Cybersecurity Policy Report, Sellers of sensitive location data agree to ban to settle FTC charges, (May 5, 2026)

By Peter Reap, J.D., LL.M.

Kochava and its subsidiary agreed to not sell sensitive location data without consumers’ affirmative express consent.

A proposed stipulated order will prohibit data broker Kochava and its subsidiary (together, Kochava) from selling, sharing, or disclosing sensitive location data without consumers’ affirmative express consent if approved by the federal district court in Idaho, according to the FTC. The companies agreed to the ban in order to settle FTC allegations that they sold location data from hundreds of millions of mobile devices that could be used to trace the movements of individuals (FTC v. Kochava Inc., No. 2:22-cv-00377-BLW (D. Idaho. May 4, 2026)).

Background. The FTC filed suit against Kochava in 2022, alleging that its collection, use and disclosure of precise location data invaded consumers’ privacy by revealing their movements, including visits to sensitive locations such as health facilities and places of worship. The FTC alleged that because consumers were unaware of and did not consent to this data sharing, consumers had no way of avoiding the harm resulting from its collection and disclosure.

The court initially dismissed the FTC complaint with leave to amend, finding that the FTC’s argument—that Kochava’s data sales could “substantially injure customers” by “enabl[ing] third parties to track consumers’ past movements to and from sensitive locations,” and “subjecting them to a significant risk of suffering concrete harms at the hands of third parties”—was plausible, the FTC failed to adequately allege that the data sales created a “significant risk” of concrete harm to consumers.

The FTC filed an amended complaint on June 5, 2023, asserting the same claim with additional factual allegations to support the FTC’s theories of consumer injury. The FTC filed this complaint under seal along with a Motion to Seal because it anticipated that Kochava would argue “that some of the materials referenced, excerpted, or cited in the amended complaint constitute trade secrets and are entitled to confidential treatment.”

On November 3, 2023, the district court denied Kochava, Inc.’s motion for sanctions under Rule 11 because the allegations in the FTC’s amended complaint were not baseless or objectively unreasonable. It also granted the FTC’s motion to unseal because Kochava had not demonstrated any compelling reason to maintain any portion of the amended complaint under seal.

On February 3, 2024, the district court declined to dismiss the FTC’s claims, finding that the FTC plausibly alleged that “Kochava causes or is likely to cause substantial injury to consumers by selling ‘massive amounts of private and encyclopedic information’ that puts consumers at significant risk of secondary harms.”

Exactly one year later, on February 3, 2025, the court denied a renewed motion to dismiss by Kochava. The court noted that invasion of privacy, despite being “intangible,” is a long-recognized and potentially substantial form of legal injury. The court found the FTC cured its earlier pleading by alleging specific instances of harm to consumer privacy. The court reiterated its opinion that Congress would have included the word “tangible” in the FTC Act if it had wanted to limit FTC authority to “tangible” consumer injuries, despite an apparently critical forthcoming law review article. Pertinent to costs and benefits under the FTC Act, the FTC only sought to enjoin Kochava sales of specific kinds of sensitive consumer data, not Kochava’s entire business.

Meanwhile, upon learning of the FTC’s plan to file suit, Kochava filed its own complaint against the FTC in the Idaho federal district court. Kochava sought a declaratory ruling that: (1) the FTC’s structure violates Article II by providing improper insulation from the president; (2) Section 13(b) of the FTC Act does not authorize the FTC to seek injunctive relief for past conduct that has ceased absent evidence that it is likely to recur; and (3) Kochava’s practice of data collection is not an unfair act or practice.

The court granted the FTC’s motion to dismiss Kochava’s lawsuit without leave to amend on May 3, 2023, finding that the remedies sought by Kochava were “inappropriate in light of the FTC’s pending enforcement action.”

Proposed stipulated order. Under the proposed order resolving the FTC’s litigation, Kochava and its subsidiary, Collective Data Solutions (CDS), which has taken over Kochava’s data broker business, will be prohibited from selling, licensing, transferring, sharing or disclosing sensitive location data in any products or services unless they obtain a consumer’s affirmative express consent and the data is used to provide a service directly requested by the consumer. The subsidiary and Kochava (if Kochava sells or uses precise location data) also are required to:

• Establish and implement a sensitive location data program to develop a comprehensive list of sensitive locations to prevent the sale, transfer or disclosure of sensitive location data;

• Implement a supplier assessment program designed to confirm that consumers have provided consent for the collection and use of all location data obtained by the subsidiary or Kochava;

• Submit incident reports to the FTC when the companies determine a third party shared consumers’ precise location data in violation of contractual requirements;

• Allow consumers to request the names of any business or individual to which CDS or Kochava has knowledge that consumers’ precise location data was sold, and provide consumers with an easy way to withdraw consent for the sale of their device’s precise location data; and

• Create a data retention schedule that will require the deletion of data on an established timeframe.

The Case is No. 2:22-cv-00377-BLW.

Attorneys: Brian Shull for the FTC. Elena A. Kuzminova (Gordon Rees Scully Mansukhani LLP) for Kochava, Inc.

Companies: Kochava, Inc.

News: ConsumerProtection Privacy FederalTradeCommissionNews CyberPrivacyFeed DataPrivacy IdahoNews GCNNews DataSecurity