FTC Settlement Bars Data Broker Kochava From Selling Sensitive Location Data Without Consumer Consent

The FTC settled charges against data broker Kochava and its subsidiary Collective Data Solutions, barring them from selling, sharing, or disclosing sensitive location data without a consumer’s affirmative express consent. The case resolves an FTC complaint originally filed in August 2022 alleging Kochava provided clients access to precise geolocation data from hundreds of millions of mobile devices, including movements traceable to mental-health clinics, addiction-recovery facilities, reproductive-health clinics, houses of worship, and domestic-violence shelters. The settlement requires Kochava to establish a sensitive-location-data compliance program, implement a supplier-assessment program, allow consumers to request data disclosure and withdraw consent, and adopt a data retention and deletion schedule.

The capture-ledger story that originally surfaced this framed it as a general FTC rulemaking banning sensitive-location-data sales; the actual action is narrower and more concrete — a company-specific enforcement settlement against one data broker, not an industry-wide rule. It is nonetheless the FTC’s most direct action yet against the data-broker location-sale pattern this corpus tracks feeding federal law enforcement’s own warrantless purchases, including FBI Director Patel’s confirmed reliance on the same commercial data-broker ecosystem (2026-03-18–patel-fbi-confirms-warrantless-purchase-commercial-data) and DHS’s Penlink PLX contract (2026-04-29–dhs-penlink-plx-no-bid-contract-warrantless-realtime-interception) — the same location-data supply chain the FTC is now narrowly restricting on the sell-side even as federal agencies remain active buyers.