"The proposed order will stop the company 'from selling, licensing, transferring, sharing or disclosing sensitive location data in any products or services unless they obtain a consumer’s affirmative express consent and the data is used to provide a service directly requested by the consumer,'" the U.S. Federal Trade Commission said Monday.
The FTC lawsuit and the proposed settlement
The Federal Trade Commission sued Idaho-based data broker Kochava and its subsidiary Collective Data Solutions in August 2022, alleging the firms sold precise location data drawn from hundreds of millions of smartphones without consumer consent. A proposed order filed in Boise federal court would halt those practices as the parties move to resolve the litigation. The proposed order must be approved by a federal judge; the agency said that judicial approval is a required step and is typically a formality.
Kochava’s capabilities and the privacy concerns
Kochava had advertised the ability to pinpoint an individual’s location to within 10 meters by combining GPS coordinates with other signals such as the Wi‑Fi network to which a smartphone is connected. That level of precision — and the company’s sale of aggregated geolocation streams — drew the FTC’s scrutiny amid fears the data could reveal visits to locations many consider sensitive.
What the order would bar and require
Under the proposed order, Kochava must stop selling, licensing, transferring, sharing or disclosing sensitive location data unless it obtains a consumer’s affirmative, express consent and the data is used to provide a service directly requested by that consumer. The order also expressly prohibits the sale of location data associated with certain categories of "sensitive locations," including medical and religious facilities, daycares, temporary shelters such as those offered to survivors of domestic violence, and military and federal law enforcement offices.
Supplier verification, consumer access, and withdrawal
The settlement requires Kochava to implement quarterly verification of suppliers that trade location data to it, confirming those suppliers have obtained express permission from users to collect location data. Kochava also agreed to let consumers request the names of any business or individual to which it sold geolocation data, and to provide an easy mechanism for consumers to withdraw consent for the sale of their device’s location data.
Legal history: dismissal, amendment, and continued scrutiny
The litigation has already survived a procedural hurdle. In May 2023 a judge dismissed the FTC’s first complaint on the ground it relied too heavily on inference that consumers were injured by Kochava’s business model, but the judge allowed the FTC to file an amended complaint to sharpen its privacy-based claims. The agency filed that amended complaint in June 2023, initially under seal because Kochava had asserted potential objections to public disclosure of material it described as proprietary.
What this means for technologists, policymakers, and consumers
- Technologists and security teams: engineers who design or integrate location‑based services will need to account for stricter consent and supplier‑verification requirements when sourcing third‑party location streams. The proposed order’s quarterly verification provision imposes an ongoing compliance check on data supply chains.
- Policymakers and regulators: the settlement signals an enforcement approach that ties allowable uses of geolocation to affirmative, express consumer consent and narrowly defined service purposes. Legal experts characterize the terms as strict: "After so many years of fighting, Kochava decided to settle on very strict terms," said attorney Randal Shaheen of BakerHostetler.
- Consumers and privacy advocates: individuals gain new, specified rights under the settlement — the ability to learn to whom their geolocation was sold and to withdraw consent easily — and wins for location-associated categories deemed especially sensitive, such as medical and religious sites.
Context intensified the FTC’s inquiry: the agency’s probe began soon after the U.S. Supreme Court in June 2022 overturned the constitutional precedent embodied in Roe v. Wade, and public concern about tracking to and from medical and religious sites grew as at least 13 states implemented full bans on abortion while others imposed partial bans or new restrictions. The FTC cited those privacy risks in bringing the case.
Geolocation law and practice remain a live issue in other fora as well. The Supreme Court heard oral arguments in April in Chatrie v. United States, a case about whether geofence warrants — orders that compel companies to disclose data on all devices within a geographic area at a given time — violate the Fourth Amendment.
Kochava told ISMG it "is pleased to have reached this proposed settlement and to take this next step toward resolving the FTC matter." The proposed order, if approved by the court, will require Kochava to implement the consent, verification and disclosure measures spelled out by the FTC — a concrete set of limits that, according to the agency, will curb the sale of sensitive location data unless consumers explicitly agree otherwise.
