The Federal Trade Commission has wrapped up a long-running enforcement action against data broker Kochava and its subsidiary, Collective Data Solutions, finalising a settlement over alleged violations.
The case was originally brought under the previous administration and centred on concerns about the collection and use of consumer profiles built from sensitive personal information.
Under the terms of the resolution, Kochava and Collective Data Solutions have agreed not to sell or share sensitive location information without first obtaining consumer consent.
The company has also committed to establishing a programme by the autumn to identify sensitive locations, ensuring that location data tied to those spaces is not sold or shared with third parties.
Beyond location data restrictions, the settlement includes requirements for Kochava to implement processes verifying that consumers have provided the requisite consent before their information is used.
The company must also inform consumers of the names of entities to whom their personal information may have been sold or shared, providing greater transparency in its data-sharing practices.
Additional obligations include the implementation of a data deletion and retention schedule, bringing Kochava’s practices more in line with the expectations regulators have set across the industry.
Kochava is further required to submit reports to the FTC if any third parties have shared precise location data in a manner that violates contractual limitations placed on such information.
The conclusion of this case has been a long time in coming and underscores the ongoing concerns that regulators and legislators have with data brokers, on both sides of the aisle.
State legislatures across the country have similarly been directing attention toward data broker activities, signalling that scrutiny of the sector is intensifying at both state and federal levels.
The FTC’s pursuit of Kochava reflects a broader regulatory pattern in which agencies are increasingly focused on the potential harms arising from the large-scale aggregation and sale of sensitive consumer data.
For businesses operating in the data broker space, the settlement serves as a clear signal that consent mechanisms, data retention policies, and transparency obligations are now front and centre for enforcement authorities.