United States of America: Federal Trade Commission reached settlement with Kochava and Collective Data Solutions resolving allegations of unlawful sale of sensitive location data

On 4 May 2026, the Federal Trade Commission (FTC) filed a stipulated order for injunction and other relief with the United States District Court for the District of Idaho, resolving the proceedings against Kochava and Collective Data Solutions (CDS). The FTC had initiated the case in August 2022, later amending the complaint on 5 June 2023 and 15 July 2024, alleging violations of Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45) in relation to the sale of precise location data from mobile devices, including data that could indicate visits to sensitive locations such as medical facilities, religious organisations, and shelters. Under the stipulated order, Kochava and CDS are prohibited from selling, licensing, transferring, sharing, or disclosing sensitive location data unless consumers have provided affirmative express consent and the data is used to deliver a service directly requested by the consumer. CDS is required to establish a Sensitive Location Data Programme and a Supplier Assessment Programme within 90 days. Both defendants must de-identify historical location data within 90 days, publish a data retention schedule for covered information within 60 days, and provide mechanisms for consumers to withdraw consent and request deletion of precise location data. They are also required to submit third-party incident reports to the FTC within 30 days of identifying a contractual violation and implement a comprehensive privacy programme within 90 days. The stipulated order remains in effect for 10 years from the date of entry.