Apple’s Safari browser has a default setting that blocks websites from setting third-party cookies that can be used to track users’ browsing behavior. But for about nine months in 2011-2012, Google’s DoubleClick ad serving service was able to get around that roadblock in order to provide user-specific ads to people with Apple computers and, more importantly, users of iPhones and iPads. Google has already been hit with a $22.5 million federal penalty, and today it has agreed to settle a multi-state claim for an additional $17 million.

The Attorneys General involved in the complaint allege that Google violated various state consumer protection laws when it failed to notify consumers that it had found a way to circumvent Safari’s default settings. The states also took issue with Google’s earlier public assurances that Safari did not, by default, allow third-party cookies.

In addition to the states that will divvy up the $17 million payout, Google has pinky-swore to the following:

1. It will not deploy the type of code used in this case to override a browser’s cookie blocking settings without the consumer’s consent unless it is necessary to do so in order to detect, prevent or otherwise address fraud, security or technical issues.

2. It will not misrepresent or omit material information to consumers about how they can use any particular Google product, service, or tool to directly manage how Google serves advertisements to their browsers.

3. It will improve the information it gives consumers regarding cookies, their purpose, and how the cookies are managed by consumers using Google’s products or services and tools.

The action was led by a 10-state executive committee with the Attorneys General offices of Connecticut, Florida, Illinois, Ohio, Maryland, New Jersey, New York, Texas, Vermont and Washington.

Also included in the agreement: Alabama, Arizona, Arkansas, California, District of Columbia, Indiana, Iowa, Kansas, Kentucky, Maine, Massachusetts, Michigan, Minnesota, Mississippi, Nebraska, Nevada, New Mexico, North Carolina, North Dakota, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Virginia, and Wisconsin.

“Consumers should be able to know whether there are other eyes surfing the web with them. By tracking millions of people without their knowledge, Google violated not only their privacy, but also their trust,” New York Attorney General Eric Schneiderman said in a statement. “We must give consumers the reassurance that they can browse the Internet safely and securely.”

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.