A Data Broker Fought Regulators for Three Years Over Selling Your Precise Location

Idaho-based data broker Kochava Inc. collects and sells precise location data gathered from hundreds of millions of mobile devices, data precise enough, according to the Federal Trade Commission, to trace an individual's visits to specific places — medical clinics, places of worship, or other sensitive locations — without those individuals ever knowing their movements were being tracked and sold.DOCUMENTED A proposed settlement resolving the agency's long-running case against Kochava and its subsidiary, Collective Data Solutions, LLC, imposes sweeping restrictions on how the companies may collect, use, sell, and disclose sensitive location data going forward.DOCUMENTED

The path to that settlement was unusually long and, at one point, went the company's way. The FTC first sued Kochava in August 2022, and in May 2023 a federal judge dismissed the agency's complaint, ruling in a 35-page opinion that the FTC had failed to allege that Kochava's data sales created a “significant risk” of concrete harm to consumers.DOCUMENTED

What the amended complaint alleged

The FTC's original 2022 complaint charged that Kochava's collection, use, and disclosure of precise location data invaded consumers' privacy because people were unaware of, and had not consented to, the sharing of their location information, in violation of Section 5 of the FTC Act's prohibition on unfair acts or practices.DOCUMENTED After the court's 2023 dismissal, the Commission revised and tightened its claims, ultimately forming the basis for the proposed settlement announced in 2026.DOCUMENTED The revised theory reportedly focused more precisely on the specific categories of sensitive locations — including health care facilities, schools, jails, and other similarly sensitive venues — that the data could be used to trace movement to and from, sharpening the concrete harm the court's earlier ruling had found insufficiently alleged.REVIEWED

Why the initial dismissal mattered for other data broker cases

The 2023 dismissal was closely watched across the data broker industry because it directly addressed a foundational question in FTC privacy enforcement: whether the mere sale of location data, absent evidence that it was actually used to cause a specific consumer harm, is enough to establish an unfair practice under Section 5.REVIEWED The court's ruling that the agency needed to allege a more concrete risk of harm forced the FTC to sharpen its legal theory not just in the Kochava case itself, but in how it approached subsequent location data cases brought against other brokers in the years that followed.

A settlement that followed a private lawsuit

Notably, Kochava had separately settled a consumer class-action lawsuit stemming from the same underlying location data practices before the FTC's amended case was resolved, agreeing in that private settlement to implement a two-year “privacy block” feature intended to prevent the sharing or use of raw location data associated with health care facilities, schools, jails, and other sensitive venues.DOCUMENTED That earlier private settlement addressed similar concerns to those in the FTC's case, though on a shorter timeline and through a different legal mechanism, well before the federal settlement imposed its own, longer-term restrictions.

Terms of the settlement

Under the proposed order, Kochava and Collective Data Solutions are prohibited from selling, sharing, or disclosing sensitive location data without consumers' affirmative express consent.DOCUMENTED The order imposes what commentators have described as sweeping operational requirements on how the companies collect, use, sell, and disclose location data more broadly, not limited only to the specific sensitive-location categories the amended complaint highlighted.DOCUMENTED The settlement was filed in the U.S. District Court for the District of Idaho.DOCUMENTED

A federal judge initially found the FTC hadn't shown enough concrete harm from selling location data alone — a ruling that reshaped how the agency built its later location-privacy cases.

Why the case matters

For the broader data broker industry, the Kochava case's winding path — an initial dismissal followed by a strengthened complaint and an eventual settlement — illustrates both the limits and the eventual reach of the FTC's authority over location data sales under existing law. Even as several states have separately moved to restrict the sale of precise location data outright, the federal case establishes that a data broker's location practices remain subject to Section 5 scrutiny, provided the agency can tie the data collection to specific, sensitive categories of consumer harm rather than resting on the sale of location data as inherently unfair on its own.

What this means for consumers going forward

Most consumers have no direct relationship with a data broker like Kochava at all; the location information these companies sell typically originates from apps installed on a consumer's own device that share location data with third-party advertising and analytics partners, often disclosed only in dense privacy policy language most users never read in full.REVIEWED Reviewing and restricting individual app location permissions directly on a mobile device remains the most concrete step an individual consumer can take, since a settlement binding one data broker does nothing to change the underlying app-level permissions that feed the broader location data marketplace in the first place.

How the case fits the FTC's broader privacy enforcement priorities

Location data has emerged as one of the FTC's clearest enforcement priorities within the broader category of consumer privacy, distinct from other data types like browsing history or purchase records, because location information can reveal intimate details about a person's life — medical conditions, religious practice, political activity, even relationship status — simply by tracking where a device physically travels over time.REVIEWED The Kochava settlement, arriving after a three-year legal battle that included an initial dismissal, signals that this priority has survived a change in Commission leadership and a court setback that might, in a less consistently prioritized enforcement area, have caused the agency to abandon the underlying case entirely rather than pursue a strengthened complaint.

Have documents relevant to this story? Reach us through our tips channel.