On May 4, 2026, the Federal Trade Commission announced a stipulated final order resolving its enforcement action against data broker Kochava Inc. and its subsidiary Collective Data Solutions (CDS). The order bans them from selling or sharing sensitive precise location data without affirmative express consumer consent. Kochava and CDS provide a range of digital analytics services, including the Kochava Collective (for which CDS assumed operation in mid-2023) that aggregate certain data made available through Kochava’s proprietary data marketplace.

In a press release announcing the stipulated final order, the FTC said Kochava and CDS’s “collection, use, and disclosure of precise location data invaded consumers’ privacy by revealing their movements, including visits to sensitive locations such as health facilities and places of worship, in violation of Section 5 of the FTC Act. The FTC also said that “because consumers were unaware of and did not consent to this data sharing, consumers had no way of avoiding the harm resulting from its collection and disclosure.”

The FTC’s Allegations

In a case first filed in August 2022 in the U.S. District Court for the District of Idaho, the FTC alleged that Kochava collected and sold precise mobile device location data tied to hundreds of millions of devices in ways that allowed purchasers to track consumers’ visits to sensitive locations, including reproductive health clinics and places of worship. According to the FTC, consumers were unaware their data was being sold and had no meaningful opportunity to avoid the resulting privacy harms.

Under the proposed final order, Kochava and CDS may not sell, license, transfer, or disclose sensitive location data unless (1) the consumer has provided affirmative, express consent and (2) the data is used solely to provide a service directly requested by the consumer. The order was approved by a 2‑0 Commission vote.

Proposed Stipulated Order

The FTC’s proposed consent order would be in effect for 10 years and would restrict Kochava and CDS from misrepresenting the extent to which it collects, uses, discloses, or deletes data, whether or not deidentified. More specifically, the consent order:

• Prohibits Kochava and CDS from selling or disclosing precise location data associated with sensitive locations unless it has a direct relationship with the consumer related to the sensitive location data, the consumer has provided affirmative express consent, and the sensitive location data is used to provide a service directly requested by the consumer.
• Requires Kochava and CDS to establish a written sensitive location data program identifying and filtering out sensitive locations, including a quarterly assessment of the accuracy and completeness of the list of sensitive locations, as well as deleting any sensitive location data for which consent has not been confirmed.
• Requires that Kochava and CDS report to the FTC any incidents of third parties misusing or improperly sharing location data in violation of contractual requirements.
• Mandates that Kochava and CDS must develop a supplier assessment program verifying that upstream data sources obtained valid consumer consent.
• Requires that Kochava and CDS provide clear and conspicuous means for consumers to request the identity of any recipient of their data, including the ability for consumers to withdraw consent and request that their data be deleted.
• Requires that Kochava and CDS develop, implement, and maintain a comprehensive privacy program, including updating their data retention schedule pursuant to the order.

The Commission voted 2-0 to approve the stipulated final order.

Takeaways

The FTC’s extended litigation with Kochava underscores its focus on the commercial sale of precise location, and other sensitive data and reinforces the FTC’s position that such data is inherently sensitive.

Businesses that collect, use, or disclose location data may want to reassess their privacy program to confirm they have in place appropriate consumer disclosures, valid consent mechanisms, vendor diligence and audit procedures, and data retention and deidentification practices.