The Federal Trade Commission proposed a settlement that would ban data broker Kochava and its subsidiary Collective Data Solutions from selling sensitive location data tied to millions of mobile devices unless consumers give affirmative express consent. The action resolves a case the agency first brought in 2022, when it alleged Kochava sold precise geolocation records that could track people to reproductive health clinics, places of worship, and other sensitive sites. The settlement adds to a growing string of FTC enforcement actions against companies that profit from selling Americans’ location histories without meaningful permission.
Why the Kochava ban reshapes the data broker business
The proposed order does not simply fine Kochava and move on. According to the FTC’s May 2026 announcement, the agency intends to prohibit Kochava and Collective Data Solutions from selling, sharing, or disclosing sensitive location data unless the use is tied to a service a consumer specifically requested and the consumer has given clear, affirmative consent. That structure goes beyond a slap-on-the-wrist penalty. It removes the core revenue mechanism, direct sales of raw location feeds, unless Kochava can prove each transaction rests on verified consumer permission.
The FTC’s approach here mirrors the consent framework it applied in a finalized order against GM and OnStar earlier this year, which settled allegations that the automaker collected and sold geolocation data without informed consent. Together, these cases signal that the agency treats precise location data as inherently sensitive, regardless of whether the seller is a standalone data broker or a car manufacturer bundling telematics with its vehicles. For data brokers, the message is that “business as usual” location monetization now faces structural limits rather than case-by-case penalties.
A reasonable question is whether consent mandates will simply push data brokers away from direct sales and toward less visible channels. The FTC’s December 2024 action against Mobilewalla is instructive on this point. In that case, the agency alleged the company collected and sold sensitive location data without reasonable steps to verify consent, and separately addressed Mobilewalla’s collection and retention of data obtained through real-time bidding ad auctions. That detail matters because real-time bidding systems let companies harvest location signals during the split-second process of serving a digital ad, without any direct sale ever taking place. If the FTC is already scrutinizing auction-derived data, the escape hatch for brokers looking to sidestep consent rules through programmatic advertising may be narrower than the industry assumes.
At the same time, consent-based limits do not necessarily spell the end of location analytics. They may instead push brokers toward more aggregated products, such as foot-traffic trends that are not traceable to individual devices, or toward partnerships where consent is gathered upstream by app developers or service providers. How much revenue can be preserved under those models will depend on whether advertisers and other buyers view aggregated or consent-limited data as an adequate substitute for the highly granular feeds that enforcement actions are targeting.
No public data yet quantifies whether enforcement volumes in ad-tech filings have shifted since the Mobilewalla and Kochava actions. Comparing pre- and post-2024 filing patterns would be the clearest test of whether consent mandates are accelerating a migration to auction-based data streams, but those records are not yet available in a form that allows direct comparison. For now, the clearest signal comes from the FTC’s choice of targets and remedies rather than from industry-wide metrics.
How the FTC built its case against Kochava
The enforcement trail stretches back to August 2022, when the FTC filed suit against Kochava for selling precise geolocation data linked to unique mobile device identifiers. The complaint described how buyers could use those identifiers to trace individual devices to specific sensitive locations, including reproductive health clinics and places of worship. The agency argued that this practice exposed consumers to stigma, discrimination, and physical danger, particularly after the Supreme Court’s 2022 decision in Dobbs v. Jackson Women’s Health Organization raised the stakes for anyone visiting reproductive health facilities.
The FTC alleged that Kochava obtained location data from a variety of sources and then packaged it into datasets that mapped device movements over time. Because each device was associated with a persistent advertising identifier, a purchaser could, in the agency’s telling, follow a phone from a home address to a clinic or religious institution and back again. The complaint emphasized that such tracking did not require any specialized technical skill beyond the ability to work with common data files, underscoring the breadth of potential misuse.
The proposed settlement announced in May 2026 resolves those charges by imposing the consent requirement and extending it to Collective Data Solutions, a Kochava subsidiary. The FTC’s case page lists the docket materials and proposed stipulated order, though the full text of the order has not been released in unredacted form. No public statement from Kochava responding to the settlement terms has appeared in the enforcement record, leaving the company’s view of the allegations and remedies largely unknown.
The Mobilewalla case adds a second data point that clarifies the FTC’s theory. There, the agency alleged the company sold location data tied to sensitive sites without taking reasonable steps to confirm that the people whose phones generated those signals had agreed to the collection. The complaint also focused on Mobilewalla’s use of real-time bidding auctions as a source of raw data, suggesting that the FTC views consent obligations as following the data through multiple layers of the ad-tech stack. Taken together, the Kochava and Mobilewalla matters show that the enforcement theory is not limited to one business model or data source.
Gaps in the enforcement record and what to watch next
Several questions remain open. The proposed Kochava settlement does not include a publicly disclosed monetary penalty, and no primary docket entry confirms the exact consent language or the scope of penalties beyond the press release summary. Without access to the unredacted order, it is difficult to assess how “affirmative express consent” will be defined in practice, whether it requires an opt-in checkbox, a signed agreement, or some other clear signal that a consumer understands and agrees to the tracking and sale of their precise location.
Kochava’s client base and the volume of location data it sold are also opaque. The FTC described the data as linked to “millions” of mobile devices, but did not break down how many buyers received those feeds, what sectors they represented, or how long they retained the information. That lack of detail makes it hard to gauge how far the proposed ban will ripple through downstream users that may have built products, risk models, or advertising tools on top of Kochava’s feeds.
Another unresolved issue is how the FTC will monitor compliance. Consent-based regimes are only as strong as the verification and auditing behind them. The press materials do not spell out whether Kochava must submit to third-party assessments, maintain detailed logs of consent flows, or provide periodic reports to the agency. Future filings in the docket may clarify these monitoring obligations, but until then, the practical enforceability of the consent standard remains an open question.
Looking ahead, observers will be watching for three main signals. First, whether the Kochava order is finalized without substantial changes, which would cement the consent framework as a template for future cases. Second, whether the FTC brings additional actions against other data brokers or ad-tech intermediaries that rely on similar location feeds, indicating that the agency is moving from one-off enforcement to a broader campaign. Third, whether Congress or state legislatures respond by codifying location-specific protections that go beyond case-by-case FTC orders.
For now, the proposed Kochava settlement marks a notable escalation in how U.S. regulators treat commercial location tracking. By tying the ability to sell sensitive location data directly to demonstrable consumer consent, the FTC is testing whether it can reshape the incentives of an industry that has long treated people’s movements as just another commodity. How data brokers adapt-and how rigorously the agency enforces its new standards-will determine whether this case becomes a turning point or simply another warning shot in the ongoing battle over location privacy.
More from Morning Overview
*This article was researched with the help of AI, with human editors creating the final content.
