FTC Order Would Force Consent Gate on Kochava Location Data

The proposed court order would make sensitive mobile location records a consent-gated product, not broadly transferable ad data.

WASHINGTON, D.C. - The Federal Trade Commission filed a proposed court order that would bar Kochava and its subsidiary Collective Data Solutions from selling or sharing sensitive location data without affirmative consumer consent, according to the FTC's May 4 filing in FTC v. Kochava.

The settlement would end a case the FTC brought in 2022 over allegations that Kochava sold precise mobile location feeds tied to hundreds of millions of devices. The order is not final until U.S. District Judge B. Lynn Winmill approves and signs it, according to the FTC's case notice.

The stakes are bigger than one Idaho company. If approved, the order would force a part of the mobile advertising data market to treat visits to health facilities, places of worship, shelters, and recovery centers as restricted information that cannot move through commercial channels unless the consumer affirmatively agreed to that use.

The Story So Far

The FTC sued Kochava in the U.S. District Court for the District of Idaho in August 2022. The agency alleged that Kochava bought location information derived from hundreds of millions of mobile devices and packaged it into customized feeds that matched unique mobile device identifiers with timestamped latitude and longitude records.

The FTC's 2022 complaint said the data could allow purchasers to infer a person's home, routine, and visits to sensitive locations. The agency said its sample included precise, timestamped location data from more than 61 million unique mobile devices in the previous week.

Kochava pushed back after the original lawsuit. In an open letter, CEO Charles Manning said the FTC matter concerned Kochava's data marketplace, not its measurement services business, and said Kochava sourced precision geolocation data in that marketplace from outside partners rather than from the Kochava software development kit.

Manning also argued that the agency had not given the industry enough detail about what counts as a sensitive location. Kochava announced a Privacy Block product before the FTC sued, according to the company's letter, and said the tool was meant to block location data around sensitive places from its data marketplace.

The case has remained pending on the FTC's case page. The May 4 proposed stipulated order would resolve the litigation if the court enters it, according to the FTC.

What's Happening Now

The proposed order would prohibit Kochava and Collective Data Solutions from selling, licensing, transferring, sharing, or disclosing sensitive location data in any product or service unless they obtain affirmative express consent and use the data to provide a service directly requested by the consumer, according to the FTC release and proposed order summary.

The FTC said Collective Data Solutions has taken over Kochava's data broker business. The proposed order would apply to Kochava if it sells or uses precise location data, according to the FTC.

The order also would require a sensitive location data program, a supplier assessment program, incident reports to the FTC when the companies determine a third party shared precise location data in violation of contractual terms, a consumer access mechanism, consent withdrawal tools, and a data retention schedule, according to the FTC's May 4 announcement.

The Commission vote approving the stipulated final order was 2-0, according to the FTC. The agency said stipulated final orders carry the force of law once a district court judge approves and signs them.

The Conservative View

The business and limited-government argument centers on rulemaking by litigation. Kochava's 2022 open letter said the company agreed that blocking sensitive locations was a good idea, but argued that the FTC had not provided a specific list of sensitive locations or a clear standard that data providers could follow.

That argument matters for companies that buy data from many suppliers. If a regulator defines sensitive location data through case settlements rather than detailed rules, ad tech firms, analytics vendors, app publishers, and data buyers must build compliance programs around enforcement signals that may not map neatly onto every product line.

Kochava also rejected the FTC's framing of actual harm. Manning wrote that the FTC's lawsuit was based on hypothetical scenarios and said the agency had not identified specific instances where Kochava sold data to reveal visits to sensitive locations.

The Progressive View

The consumer-protection argument is that precise location records can reveal intimate facts even when a dataset does not contain a person's name. The FTC's complaint said a device's nighttime location can point to a home address and can be combined with property records to identify the user.

Progressive privacy advocates generally favor treating sensitive location data as information that requires affirmative consent because the consumer often does not see the full chain from app permission to brokered data feed. The FTC made the same mechanism central to its complaint, saying consumers were often unaware that their location data was being purchased and shared and had no control over its sale or use.

