It’s been nearly four years since the Federal Trade Commission first accused Kochava of selling highly sensitive location data.
Now, the two have finally reached a settlement.
On Monday, the FTC filed a proposed order in the US District Court for the District of Idaho that would bar Kochava and its data‑broker subsidiary, Collective Data Solutions, from selling, licensing, transferring, sharing or disclosing sensitive location data unless they first obtain a consumer’s “affirmative express consent” and use the data solely to provide a service directly requested by that consumer.
The Commission voted 2 to 0 in favor of the settlement. (It’s wild that the FTC still only has two commissioners. But moving on.)
For Kochava, the agreement is as much about optics as it is about operational changes, and the company is casting this development as a positive “next step toward resolving the FTC matter,” a Kochava spokesperson said in a statement shared with AdExchanger.
“While the settlement remains subject to the Court’s review and approval, it reflects Kochava’s ongoing commitment to privacy and responsible data practices and formalizes the practical safeguards around privacy and compliance,” the spokesperson said. “We are looking forward to moving on from this chapter and continuing to focus on delivering industry-leading innovation and value.”
Sensitive data showdown
The settlement is the culmination of a years‑long dispute over what counts as “sensitive” location data, how much harm the sale of that data can cause in the real world and how far the FTC’s authority under the FTC Act really stretches.
In 2022, not long after the Supreme Court’s Dobbs decision overturned Roe v. Wade, the FTC sued Kochava for allegedly selling precise location data tied to hundreds of millions of mobile devices in a way that would allow buyers to trace people’s visits to “sensitive locations,” including health facilities, places of worship, addiction recovery centers and shelters.
According to the commission, consumers were largely unaware that their movements were being tracked at this level of detail or that the resulting data could be packaged and sold.
Kochava has long disputed both these facts and the framing.
CEO and Founder Charles Manning’s argument has been that commissioners wanted to “make an example” of his company and that the agency refused to clearly define what counted as “sensitive location data,” turning the term into a moving target.
For example, Kochava refused to sign the original consent order in 2022 because it didn’t include a clear definition of “sensitive location data,” and then preemptively sued the FTC over what it described as vague, shifting standards.
Roughly two weeks later, the FTC filed its own suit, and the language in that complaint broadened the term “sensitive” from health-related locations to also cover houses of worship and other categories of sites – exactly the kind of expansion Manning had said he was worried about.
Legal wrangling
The legal fight since then has been both messy and protracted.
Here’s the truncated version: In 2023, the year after Kochava and the FTC’s initial lawsuits, a US district judge in Idaho dismissed the FTC’s first complaint, but without prejudice. He called the privacy concerns “certainly legitimate” while faulting the agency for alleging only theoretical downstream harms rather than a likelihood of “substantial injury” as required under the FTC Act.
At the same time, the judge was skeptical of Kochava’s defenses, questioning whether consumers can reasonably be expected to avoid tracking by turning off their phones. He also described Privacy Block – a tool Kochava released in 2022 that removes location data related to health services from its data marketplace by default – as a “readily reversible step” that didn’t guarantee Kochava’s future compliance.
The judge gave the FTC 30 days to sharpen its case, and the commission refiled in June 2023 with a more detailed complaint under temporary seal. Kochava vowed to keep fighting, insisting that the amended suit still depended on “hypothetical privacy violations.”
But now, instead of pressing that fight all the way to trial, Kochava has opted to settle.
Kochava’s to-do list
In addition to the headline restriction on selling sensitive location data without explicit consent tied to a consumer‑requested service, Kochava and Collective Data Solutions must also stand up a dedicated program to identify and manage sensitive locations.
They also have to vet their data suppliers for proper consent, report certain violations to the FTC, allow people to request the names of any business or individual their precise location data was shared with and delete that data on a set schedule instead of storing it indefinitely.
If the district court signs off, the settlement will become binding and enforceable.
