FTC Finalizes Settlement Banning Kochava from Selling Sensitive Location Data
The Federal Trade Commission has reached a settlement with data broker Kochava, prohibiting the company from selling or sharing sensitive geolocation data without explicit consumer consent following a years-long legal dispute.
The Federal Trade Commission (FTC) has finalized a settlement with data broker Kochava and its subsidiary, Collective Data Solutions, effectively banning the company from selling, sharing, or disclosing sensitive geolocation data without obtaining explicit consumer consent The Record. This resolution concludes a legal battle initiated by the FTC in August 2022, which alleged that the firm engaged in unfair and deceptive practices by trafficking in highly granular personal information The Record.
The core of the FTC’s 2023 complaint centered on Kochava’s acquisition and sale of precise geolocation data—accurate within 10 meters—alongside mobile device IDs, app usage history, and annual income estimates The Record. The agency highlighted that the company’s data sets included sensitive movements, such as visits to health care clinics and houses of worship, which were tracked and sold without the knowledge or permission of the affected individuals The Record.
Under the terms of the proposed order, which does not include a monetary fine, Kochava is mandated to implement a "sensitive location data program" designed to catalogue and protect sensitive sites from being included in data sales The Record. Furthermore, the company must establish a "supplier assessment" program to verify that all location data it processes has been collected with valid consumer consent The Record. The broker is also required to maintain a strict data retention schedule, ensuring that consumer information is deleted within a predetermined timeframe The Record.
The settlement also introduces new transparency and control requirements for consumers. Kochava must provide individuals with the identities of any third parties that have purchased their precise location data and offer a mechanism for consumers to easily withdraw consent for future sales The Record. Additionally, the company is obligated to notify the FTC if it discovers that a third party has disclosed precise location data in a manner that violates the terms of the agreement The Record.
While this settlement formalizes new regulatory oversight, its practical impact may be limited by previous legal actions. Kochava had already committed to ceasing the sale of location data derived from software development kits (SDKs) as part of a class-action lawsuit settlement in November The Record. At that time, the company pledged to create an opt-out mechanism allowing users to delete their data and prevent future collection The Record. A spokesperson for Kochava stated the company is "pleased" to reach the settlement, framing it as a commitment to "responsible data practices" The Record.
This case underscores the ongoing regulatory focus on the data brokerage industry and the risks associated with the aggregation of granular mobile telemetry. By pursuing this litigation, the FTC has signaled a more aggressive stance toward companies that monetize sensitive movement patterns. Industry observers will likely watch how the FTC monitors compliance with these new "supplier assessment" and "data retention" mandates, as regulators continue to grapple with the privacy implications of the modern data economy The Record.