On May 4, 2026, the Federal Trade Commission announced a settlement that prohibits data broker Kochava, Inc. and its subsidiary Collective Data Solutions from selling, sharing, or disclosing sensitive location data without consumers' affirmative express consent. The resolution brings to a close litigation the FTC initiated in 2022, and it sends a clear message that the Commission intends to scrutinize the location data industry with renewed vigor. For companies that collect, transact in, or rely upon precise geolocation information, the order establishes a practical compliance benchmark that should be reviewed without delay.
Under the settlement, Kochava must implement a comprehensive sensitive location data program designed to identify and protect categories of geolocation information that can reveal consumers' visits to places such as healthcare facilities, places of worship, or residential addresses. The order further requires Kochava to verify that consumers have given affirmative express consent before their sensitive location data is sold or shared, and to submit incident reports to the FTC when compliance failures or unauthorized disclosures occur. These obligations move the standard well beyond traditional notice-and-choice frameworks, requiring documented, demonstrable consent at the point of collection and through downstream transfers.
The settlement also obligates Kochava to provide consumers with meaningful opt-out rights and to honor disclosure requests, allowing individuals to learn how their data has been handled. Although the order binds only Kochava and Collective Data Solutions, the practical effect is broader. Data brokers, advertising technology providers, mobile application publishers, and downstream advertisers that ingest or activate location data should treat the order as an enforcement roadmap and assess their own consent flows, data-sharing agreements, and incident-response procedures against its requirements.
In the near term, businesses should consider reviewing vendor contracts to confirm that upstream sources can substantiate affirmative express consent, auditing internal classifications of sensitive locations, and strengthening governance over data retention, opt-out mechanisms, and breach reporting. Companies operating in jurisdictions with overlapping state privacy regimes should evaluate whether existing programs satisfy the FTC's heightened expectations.
This alert is provided for general informational purposes only and does not constitute legal advice. Clients facing questions about location data practices, FTC enforcement risk, or related compliance matters should seek tailored counsel addressing their specific circumstances.