The Federal Trade Commission came down hard on a mobile ad firm on Wednesday after ruling that the business deceptively tracked hundreds of millions of consumers, including children.
The firm, Indian-based InMobi, runs an ad network that reaches one billion devices, competes with Facebook and Google for mobile ads, and was rumored to the target of a Microsoft acquisition earlier this year.
According to the FTC, InMobi tracked consumers’ locations without permission in order to place ads, and even ignored those who explicitly told them not to do this. The tracking involved blending information from consumer profiles and the location of the wireless networks they used to connect their phones.
Even by the often fast-and-loose standards of online advertising, the company’s behavior was egregious:
“InMobi created a database built on information collected from consumers who allowed the company access to their geolocation information, combining that data with the wireless networks they were near to document the physical location of wireless networks themselves,” said the FTC in a statement.
Get Data Sheet, Fortune’s technology newsletter.
In response, the agency sued the company in San Francisco federal court, and extracted a settlement that will force it to pay $950,000. The actual terms of the settlement require a $4 million penalty, but the agency suspended the full amount due to the “company’s financial condition.”
InMobi is also obliged to delete all the location information it collected, and to honor consumers’ privacy settings. It will also be required to a implement a privacy program that will be subject to a 20-year oversight by the FTC.
In an email statement to Fortune, an InMobi spokesperson said the collection of children’s information was inadvertent, and that the company notified the FTC after discovering a “technical error.”
While the FTC regularly smacks down ad companies for privacy violations, the large financial penalty is unusual since the agency does not have the authority to fine companies for first-time offenses under its power to regulate “unfair and deceptive” trade practices.
Instead, the reason InMobi must pay is because it tripped over a separate law called the Children’s Online Privacy Protection Act, which provides stiff penalties for companies that wrongly collect information about kids.
The FTC investigation may explain why Microsoft declined to acquire the company despite widespread rumors earlier this year.
It has been a rough stretch for InMobi, which was once hailed as an “Indian unicorn” and a darling of the startup scene, and has been backed by big league investors like Kleiner Perkins. Earlier this spring, it laid off staff as part of a plan to move towards profitability.
(Updated at 1:30PM ET to include InMobi response)
