FTC settlement bars Kochava from selling sensitive location data

Data broker Kochava and its subsidiary, Collective Data Solutions, can no longer sell or share sensitive location data without users' affirmative express consent, following a Federal Trade Commission settlement announced on May 4, 2026. The agency alleged that Kochava traded location records from hundreds of millions of mobile devices, data that could track individuals to health facilities, places of worship, and other sensitive spots. Kochava did not admit to wrongdoing as part of the agreement.

This legal move follows a wider regulatory push against the location data industry. In December 2024, the FTC acted against two other firms, Gravy Analytics and Mobilewalla, over similar claims regarding the sale of sensitive location data. The risks tied to these practices moved beyond legal theory in January 2025, when Gravy Analytics suffered a breach. A hacker posted what they claimed was 17 terabytes of stolen data on a Russian cybercrime forum. Security researchers who examined a sample of the stolen files identified more than 30 million location points. The data reportedly included device locations at the White House, the Kremlin, and military bases worldwide, originating from common applications such as games and dating apps.

Location data often leaves a phone through advertising and analytics software embedded in ordinary apps. Smartphones use advertising identifiers to connect user activity across different platforms. Apple devices utilize the system advertising identifier, known as IDFA, while Android devices can use Google's advertising ID. When these identifiers are combined with location signals, companies can construct detailed trails of a device's movements. A pattern of a device sleeping at a specific address and appearing at a dialysis center on regular days can reveal sensitive personal habits to entities that possess the data.

The FTC's actions highlight that location data brokers collect movements from everyday apps, but the Gravy Analytics breach demonstrates that these collections remain vulnerable to criminal theft even after regulatory intervention. Once location data is collected and shared among multiple companies in the digital advertising ecosystem, controlling its further distribution becomes difficult for the individual user. A few weeks of location data can potentially expose visits to medical providers, pharmacies, and support groups. This information can also be used to make scam calls more convincing by referencing specific clinics or timing that matches the victim's actual movements.

Users can limit the collection and sharing of their data by adjusting specific phone settings, though these changes do not erase information already collected by third parties. On Apple devices, users can turn off the "Allow Apps to Request to Track" setting. This prevents apps from accessing the IDFA for cross-app tracking purposes. A separate setting controls how Apple personalizes ads in its own services, such as the App Store and Apple News. On Android devices, users can delete their advertising ID through Google's services menu. Deleting this ID causes apps to receive a string of zeros instead of a unique identifier, although it does not stop all forms of analytics or device identification.

Users should also review which applications have permission to access their location. Turning off Location Services entirely can interfere with useful features like navigation. Instead, users should focus on apps that have more access than they need. Weather and shopping apps generally do not require continuous background location access. Deleting dormant apps that have not been used in a long time removes another source of forgotten permissions. These steps reduce the amount of new data available to build detailed user profiles but do not remove existing records held by data brokers or other entities.