FTC Bans Data Broker Kochava From Selling Sensitive Location Data Without Consent, Closing a Four-Year Case

Overview

The Federal Trade Commission on May 4, 2026 filed a proposed settlement in U.S. District Court for the District of Idaho that would permanently ban Idaho-based data broker Kochava Inc. and its subsidiary Collective Data Solutions (CDS) from selling precise location data without consumers’ affirmative express consent. The proposed order resolves a lawsuit filed nearly four years ago and represents the most significant U.S. enforcement action against a location data broker to date, according to Privacy Guides.

The FTC Commission voted 2-0 in favor of the settlement, according to AdExchanger. The order is subject to court approval before becoming binding.

What We Know

The Case

The FTC sued Kochava in August 2022, alleging the company had “collected and sold precise geolocation data from hundreds of millions of mobile devices” without consumers’ knowledge or permission, per Bleeping Computer. The agency alleged the data revealed visits to mental health and addiction recovery facilities, reproductive health clinics, places of worship, and shelters for the homeless and domestic violence survivors — exposing consumers to “stalking, discrimination, and physical violence.”

Kochava’s own marketing described a data feed delivering “raw latitude/longitude data with volumes around 94B+ geo transactions per month, 125 million monthly active users, and 35 million daily active users,” per Bleeping Computer. The company offered data access via AWS Marketplace for a “$25,000 subscription fee.”

The lawsuit, Case No. 2:22-cv-00377-BLW, faced early setbacks: a federal judge initially dismissed the complaint in 2023 without prejudice, allowing the FTC 30 days to strengthen its case. The FTC filed an amended complaint in June 2023. In 2024, U.S. District Judge B. Lynn Winmill denied Kochava’s motion to dismiss, writing that the company had allegedly provided “vast amounts of essentially non-anonymized information” and that the “alleged invasion of privacy…plausibly constitutes a ‘substantial injury’ to consumers,” per the HIPAA Journal.

The Settlement Terms

Under the proposed order, Kochava and CDS are permanently prohibited from selling, licensing, transferring, or disclosing sensitive location data unless they obtain “a freely given, specific, informed, and unambiguous indication of agreement” from consumers, per PPC.land. The consent must be obtained through a standalone, plain-language disclosure entirely separate from any privacy policy or terms of service. Consent obtained via “hovering over, muting, pausing, or closing a piece of content” is explicitly prohibited.

The order covers five categories of sensitive locations: medical facilities, religious organizations, education and childcare providers, temporary shelters or social services for homeless people and domestic violence survivors, and military or federal law enforcement installations, per PPC.land.

Key compliance requirements include:

• A Sensitive Location Data Program, due within 90 days, requiring senior officer oversight with board reporting and quarterly accuracy assessments
• A Supplier Assessment Program verifying that third-party data suppliers obtained valid consumer consent before selling data to Kochava
• Deletion timelines: non-consented sensitive data must begin deletion within 2 days and complete within 30 days
• Consumer rights: individuals may request the names of businesses that received their location data and withdraw consent at any time
• Data retention schedules published on the company website, with indefinite retention explicitly prohibited
• An incident reporting requirement obliging the companies to notify the FTC within 30 days if third parties misuse location data

The order runs for 10 years from the date of court entry. No financial penalty was imposed, according to The Record.

Kochava’s Response

Kochava stated it is “pleased” with the settlement, describing it as formalizing “safeguards around privacy and compliance,” per The Record. The company previously told regulators it “has always operated consistently and proactively in compliance with all rules and laws, including those specific to privacy,” per HIPAA Journal.

Kochava had countersued the FTC but separately pledged to introduce a “Privacy Block” feature blocking sensitive location collection, per Privacy Guides.

Industry Context

The Kochava action is the latest in a sustained FTC enforcement campaign targeting location data brokers. In 2024, the agency banned InMarket Media, Outlogic (formerly X-Mode Social), Gravy Analytics, and Mobilewalla from selling or licensing precise location data in actions built around nearly identical legal theories, per Bleeping Computer and Privacy Guides. The Kochava settlement replicates the structural template of the January 2024 InMarket order.

The FTC’s enforcement posture has grown progressively more explicit about the privacy risks of anonymization workarounds: in July 2024, the agency warned that “hashed data is not anonymous,” and in November 2024 it cautioned that data clean rooms are “not a privacy silver bullet,” per PPC.land.

The FTC’s enforcement program rests on the principle that “precise location data is inherently sensitive,” per the National Law Review. The original 2022 lawsuit was filed in the immediate aftermath of the Supreme Court’s decision to overturn Roe v. Wade, reflecting regulator concern that commercially available location data could be used to identify and prosecute individuals seeking reproductive healthcare, per HIPAA Journal.

What We Don’t Know

It remains unclear whether and when U.S. District Judge Winmill will formally enter the consent order, triggering the 10-year term and 90-day compliance deadlines. The absence of any financial penalty — despite nearly four years of litigation — has drawn implicit criticism from industry observers, who note the FTC is currently operating with only two commissioners. Whether the enforcement template established across these data broker cases will be formalized into a federal data broker statute through Congress remains an open legislative question.