FTC Bans Data Broker From Selling Sensitive Location Data Without Consent
On May 4, 2026, the Federal Trade Commission announced that it will prohibit data broker Kochava and its subsidiary from selling, sharing or disclosing sensitive location data without consumers’ affirmative express consent to settle allegations the companies sold location data from hundreds of millions of mobile devices that could be used to trace the movements of individuals.
The FTC sued Idaho-based Kochava in August 2022 alleging that its collection, use and disclosure of precise location data invaded consumers’ privacy by revealing their movements, including visits to sensitive locations such as health facilities and places of worship. According to the author, the FTC alleged that because consumers were unaware of and did not consent to this data sharing, consumers had no way of avoiding the harm resulting from its collection and disclosure.
Under the proposed order resolving the FTC’s litigation, Kochava and its subsidiary, Collective Data Solutions (CDS), which has purportedly taken over Kochava’s data broker business, will be prohibited from selling, licensing, transferring, sharing or disclosing sensitive location data in any products or services unless they obtain a consumer’s affirmative express consent and the data is used to provide a service directly requested by the consumer.
The subsidiary and Kochava (if Kochava sells or uses precise location data) also are required to:
- Establish and implement a sensitive location data program to develop a comprehensive list of sensitive locations to prevent the sale, transfer or disclosure of sensitive location data;
- Implement a supplier assessment program designed to confirm that consumers have provided consent for the collection and use of all location data obtained by the subsidiary or Kochava;
- Submit incident reports to the FTC when the companies determine a third party shared consumers’ precise location data in violation of contractual requirements;
- Allow consumers to request the names of any business or individual to which CDS or Kochava has knowledge that consumers’ precise location data was sold, and provide consumers with an easy way to withdraw consent for the sale of their device’s precise location data; and
- Create a data retention schedule that will require the deletion of data on an established timeframe.
The Commission vote approving the stipulated final order was 2-0. The FTC filed the proposed order in the U.S. District Court for the District of Idaho.
Richard B. Newman is an advertising practices attorney at Hinch Newman LLP.
Informational purposes only. Not legal advice. This article is not intended to and should not be construed as legal advice. May be considered attorney advertising.
Topics
Archives
About This Blog and Hinch Newman’s Advertising + Marketing Practice
Hinch Newman LLP’s advertising and marketing practice includes two decades successfully resolving some of the highest-profile Federal Trade Commission (FTC) and state attorneys general digital advertising and telemarketing investigations and enforcement actions. As FTC attorneys, the firm possesses superior FTC compliance knowledge and more than 20 years of FTC defense advocacy experience in the areas of advertising, marketing, lead generation, promotions, e-commerce, privacy and intellectual property law. It has also been selected to author the Consumer Protection Section of the prestigious American Lawyer Media International Federal Trade Commission: Law, Practice and Procedure Treatise, a comprehensive resource for developments of concern to advertisers, marketers and legal professionals that practice before the Commission. Through these advertising and marketing law updates, Hinch Newman LLP provides commentary, news and analysis on issues and trends concerning developments of interest to digital marketers, including FTC and state attorneys general advertising compliance, civil investigative demands (CIDs), and administrative/ judicial process.