Act also requires companies to be transparent about how they use and secure data, as well as obtain consumer consent before collecting certain categories of sensitive information—including precise location data.

The attorneys general of Oregon and Nebraska led the settlement negotiations, assisted by Arkansas, Florida, Illinois, Louisiana, New Jersey, North Carolina, Pennsylvania, and Tennessee. The final settlement was also joined by Alabama, Alaska, Colorado, Delaware, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Nevada, New Mexico, New York, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Utah, Vermont, Virginia, and Wisconsin. Connecticut also joined.