The **Federal Trade Commission (FTC)** and data broker **Kochava** have reached a settlement agreement that will significantly restrict the company's ability to handle sensitive location data. The agreement, which also involves **Kochava's** subsidiary, Collective Data Solutions, aims to protect consumers from the unauthorized sale, sharing, or disclosure of their location information without explicit consent. ### FTC's Complaint Against **Kochava** The **FTC's** initial complaint, filed in 2023, accused **Kochava** of illegally obtaining and selling sensitive consumer data, including yearly incomes, mobile device IDs, app usage, and near real-time geolocation data accurate to within 10 meters. According to the complaint, **Kochava** sold precise geolocation data revealing consumers' visits to sensitive locations such as houses of worship and healthcare clinics, all without their knowledge or consent. The **FTC** argued that this practice violated laws prohibiting unfair and deceptive business practices. The lawsuit against **Kochava** was initiated in August 2022 under the leadership of **FTC** Chair Lina Khan. ### Terms of the Settlement While the proposed order does not include a financial penalty for **Kochava**, it mandates several key changes to the company's data handling practices. Notably, **Kochava** had already agreed to cease sharing or selling sensitive location data as part of a separate class-action lawsuit settlement reached in November. This earlier settlement also required **Kochava** to stop profiting from location data obtained through software development kits (SDKs) embedded in apps and to establish an opt-out mechanism for consumers to delete their data and prevent future collection. According to a **Kochava** spokesperson, the company is "pleased to have reached this proposed settlement and to take this next step toward resolving the **FTC** matter." The spokesperson added that the settlement "reflects **Kochava's** ongoing commitment to privacy and responsible data practices, and formalizes the practical safeguards around privacy and compliance." ### Additional Requirements Under the terms of the **FTC** settlement, **Kochava** must also: * Create a sensitive location data program to identify and catalogue sensitive locations, ensuring that data related to these locations is not sold or shared. * Establish a "supplier assessment" program to verify that consumers have consented to the collection and use of all location data by **Kochava** and its subsidiary. * Notify the **FTC** if it discovers that a third party has disclosed consumers' precise location data in violation of the settlement terms. * Provide consumers with the names of businesses or individuals to whom their precise location data has been sold. * Allow consumers to easily withdraw their consent for the sale of their precise location data. * Implement a "data retention schedule" that mandates the deletion of consumers' data within a predetermined timeframe.