FTC Enforcement Action Against Kochava Signals Regulatory Shift on Location Data Commercialisation
The FTC has banned data broker Kochava from selling precise geolocation data without explicit consumer consent, settling charges that the company monetised location information harvested from hundreds of millions of mobile devices. This represents meaningful regulatory intervention in the location data market.
Affected
Kochava operated as a significant aggregator in the location data supply chain, collecting precise geolocation signals from hundreds of millions of mobile devices through apps and mobile web traffic. The FTC's action establishes that selling this data without explicit consumer consent violates the FTC Act, moving beyond mere notification requirements toward actual data commercialisation restrictions. This differs from previous enforcement patterns where fines were the primary remedy.
The settlement is notable because it attacks the infrastructure layer rather than endpoint applications. Kochava did not directly collect from consumers but purchased data from other sources, meaning the FTC is now scrutinising intermediaries that lack consumer-facing interfaces. This removes a common defence that data brokers simply aggregate information already collected by others.
From a technical standpoint, location data derived from mobile devices carries exceptional sensitivity. Precise geolocation histories enable inference of sensitive behaviours: medical visits, religious attendance, political activity, and home location. Unlike pseudonymised datasets, location trails are difficult to fully de-identify and remain subject to re-identification attacks when combined with auxiliary information.
Defenders and enterprises relying on location data products should immediately audit their data sourcing. If procurement chains included Kochava-sourced data, organisations face potential liability downstream. Privacy teams should implement explicit consent verification before acquiring any location dataset and document the legal basis for retention and use.
The broader implication is that the FTC is moving toward restricting data broker business models at the collection-or-purchase stage, not just the sale. This creates risk for other location aggregators operating on similar consent models. The settlement also signals that US privacy enforcement is beginning to treat aggregated location data as sensitive personal information requiring affirmative opt-in, aligning with emerging international frameworks like GDPR.
Sources