FTC Targets Kochava Over Sensitive Location Data Sales

The proposed order would require affirmative consent before sensitive mobile location data can be sold, shared or disclosed.

WASHINGTON - The Federal Trade Commission said Monday it will prohibit Idaho data broker Kochava and subsidiary Collective Data Solutions from selling, sharing or disclosing sensitive location data without consumers' affirmative express consent, resolving litigation the agency filed in 2022.

The case turns on a technical but familiar data chain. The FTC said mobile location feeds can combine device identifiers with timestamped latitude and longitude points, allowing buyers to trace where a device sleeps at night, where it works during the day and whether it appears at clinics, places of worship, shelters or addiction recovery facilities.

The proposed stipulated order was filed in the U.S. District Court for the District of Idaho, according to the FTC. The commission said the vote approving the order was 2 to 0. The order still needs approval and a district judge's signature before it has force of law, according to the agency's own notice on stipulated final orders.

The Story So Far

The FTC sued Kochava in August 2022, alleging the company bought location information derived from hundreds of millions of mobile devices and packaged it into customized feeds. The agency said those feeds matched unique mobile device identification numbers with timestamped latitude and longitude locations.

According to the FTC's 2022 release, Kochava said the feeds could help clients with advertising and store foot traffic analysis. The agency alleged the same feed structure could also let purchasers identify and track specific mobile devices over time, especially when a nighttime location could be linked to a home address through property records.

The agency framed the risk around sensitive places, not ordinary ad targeting. In the original 2022 release, the FTC said the data could show visits to reproductive health clinics, places of worship, homeless shelters, domestic violence shelters and addiction recovery centers. The FTC's second amended complaint said Kochava's alleged FTC Act violations involved acquiring and using consumers' sensitive identifying information and disclosing it to third parties.

Kochava did not appear to have a public statement on its press page as of May 8, according to the research brief. The proposed order names Collective Data Solutions as the subsidiary that has taken over Kochava's data broker business.

What's Happening Now

Under the proposed order, the FTC said Kochava and Collective Data Solutions would be barred from selling, licensing, transferring, sharing or disclosing sensitive location data in any product or service unless they obtain a consumer's affirmative express consent and use the data to provide a service directly requested by the consumer.

The order would also require a sensitive location data program, according to the FTC. That program would require the companies to develop a comprehensive list of sensitive locations intended to prevent the sale, transfer or disclosure of data tied to those places.

The FTC said the companies must implement a supplier assessment program designed to confirm that consumers provided consent for the collection and use of all location data obtained by Kochava or the subsidiary. The companies would also have to submit incident reports to the FTC when they determine a third party shared consumers' precise location data in violation of contractual requirements.

The consumer side of the order is unusually concrete. The FTC said consumers would be allowed to request the names of any business or individual known to have received their precise location data, withdraw consent for the sale of their device's precise location data and benefit from a data retention schedule that deletes data on a set timeframe.

The Mechanism

Precise location feeds are more revealing than ordinary demographic ad segments because they carry time and place together. The FTC said Kochava's feeds matched mobile device identifiers with timestamped latitude and longitude coordinates. A single dot may not identify a person, but a repeated overnight cluster can suggest a home address, and a weekday cluster can suggest a workplace.

That is the reidentification problem. The FTC's 2022 release said a nighttime device location could be combined with property records to uncover an identity. Once a buyer can connect a device to a likely person, visits to sensitive places become personal information rather than anonymous movement patterns.

The proposed order tries to interrupt the chain in several places. Affirmative express consent would govern the consumer side. Supplier assessments would govern upstream collection. Sensitive location lists and product restrictions would govern packaging and resale. Incident reports would give the FTC notice if a downstream party shared data against contractual limits.

The approach does not ban all location data uses. According to the FTC, the restriction applies to sensitive location data in products or services unless consent is obtained and the data is used to provide a service directly requested by the consumer. That distinction matters for navigation, delivery, weather, fraud prevention and other functions where a consumer asks an app to use location for a specific purpose.

The Conservative View

A conservative privacy argument can support the order on property, family and religious liberty grounds. The FTC's 2022 release said the data could reveal visits to churches, reproductive health clinics and shelters. For conservatives who view home life, worship and medical decisions as private domains, the allegation is that an invisible data market exposed those domains without a clear consumer choice.

A conservative business argument cuts the other way. The FTC said Kochava described the feeds as useful for advertising and foot traffic analysis. Business advocates often argue that federal privacy restrictions should be clear enough for companies to build compliance systems before enforcement begins. The Kochava matter illustrates why the definition of sensitive location data, consent and downstream use matters for adtech companies, retailers and analytics firms.

