FTC Bars Kochava From Selling Sensitive Location Data Without Consent

The Federal Trade Commission announced in May 2026 that it will prohibit the data broker Kochava and a subsidiary from selling, sharing or disclosing sensitive location data without consumers’ affirmative express consent, settling allegations first brought in 2022 that the company sold location data from hundreds of millions of mobile devices.

The complaint described data capable of tracing individuals’ movements, including visits to health facilities and places of worship.

Every other exposure in this database involved a failure — an intrusion, a misconfiguration, a mistake. This describes a functioning business selling exactly what it intended to sell.

From the position of the person whose movements were traced, the distinction is thin. Their location history reached parties they never identified, for purposes they never agreed to, at scale. The mechanism was commerce rather than compromise.

A single coordinate is close to meaningless. A continuous trace is a biography: where you sleep, where you work, who you visit and how often.

The sensitive-location framing in the complaint is the sharpest version. A visit to a specific clinic reveals a medical circumstance. Regular attendance at a place of worship reveals religion. Neither is recorded as such; both are inferable from coordinates and a map.

Requiring affirmative express consent is a meaningful change from a regime where collection was the default. It is also a remedy that depends on people making informed decisions about data flows they cannot observe.

The data reached brokers through applications with legitimate reasons to know location — weather, mapping, delivery. A consent prompt at that moment asks the user to evaluate a downstream market they have no visibility into.