On May 4, 2026, the Federal Trade Commission announced that it will prohibit data broker Kochava and its subsidiary from selling, sharing or disclosing sensitive location data without consumers’ affirmative express consent to settle allegations the companies sold location data from hundreds of millions of mobile devices that could be used to trace the movements of individuals.
The FTC sued Idaho-based Kochava in August 2022 alleging that its collection, use and disclosure of precise location data invaded consumers’ privacy by revealing their movements, including visits to sensitive locations such as health facilities and places of worship. According to the author, the FTC alleged that because consumers were unaware of and did not consent to this data sharing, consumers had no way of avoiding the harm resulting from its collection and disclosure.
Under the proposed order resolving the FTC’s litigation, Kochava and its subsidiary, Collective Data Solutions (CDS), which has purportedly taken over Kochava’s data broker business, will be prohibited from selling, licensing, transferring, sharing or disclosing sensitive location data in any products or services unless they obtain a consumer’s affirmative express consent and the data is used to provide a service directly requested by the consumer.
The subsidiary and Kochava (if Kochava sells or uses precise location data) also are required to:
- Establish and implement a sensitive location data program to develop a comprehensive
list of sensitive locations to prevent the sale, transfer or disclosure of sensitive location
data; - Implement a supplier assessment program designed to confirm that consumers have
provided consent for the collection and use of all location data obtained by the subsidiary
or Kochava; - Submit incident reports to the FTC when the companies determine a third party shared
consumers’ precise location data in violation of contractual requirements; - Allow consumers to request the names of any business or individual to which CDS or
Kochava has knowledge that consumers’ precise location data was sold, and provide
consumers with an easy way to withdraw consent for the sale of their device’s precise
location data; and - Create a data retention schedule that will require the deletion of data on an established
timeframe.
The Commission vote approving the stipulated final order was 2-0. The FTC filed the proposed order in the U.S. District Court for the District of Idaho.