Samuel Levine, then director of the FTC's Bureau of Consumer Protection, framed the original lawsuit as a safety issue, not only a privacy dispute. He said in 2022 that places where consumers seek health care, counseling, or worship should not be sold to the highest bidder.

Other Perspectives

Advertisers, retailers, and app publishers sit in the middle. Kochava's open letter said the company's measurement tools help brands and publishers understand whether advertising works across mobile, connected TV, display, and traditional TV.

The money behind that measurement market is large. IAB's Internet Advertising Revenue Report for full year 2025 said U.S. digital advertising revenue reached nearly $300 billion, up 13.9% from the prior year. The Kochava order would not regulate that full market, but it would add new constraints to one input that advertisers and analytics firms use for foot traffic measurement, audience segmentation, and attribution.

For consumers, the practical question is whether an app permission screen reflects the downstream use of location data. The FTC's proposed order would answer that question by requiring affirmative express consent before sensitive location data can be sold or shared, and by requiring a way to withdraw consent for the sale of precise location data.

Economic Implications

The direct business impact falls on data supply and compliance costs. If the order is approved, Kochava and Collective Data Solutions would have to run supplier assessments to confirm consumer consent, maintain a sensitive location data program, report certain third party contract violations to the FTC, and delete data under a retention schedule, according to the FTC's order summary.

That changes the economics of sensitive location data. A broker that once treated precise device movement records as transferable inventory would need to verify consent upstream, restrict sensitive-location uses, and maintain downstream controls. Those requirements can raise vendor review costs, reduce available inventory, and make buyers prove that a use is tied to a consumer-requested service.

The broader signal reaches beyond Kochava because the FTC is using Section 5 unfairness theory against commercial surveillance practices. The agency's alleged mechanism is specific: app-derived location records become timestamped device feeds, those feeds can be linked to homes and routines, and the resulting profile can expose visits to sensitive locations. Companies that sell or buy similar feeds now have a regulatory reason to audit whether consent, retention, and sensitive-location suppression match the standard in the proposed order.

By the Numbers

• 2-0, the FTC vote approving the proposed stipulated final order, according to the agency's May 4 announcement.
• 2:22-cv-00377-BLW, the U.S. District Court for the District of Idaho case number for FTC v. Kochava.
• More than 61 million unique mobile devices, the size of the one-week data sample the FTC said it examined in its 2022 announcement.
• Hundreds of millions of mobile devices, the scale of location information the FTC alleged Kochava purchased and sold.
• Nearly $300 billion, U.S. digital advertising revenue in 2025, according to IAB's full year 2025 report.

What People Are Saying

"The Federal Trade Commission will prohibit data broker Kochava and its subsidiary from selling, sharing or disclosing sensitive location data without consumers' affirmative express consent to settle allegations the companies sold location data from hundreds of millions of mobile devices that could be used to trace the movements of individuals." - Federal Trade Commission, May 4 press release

"Where consumers seek out health care, receive counseling, or celebrate their faith is private information that shouldn't be sold to the highest bidder."

Samuel Levine, then director of the FTC's Bureau of Consumer Protection, August 2022 FTC announcement

"We are confident that the facts are both straightforward and on our side. Kochava operates consistently and proactively in compliance with all rules and laws, including those specific to privacy." - Charles Manning, Kochava CEO, open letter

"In the absence of specificity from the FTC on the definition of sensitive locations or a list of locations to be blocked, the industry is in a difficult place." - Charles Manning, Kochava CEO, open letter

The Big Picture

The proposed order would not become enforceable unless the district court approves it. Until then, the legal posture remains a pending settlement in a case where the FTC alleged unfair data practices and Kochava previously denied wrongdoing.

If the judge signs the order, the immediate compliance burden lands on Kochava and Collective Data Solutions. The wider business effect is that other companies handling precise location feeds will have a concrete FTC settlement to measure against their own supplier contracts, consent records, retention policies, and sensitive-location controls.

The next thing to watch is the court's approval. After that, the practical question becomes how quickly location-data sellers and buyers adjust their contracts and data flows before the FTC brings the same theory to another company.