The Context
In June 2022, the U.S. Supreme Court overturned Roe v. Wade, changing the federal legal framework governing abortion access. Following the decision, several states enacted or enforced laws that restricted or prohibited certain reproductive healthcare services.
In response, privacy researchers and regulators began examining how commercially collected location data could be used to identify visits to sensitive locations, including healthcare facilities. Concerns focused on whether location data collected for advertising or analytics purposes could be repurposed in ways that expose individuals to legal, safety, or privacy risks.
In August 2022, the Federal Trade Commission filed a lawsuit against a location data broker. The defendant was Kochava Inc., a company headquartered in Idaho.
The FTC alleged that Kochava sold geolocation data that could be used to track individuals to sensitive locations, including reproductive health clinics, places of worship, addiction recovery centers, and domestic violence shelters.
The Company
Kochava was founded in 2011 by Charles Manning. The company described itself as a mobile attribution and analytics provider, offering tools that help advertisers measure whether ads lead to actions such as app installs, store visits, or purchases.
Mobile attribution services are common within the advertising ecosystem. They typically rely on data collected from mobile devices to link advertising exposure to subsequent activity.
In 2016, Kochava expanded its operations by launching the Kochava Collective, a data marketplace that allowed third parties to purchase location data directly.
According to the FTC’s complaint, Kochava’s datasets included:
- Geolocation data from hundreds of millions of mobile devices, with high geographic precision
- Mobile advertising IDs (MAIDs), which persist over time unless reset by the user
- Timestamped location histories extending over long periods
- Data products linking MAIDs to other identifiers through database relationships
- App usage information and behavioral classifications
- Audience segments based on inferred characteristics and behaviors
The FTC identified examples of audience segments offered through Kochava’s platform, including categories related to health status, caregiving, religious affiliation, pregnancy, and political activity.
Publicly Accessible Data Samples
A key issue raised in the FTC’s case involved how Kochava made portions of its data available.
According to the FTC, until at least mid-2022, Kochava provided access to a sample of its location data through an online marketplace. Access required creating an account and submitting basic contact information.
The FTC stated that this sample included:
- Tens of millions of unique mobile device identifiers
- Recent location data
- Precise geographic coordinates with timestamps
Using this sample, the FTC demonstrated that it was possible to associate a device with visits to specific locations and to observe repeated patterns consistent with daily routines.
The FTC also noted that similar methods could be used to infer visits by healthcare providers or staff at sensitive facilities.
Sensitive Location Categories
The FTC’s complaint described risks associated with tracking visits to certain categories of locations, including:
Reproductive Health Facilities
Location data could indicate visits to clinics providing reproductive healthcare services. The FTC noted that such information could expose individuals to privacy risks depending on jurisdiction and use.
Places of Worship
The data sample included location traces associated with visits to religious institutions. Such data could reveal religious practices or affiliations that individuals may wish to keep private.
Shelters and Support Services
Location traces could reveal visits to homeless shelters, domestic violence shelters, or services for at-risk populations, creating potential safety concerns.
Addiction Treatment Facilities
The data could reveal visits to substance abuse treatment centers, including frequency and duration, potentially exposing individuals to discrimination or stigma.
The FTC Lawsuit
On August 29, 2022, the FTC filed a complaint against Kochava in federal court, alleging violations of Section 5 of the FTC Act.
The FTC argued that Kochava’s sale of precise location data constituted an unfair practice because it:
- Enabled identification and tracking of individuals
- Exposed consumers to risks including stigma, discrimination, harassment, and physical harm
- Invaded consumer privacy
The FTC sought injunctive relief to restrict Kochava’s data practices and require deletion of certain datasets.
Kochava’s Response
Prior to the FTC filing its complaint, Kochava filed its own lawsuit challenging the FTC’s authority. After the FTC proceeded, Kochava publicly disputed the agency’s allegations and characterized the enforcement action as overreaching.
Kochava stated that it was developing features intended to limit the use of sensitive location data and argued that it had not been provided sufficient specificity in early settlement discussions.
The Legal Proceedings
Initial Dismissal (May 2023)
The court initially dismissed the FTC’s complaint, concluding that the agency had not adequately alleged substantial consumer injury. The court allowed the FTC to amend its filing.
Amended Complaint (June 2023)
The FTC submitted an amended complaint with additional detail, including:
- Examples of real-world risks associated with location data exposure
- Detailed descriptions of audience segments
- Allegations regarding insufficient customer screening
- Claims that Kochava marketed the ability to identify individuals
Motion to Dismiss Denied (February 2024)
The court denied Kochava’s motion to dismiss the amended complaint. The court found that the FTC plausibly alleged:
- Secondary harms resulting from the sale of sensitive location data
- Invasion of privacy as a standalone form of substantial injury
Subsequent Filings (2024–2025)
The FTC filed additional amended complaints naming a Kochava subsidiary involved in data brokerage operations. As of the most recent filings, the case remains ongoing.
Class Action Settlement
Separately from the FTC litigation, Kochava faced consumer class action lawsuits in multiple jurisdictions.
In late 2025, a federal court approved a settlement requiring Kochava to implement changes to its data practices, including:
- Filtering location data associated with sensitive locations
- Providing consumer opt-out mechanisms
- Limiting use of collected data to defined purposes
- Implementing consent verification measures with app developers
The settlement did not include significant monetary compensation to class members.
Why Kochava Matters
The Kochava case is frequently cited because it illustrates broader characteristics of the location data ecosystem:
1. Location data can be highly sensitive even when collected for advertising
Precise location trails can reveal medical visits, religious activity, and personal routines.
2. Persistent identifiers enable long-term tracking
Mobile advertising IDs allow devices to be recognized over time and across apps.
3. Disclosure and consent vary widely
Users may not be aware of how location data is collected, shared, or resold.
4. Regulatory enforcement is still evolving
The Kochava case represents one of the first fully litigated FTC actions against a location data broker.
5. Data access controls matter
The availability of large data samples increased exposure risk beyond intended customers.
Protecting Yourself
1. Review location permissions
Limit location access to apps that require it.
- On iPhone: Settings > Privacy & Security > Location Services
- On Android: Settings > Location > App permissions
CYBERSAFETY TIP:
Use “While Using” instead of “Always” whenever possible.
2. Manage advertising identifiers
Reset or disable advertising IDs to reduce cross-app tracking.
3. Be cautious with sensitive app categories
Apps related to health, religion, dating, or recovery can involve heightened privacy risk.
4. Review privacy disclosures
Look for references to third-party SDKs, advertising partners, or data sharing.
5. Reduce device exposure when appropriate
Depending on circumstances, limiting phone use or disabling location services can reduce data collection.
NOTE:
This guidance is informational and does not constitute legal advice.
The Bottom Line
The FTC’s case against Kochava highlights how commercially collected location data can be repurposed in ways that expose individuals to significant privacy risks.
For consumers, the key takeaway is that location data collection is not limited to navigation apps, and third-party data flows can extend beyond user expectations. Understanding permissions, identifiers, and app data practices can help reduce exposure.
Sources
- Federal Trade Commission, FTC v. Kochava filings and orders
- U.S. District Court for the District of Idaho rulings (2023–2025)
- MediaPost reporting on Kochava settlement
- Lawfare analysis of FTC location data enforcement
- Vice Motherboard and The Markup investigative reporting
- TechCrunch reporting on location data brokers