The U.S. Federal Trade Commission announced a proposed court order on May 5, 2026 banning Idaho-based data broker Kochava, Inc. and its subsidiary Collective Data Solutions from selling consumers’ precise location data without explicit consumer consent. The order follows a lawsuit the FTC filed against Kochava in August 2022, in which the agency alleged that Kochava collected and sold location data drawn from hundreds of millions of mobile devices — processing more than 94 billion geolocation transactions per month — exposing individuals to risks including stalking, harassment, and physical violence by enabling tracking to sensitive locations such as reproductive health clinics, domestic violence shelters, and places of worship.
FTC’s Lawsuit Against Kochava: 94 Billion Monthly Location Transactions from Hundreds of Millions of Devices
The FTC’s August 2022 complaint alleged that Kochava aggregated precise latitude and longitude data from hundreds of millions of mobile devices and made that data available to clients through a subscription service priced at $25,000 for raw geolocation data access. The agency’s complaint characterized the data’s availability as a direct physical safety risk — not merely a privacy concern — because the precision of the location records was sufficient to identify when an individual visited a reproductive health clinic, domestic violence shelter, mental health facility, or place of worship.
The FTC alleged that the commercial availability of this data meant that private actors could purchase the records and use them to surveil, track, and target individuals based on their visits to sensitive locations, without any court order, law enforcement authorization, or consent from the individuals being tracked.
Sensitive Locations Tracked: Reproductive Health Clinics, Domestic Violence Shelters, Places of Worship
The FTC’s complaint specifically identified the following categories of sensitive locations for which tracking data was commercially available through Kochava’s subscription product:
- Reproductive health clinics
- Domestic violence shelters
- Places of worship
- Mental health facilities
The agency’s framing of the case centered on physical safety risks — the argument that commercially purchased location data from these categories of visits could enable harassment campaigns, domestic abuse facilitation, and targeted violence against individuals identified through their location patterns.
Settlement Terms: Sales Ban, Consent Requirements, and Mandatory Data Handling Program
The proposed court order includes several binding requirements for Kochava and Collective Data Solutions:
- Sales ban: Prohibition on selling location data without explicit consumer consent
- Sensitive location data program: Mandatory internal program governing the collection, use, and retention of data associated with sensitive location categories
- Consumer disclosure and opt-out rights: Obligation to inform consumers about data collection and honor opt-out requests
- Supplier assessments: Requirements to evaluate the data practices of upstream location data suppliers
- Incident reporting requirements: Obligations to report security incidents involving consumer location data
- Data retention schedule: Limits on how long location data may be held
The proposed order applies to both Kochava, Inc. and its subsidiary Collective Data Solutions. The settlement terms take effect upon court approval.
First Major FTC Enforcement Against Location Data Sales Sets Industry Precedent
The Kochava settlement represents the first major FTC enforcement action targeting the sale of consumer location data directly — addressing the commercial data broker market rather than a company that suffered a breach or failed to protect data it collected for its own purposes. The settlement’s consent-based framework, if upheld by the court, establishes a direct regulatory precedent applicable to the broader data broker industry, which has operated with limited oversight over location data sales to commercial clients.
The FTC’s original complaint was filed in August 2022; the May 5, 2026 settlement announcement came nearly four years after the initial lawsuit. The gap reflects the complexity of the legal proceeding and Kochava’s initial legal resistance to the FTC’s action.
