Social media giant Twitter agreed to a $150 million settlement with the Department of Justice (DOJ) and Federal Trade Commission (FTC) on Wednesday for violating a 2011 administrative order by “misrepresenting” how it used nonpublic user information.

According to a complaint filed in the U.S. District Court for the Northern District of California, from May 2013 to September 2019, Twitter violated the FTC Act by misrepresenting the “controls it implemented to keep user accounts secure” after prompting users for phone numbers and emails for two-factor authentication. The company, in turn, allegedly used that data for targeted advertising without consent.