FTC to Ban Kochava and Subsidiary from Selling Sensitive Location Data to Settle Charges They Sold Location Data Linked to Millions of Mobile Devices

The Federal Trade Commission will prohibit data broker Kochava and its subsidiary from selling, sharing or disclosing sensitive location data without consumer consent to settle allegations the companies sold location data from hundreds of millions of mobile devices that could be used to trace the movements of individuals.

The FTC sued Idaho-based Kochava in August 2022 alleging that its collection, use and disclosure of precise location data invaded consumers’ privacy by revealing their movements, including visits to sensitive locations such as health facilities and places of worship. The FTC alleged that because consumers were unaware of and did not consent to this data sharing, consumers had no way of avoiding the harm resulting from its collection and disclosure.

Under the proposed order resolving the FTC’s litigation, Kochava and its subsidiary,  Collective Data Solutions (CDS), which has taken over Kochava’s data broker business, will be prohibited from selling, licensing, transferring, sharing or disclosing sensitive location data in any products or services unless they obtain a consumer’s affirmative express consent and the data is used to provide a service directly requested by the consumer. The subsidiary and Kochava (if Kochava sells or uses precise location data) also are required to:

• Establish and implement a sensitive location data program to develop a comprehensive list of sensitive locations to prevent the sale, transfer or disclosure of sensitive location data;
• Implement a supplier assessment program designed to confirm that consumers have provided consent for the collection and use of all location data obtained by the subsidiary or Kochava;
• Submit incident reports to the FTC when the companies determine a third party shared consumers’ precise location data in violation of contractual requirements;
• Allow consumers to request the names of any business or individual to which CDS or Kochava has knowledge that consumers’ precise location data was sold, and provide consumers with an easy way to withdraw consent for the sale of their device’s precise location data; and
• Create a data retention schedule that will require the deletion of data on an established timeframe.

The Commission vote approving the stipulated final order was 2-0. The FTC filed the proposed order in the U.S. District Court for the District of Idaho.

NOTE: Stipulated final orders have the force of law when approved and signed by the District Court judge.

The lead attorneys on this matter are Jennifer Rimm, Erik Jones, Mike Sherling, Elizabeth C. Scott, and Julia Horwitz in the FTC’s Bureau of Consumer Protection.