FTC v. Kochava: Proposed Order Imposes Restrictions on Sale of Sensitive Location Data

Overview

In FTC v. Kochava Inc., the Federal Trade Commission (FTC or Commission) advanced the theory that, under the right circumstances, the sale of non-anonymized geolocation data linked to mobile advertising IDs (MAIDs) can itself be an “unfair” practice under 15 U.S.C. § 45 (Section 5 of the FTC Act). This litigation was one of the rare FTC litigations that addressed the legal bounds of the Commission’s unfairness authority. After dismissing the FTC’s original complaint, the U.S. District Court for the District of Idaho denied Kochava’s motion to dismiss the FTC’s amended complaint. The parties recently filed a proposed order that limits Kochava’s ability to sell sensitive location data.

The Initial Complaint

The FTC filed its initial complaint against Kochava in August 2022. The FTC alleged that Kochava engaged in “unfair” practices in violation of Section 5 of the FTC Act by selling precise geolocation data associated with MAIDs. The FTC alleged that Kochava’s data feeds allowed customers to track consumers’ movements, including to sensitive locations. The FTC alleged that Kochava made large volumes of such data available through paid subscriptions and publicly accessible samples without meaningful access controls or technical safeguards to prevent misuse.

The FTC did not allege that Kochava’s practices were deceptive. Instead, the Commission alleged that Kochava’s practices were “unfair” under Section 5 of the FTC Act, asserting that the practices caused or were likely to cause substantial injury to consumers that was not reasonably avoidable and not outweighed by countervailing benefits to consumers or competition.

Dismissal of the Original Complaint

In May 2023, the court dismissed the FTC’s complaint without prejudice, holding that the FTC failed to adequately plead a likelihood of substantial consumer injury. Specifically, the court held that:

• The complaint did not adequately allege that Kochava’s practices created a significant risk of downstream harm (e.g., stigma, discrimination or violence by third parties).
• The complaint did not allege a privacy intrusion severe enough to constitute a substantial injury.

The Amended Complaint

In June 2023, the FTC filed an amended complaint. The amended complaint added concrete examples, and rather than focusing solely on geolocation data, the FTC relied in detail on the alleged cumulative effect of four interrelated Kochava products. The FTC alleged that Kochava’s products were designed to be combined, rendering the data effectively non‑anonymized and alleged that Kochava emphasized its ability to identify individual consumers at scale. The FTC also alleged that customers could not avoid the alleged harm because they do not know Kochava is collecting this data and, in many cases, believed they are opting into data collection for different purposes. Finally, the FTC alleged that Kochava did not have meaningful controls to protect consumers’ privacy.

Decision Denying the Motion to Dismiss the Amended Complaint

In February 2024, the court denied Kochava’s motion to dismiss the amended complaint, holding that the FTC plausibly alleged “substantial injury” under both of its theories.

First, the court found the FTC adequately pleaded that Kochava’s practices, taken together, could expose consumers to a significant risk of secondary harms. The court also stressed the FTC’s allegations regarding Kochava’s purported lack of controls surrounding access to/use of its data and practice of linking geolocation data to MAIDs, along with its allegations that customers have, in some situations, been targeted based on geolocation data.

Second, the court held that the alleged invasion of privacy could itself constitute a substantial injury because the FTC alleged that Kochava’s products were designed to provide “comprehensive, aggregated collections of raw and synthesized data designed to give its customers a ‘360-degree perspective’ on the unique traits of millions of individual users” instead of merely selling “bits and pieces” of data. In reaching this conclusion, the court stressed the FTC’s allegation that Kochava itself makes inferences about consumers based on its products.[1]

The Proposed Stipulated Order

In May 2026, the FTC and Kochava filed a proposed a stipulated order resolving the case. Without admitting liability, Kochava agreed to substantial injunctive relief, including:

• A prohibition on selling or disclosing certain sensitive location data unless the data is used to provide a service directly requested by the consumer and Kochava has obtained express affirmative consent from the consumer.
• Establishment of a sensitive location data program to ensure compliance with restrictions on sale or disclosure of information associated with those locations.
• Deletion or deidentification of historical sensitive location data collected without confirmed consent.
• Supplier assessment obligations to verify that upstream data sources obtained valid consumer consent.

Why This Matters for Businesses

Kochava highlights the FTC’s continued approach to challenging the large-scale sale of comprehensive, non-anonymized sensitive consumer data without adequate safeguards, even absent deception.

Companies commercializing sensitive consumer data should consider:

• Whether “anonymous” data can, in practice, easily be linked to specific consumers
• Whether data associated with sensitive locations can be reliably and efficiently excluded
• The adequacy of technical/use restrictions on sensitive data
• Upstream data providers’ collection practices

[1] Following this decision, the FTC filed a second amended complaint adding Collective Data Solutions LLC (a subsidiary of Kochava) as a defendant.