FTC Bans Kochava From Selling Americans’ Location Data Without Consent

The Federal Trade Commission has issued a proposed order that would prohibit data‑broker Kochava and its subsidiary Collective Data Solutions from selling or licensing precise geolocation data without explicit consumer consent. The action follows an August 2022 lawsuit that accused Kochava of harvesting and distributing location data from hundreds of millions of mobile devices, enabling clients to track users to sensitive venues such as mental‑health clinics, reproductive‑health centers, places of worship and domestic‑violence shelters. The data feed, sold through the AWS Marketplace for a $25,000 subscription fee, reportedly delivers more than 94 billion geo‑transactions per month, serves 125 million monthly active users and 35 million daily active users, and records over 90 daily transactions per device on average.

In parallel, the FTC’s settlement with Kochava over alleged misuse of location data has imposed new compliance requirements on ad‑tech firms, including enhanced transparency and user‑consent mechanisms. The settlement comes amid a UID2 identity‑solution mix‑up that left a publisher questioning the reliability of alternative identifiers, underscoring a growing regulatory focus on privacy safeguards in identity management. The order requires Kochava to establish a sensitive‑location‑data program, implement a supplier‑assessment program to verify consumer consent, allow consumers to request disclosure of data recipients and withdraw consent, submit incident reports to the FTC for misuse, and create a data‑retention and deletion schedule. Once approved by a district court judge, the order will become law.

The FTC has already banned other data brokers in 2024 and is actively pursuing rules to curb mass commercial surveillance. The proposed order signals that any business selling or sharing location data must now obtain affirmative express consent and demonstrate compliance with these new safeguards. Clients using location‑based advertising or analytics are urged to review their data‑broker agreements and data‑handling practices to avoid regulatory penalties and to ensure they meet the FTC’s stringent privacy requirements.