The U.S. Federal Trade Commission recently filed a proposed order in the U.S. District Court for the District of Idaho to prohibit Kochava Inc., an Idaho-based data broker, and its subsidiary Collective Data Solutions (“CDS”) from selling or disclosing consumers’ sensitive location data without obtaining their express consent. In August 2022, the FTC sued Kochava for unlawfully collecting and selling geolocation data from consumers’ mobile devices in violation of the prohibition against unfair or deceptive practices in Section 5(a) of the FTC Act, 15 USC § 45(a). The FTC filed the suit over concerns that geolocation data, which was collected without consumers’ consent, could potentially injure consumers by revealing their visits to sensitive locations, including medical facilities, religious institutions, and addiction recovery centers. According to the Stipulated Order for Injunction and Other Relief (“Proposed Order”), which was filed as part of a Joint Motion for Settlement filed on May 4, 2026, Kochava and CDS did not admit or deny the FTC’s allegations against them.
According to the FTC, the Proposed Order resolves the FTC’s case against Kochava and CDS, a subsidiary that has taken over Kochava’s data broker business, by prohibiting them from “selling, licensing, transferring, sharing or disclosing sensitive location data in any products or services unless they obtain a consumer’s affirmative express consent and the data is used to provide a service directly requested by the consumer.” The Proposed Order also requires the companies to establish safeguards to protect consumers’ sensitive information, including the formation of a Supplier Assessment Program to confirm that consumers have provided Kochava and/or CDS with consent to the collect and use their geolocation data; the formation of the Sensitive Location Data Program to develop a list of sensitive locations in order to prevent the sale and disclosure of data for those locations; and the publication of data retention limits that provide the purpose for collecting or using the geolocation data, the business need for its retention, and a schedule that requires the deletion of the data at regular intervals.
The Proposed Order also requires Kochava and CDS to allow consumers to request the names of the individuals and entities to which their precise location data was sold and provide consumers with the means to “easily” withdraw their consent for the sale of this data. In addition, the companies must provide the FTC with incident reports of occasions when third parties shared consumers’ geolocation data in violation of contractual requirements, including the number of consumers affected by each incident, the type of information involved, and the steps taken by Kochava and/or CDS to remediate the incident.
FTC Press Release | Joint Motion for Settlement | Stipulated Order for Injunction and Other Relief