New York’s attorney general is opening an investigation into Facebook’s unauthorized collection of 1.5 million users’ email contacts without their permission.

The email harvest may have exposed hundreds of millions of people to targeted advertising by the embattled social-media company, New York Attorney General Letitia James said Thursday in a statement.

The practice, which was uncovered by Business Insider last week, was a result of Facebook’s email password verification process for new users—a process that’s standard for online services like Facebook, James said. Facebook’s procedure, however, asked some users to hand over the password to their personal email account.

In some cases, Facebook accessed those user’s contacts and uploaded the information “to be used for targeted advertising,” the attorney general said.

“It is time Facebook is held accountable for how it handles consumers’ personal information,” James said. “Facebook has repeatedly demonstrated a lack of respect for consumers’ information while at the same time profiting from mining that data.”

“We’re in touch with the New York State attorney general’s office and are responding to their questions on this matter,” a spokeswoman for Facebook said. The New York Times reported the investigation Thursday.

In January, James opened an investigation of Apple under the state’s consumer-protection laws for failing to alert users to a bug that allowed some users of its FaceTime video-chat service to listen in on people they contacted even before the person accepted or rejected the call.

Facebook has been working to address concerns by lawmakers and regulators about how it protects users’ data. On Wednesday, Facebook estimated it will cost as much as $5 billion to resolve a Federal Trade Commission investigation into triggered by Cambridge Analytica, a now-defunct British political consultancy which had ties to Donald Trump’s presidential campaign obtained the data of millions of Facebook users without their consent.

Separately, Facebook is in advanced talks with a group of states to resolve investigations into whether the Cambridge Analytica incident violated local consumer-protection laws, people familiar with the matter have said.