FTC settlement bars Kochava from selling precise location data without consent

The FTC has reached a proposed settlement with Idaho-based data broker Kochava and its subsidiary Collective Data Solutions, ending a four-year case that began in August 2022. Kochava had been selling precise geolocation data from hundreds of millions of mobile devices through an AWS Marketplace feed priced at a $25,000 subscription, advertising over 94 billion geo transactions per month. The data could be used to track individuals to mental health clinics, reproductive health facilities, places of worship, and domestic violence shelters — without affected consumers’ knowledge or consent.

Under the proposed order, Kochava and CDS are barred from selling, licensing, or transferring precise location data unless they obtain affirmative express consent tied to a service the consumer actually requested. They must also stand up a sensitive-location data program, audit suppliers for valid consent, give consumers visibility into who received their data and the ability to withdraw consent, report third-party misuse to the FTC, and adopt formal retention and deletion schedules.

The settlement extends a broader FTC enforcement pattern against location-data brokers, following 2024 actions against InMarket Media, Outlogic, Gravy Analytics, and Mobilewalla. It signals that the agency now treats sensitive-location resale as a default-prohibited activity rather than a disclosure problem, raising the compliance bar for the entire ad-tech and mobile SDK supply chain.