The Progressive View

Progressive privacy advocates are likely to view the settlement as a minimum safeguard for consumers who cannot realistically audit the mobile data supply chain. The FTC alleged consumers were unaware of the collection and disclosure and had no way to avoid resulting harm. The agency also linked the data to risks including stigma, stalking, discrimination, job loss and physical violence.

The progressive concern is strongest around health care, domestic violence and addiction treatment. The FTC's 2022 release said the data could identify people who visited reproductive health clinics, domestic violence shelters and recovery centers. In that view, consent is not a paperwork step. It is the line between a consumer using a phone and a broker monetizing a record of where that phone has been.

Other Perspectives

The advertising industry's self regulatory layer has moved in the same direction, at least for companies that voluntarily join it. The Network Advertising Initiative says its Precise Location Information Solution Provider Voluntary Enhanced Standards prohibit the use, sale and transfer of U.S. consumer precise location information related to sensitive points of interest. NAI says the standards also restrict participating companies from using, selling or sharing U.S. consumer precise location information for law enforcement or national security purposes except when required by law.

The gap is enforceability. NAI says the enhanced standards apply only to member companies that voluntarily commit to them and participate in annual accountability reviews. The FTC order, if approved by the court, would bind Kochava and Collective Data Solutions as a legal obligation.

Economic Implications

The order lands inside a digital advertising market that remains heavily dependent on measurement, attribution and automated buying. IAB said its 2025 Internet Advertising Revenue Report, conducted by PwC, measured $294.6 billion in U.S. internet advertising revenue in 2025, up 13.9 percent from 2024. IAB also said programmatic advertising reached $162.4 billion in 2025, up 20.5 percent from the prior year.

Those numbers do not mean all digital advertising depends on precise location data. They do show why data governance rules have economic weight. If courts and regulators require stronger consent, supplier reviews, retention schedules and sensitive place filtering, data brokers and advertisers face higher compliance costs and narrower resale channels for location products tied to health care, worship, shelters and other protected categories.

For retailers and app developers, the mechanism is practical. Foot traffic measurement and location based audience products can still operate when the data is consented, limited and filtered. The proposed order raises the cost of proving that chain. Companies that cannot show consent, supplier diligence and downstream controls may lose access to products that were previously sold as broad location feeds.

By the Numbers

• 2 to 0: FTC vote approving the proposed stipulated final order, according to the agency.
• Hundreds of millions: mobile devices allegedly covered by Kochava's location data, according to the FTC.
• More than 61 million: unique mobile devices in a Kochava data sample the FTC said it examined in 2022.
• $294.6 billion: U.S. internet advertising revenue in 2025, according to IAB and PwC.
• $162.4 billion: U.S. programmatic advertising revenue in 2025, according to IAB and PwC.

What People Are Saying

"The Federal Trade Commission will prohibit data broker Kochava and its subsidiary from selling, sharing or disclosing sensitive location data without consumers' affirmative express consent to settle allegations the companies sold location data from hundreds of millions of mobile devices that could be used to trace the movements of individuals." - Federal Trade Commission, May 4, 2026

"Where consumers seek out health care, receive counseling, or celebrate their faith is private information that shouldn't be sold to the highest bidder." - Samuel Levine, then director of the FTC Bureau of Consumer Protection, Aug. 29, 2022

"This revenue growth reflects a market that has reoriented around performance channels. As expectations for measurable outcomes rise, investment is concentrating in areas that can directly correlate spend to business results." - David Cohen, CEO of IAB, April 16, 2026

"The lesson of our 30-year history is that measurement, standards, and interoperability, as mundane as those things can sometimes sound, are what got this industry from zero to just shy of $300 billion." - David Cohen, CEO of IAB, April 16, 2026

The Big Picture

The Kochava settlement shows how U.S. privacy enforcement is being built case by case while Congress has not enacted a comprehensive federal privacy statute. The FTC is using unfairness and deception authority to police a data broker layer most consumers never see, while industry groups use voluntary standards and companies build compliance programs around state laws, app platform rules and enforcement orders.

The next step is judicial approval. If the District of Idaho approves the stipulated order, Kochava and Collective Data Solutions would face a court backed consent framework for sensitive location data. For the wider market, the signal is that precise location data tied to sensitive places now carries litigation, compliance and product design risk that ordinary ad segments do not.