The FTC has reached a proposed settlement with data broker Kochava and its subsidiary, Collective Data Solutions, that would bar them from selling sensitive location data without consumers’ explicit consent.
Regulators alleged the companies sold precise geolocation data from hundreds of millions of mobile devices, enabling tracking of visits to reproductive health clinics, addiction treatment centers, places of worship and domestic violence shelters.
The settlement marks the latest escalation in the FTC’s crackdown on the commercial trade in sensitive consumer location data.
The Federal Trade Commission has taken action to block data broker Kochava and its subsidiary from selling sensitive location data after accusing the companies of exposing detailed information about the movements of millions of Americans.
Under a proposed settlement filed in federal court, Idaho-based Kochava and its subsidiary, Collective Data Solutions (CDS), would be prohibited from selling, licensing, transferring or otherwise disclosing sensitive geolocation data unless consumers provide affirmative express consent and the information is used to deliver a service the consumer specifically requested.
The FTC originally sued Kochava in 2022, alleging the company collected and sold precise location data from hundreds of millions of mobile devices through data feeds marketed to advertisers and other clients.
According to the agency, the data could be used to trace individuals to sensitive locations, including reproductive health clinics, addiction recovery centers, religious institutions and shelters for victims of domestic violence.
The agency says consumers were in the dark
Regulators said consumers often were unaware that their location information was being bought and sold and had little ability to prevent its use. The FTC argued the practice exposed people to potential harms, including stalking, discrimination and threats to personal safety.
The proposed order would also require Kochava and CDS to implement measures governing the handling of sensitive location information, including consumer consent verification and controls on data retention and disclosure.
Collective Data Solutions has since taken over Kochava’s data broker business, according to the FTC.
The settlement is part of a broader FTC campaign targeting the location data brokerage industry. In recent years, the agency has taken action against several other firms accused of collecting and selling sensitive location information tied to healthcare facilities, military bases and religious organizations.
Privacy advocates say the Kochava case could have broader implications for the data broker industry because it reinforces regulators’ position that precise geolocation data can constitute highly sensitive personal information even when not directly tied to a person’s name.