FTC Bars Kochava from Selling Precise Location Data Without Consent
The FTC has barred Kochava from selling or sharing sensitive location data without explicit user consent.
Why it matters: The order highlights growing regulatory scrutiny over data brokers and sets new compliance benchmarks in location data handling. Legal departments and privacy professionals must reevaluate their data practices in light of the FTC’s action.
- The FTC announced a stipulated final order against Kochava and its subsidiary on May 4, 2026.
- Kochava collected and sold precise location data from hundreds of millions of mobile devices.
- Kochava must now obtain users' affirmative express consent before selling or disclosing sensitive geographic data.
- Consumers can request information about buyers of their data and withdraw consent at any time.
The Federal Trade Commission on May 4, 2026, issued a stipulated final order that bars data broker Kochava Inc. and its subsidiary, Collective Data Solutions (CDS), from selling, sharing, or disclosing sensitive location data without consumers’ explicit affirmative consent.
- The FTC’s enforcement stems from a 2022 complaint, which alleged Kochava collected and sold granular location information from hundreds of millions of mobile devices. According to the agency, this data could expose visits to health facilities, places of worship, and shelters.
- Kochava and CDS must now create a Sensitive Location Data Program to catalog sensitive sites and block the sale or disclosure of such data without clear consumer opt-in.
- The final order also requires a Supplier Assessment Program, obligating Kochava to verify that any third-party obtained data is properly consented to by consumers.
- Consumers gain additional rights: They may request the identities of companies that bought their data and must have access to a straightforward process for revoking consent for further sale of their device’s location data.
The order sets the compliance term at 10 years from its entry by the court, providing a long-term framework for handling sensitive location information. The settlement reaffirms the FTC’s intensified focus on privacy enforcement, serving as a compliance blueprint for legal, technology, and privacy teams evaluating how they handle location data in practice.
By the numbers:
- Hundreds of millions — mobile devices from which Kochava collected and sold precise location data
- 10 years — duration the stipulated final order will remain in effect
Yes, but: The order does not specify financial penalties or restitution for affected consumers.