Kochava Won't Sell 'Sensitive' Location Data Without Consent

Why It Matters

The deal limits the commercial use of highly granular location data, reinforcing privacy safeguards and setting a precedent for data‑broker accountability.

Key Takeaways

• Kochava must obtain explicit consent before selling sensitive location data.
• Sensitive data includes GPS tied to medical, religious, and law‑enforcement sites.
• Settlement requires a formal privacy program and ongoing compliance monitoring.
• FTC alleges data could expose visits to abortion clinics and private venues.
• No admission of guilt; case resolves lawsuit dating back to August 2022.

Pulse Analysis

The FTC’s crackdown on data brokers has accelerated as lawmakers and privacy advocates spotlight the risks of hyper‑granular location tracking. Mobile advertising platforms routinely collect GPS coordinates alongside identifiers such as Apple’s IDFA, creating datasets that can be re‑identified with a few ancillary data points. Recent court rulings, including the Dobbs decision, have heightened fears that such information could be weaponized for law‑enforcement investigations, especially around reproductive health services. In this climate, regulators are demanding clearer consent mechanisms and stronger safeguards.

Kochava’s proposed settlement draws a line around what the agency calls “sensitive” location data—precise GPS points linked to medical facilities, religious institutions, schools, homeless shelters, domestic‑violence shelters, and federal law‑enforcement sites. Under the agreement, the company must obtain affirmative consumer consent before sharing any of these records and must institute a comprehensive privacy program subject to FTC oversight. While Kochava does not admit liability, the binding terms effectively prohibit the sale of non‑anonymized location feeds that could pinpoint visits to abortion clinics or other private venues.

The deal sends a clear market signal: data brokers that continue to monetize exact location signals without explicit permission may face steep penalties. Advertisers will need to adjust targeting strategies, relying more on aggregated or consent‑based data sets to avoid compliance risk. Moreover, the settlement could serve as a template for future FTC actions against firms that blend advertising IDs with precise geolocation. Companies should audit their data pipelines, implement opt‑in consent flows, and document privacy controls to stay ahead of evolving regulatory expectations.