The technology company tracked users' locations despite them opting out, a US investigation found.