The Federal Trade Commission just dropped the hammer on a massive corporate data broker.
As of May 4, 2026, the FTC is officially banning an Idaho-based company called Kochava, along with its subsidiary Collective Data Solutions, from selling your sensitive, precise location data without your explicit permission.
A federal judge in the U.S. District Court for the District of Idaho is signing off on this stipulated final order, which instantly gives it the full force of the law.
The momentum for this terminal enforcement action was accelerated by an intense, multi-year political pressure campaign following the reversal of federal abortion protections, which instantly weaponized routine smartphone telemetry against citizens visiting reproductive health clinics.
Facing parallel class-action lawsuits across California, Massachusetts, and Idaho, alongside escalating scrutiny from European privacy regulators targeting underlying cookie infrastructure, federal enforcers required a definitive, high-profile victory to codify a hardline national standard.
A data broker is a company that sweeps up your personal information, in this case, the highly precise GPS coordinates broadcasting from your cell phone, and packages it up to sell to third parties.
According to the FTC, Kochava was sitting on location data linked to hundreds of millions of mobile devices.
The problem was never just about an advertiser knowing what coffee shop you visited.
The FTC alleged this data was so razor-sharp it could trace individuals walking into highly sensitive, private locations.
We are talking about tracking people visiting reproductive health clinics, hospitals, and places of worship.
The average person walking down the street had absolutely no idea this invisible tracking was happening behind the scenes, meaning they had zero ability to avoid the harm.
This settlement delivers a systemic shock to the broader data economy, permanently fracturing the lucrative secondary market that trades on unmasked consumer movements.
Now, the federal government is forcing a total operational overhaul on how Kochava and its subsidiary, which recently took over the data broker business, operate.
They are permanently prohibited from selling, licensing, sharing, or transferring sensitive location data in any of their products or services.
There is exactly one narrow escape hatch for the companies. They can only share this sensitive data if they get what the regulators call "affirmative express consent.”
In plain English, that means you have to clearly and actively say "yes" to the tracking.
Furthermore, the data can only be used to provide a specific service that you directly requested. No more hiding the tracking software in page fifty of an unreadable user agreement.
By functionally outlawing the opaque collection of Mobile Ad Identifiers (MAIDs) tied to geospatial points, regulators are triggering a massive consolidation of power in the tech sector.
Independent third-party brokers will suffocate under skyrocketing compliance and audit costs, handing a functional monopoly in targeted advertising to first-party behemoths like Apple and Google, who operate the underlying mobile operating systems and inherently command user consent.
The compliance mandates hitting Kochava and Collective Data Solutions are heavy.
They must immediately build a comprehensive sensitive location data program.
This requires them to actually list out sensitive locations and actively block the sale, transfer, or disclosure of data tied to those exact spots.
It does not stop there. The companies have to aggressively audit their own suppliers. They must implement a strict assessment program to definitively confirm that consumers actually consented to having their location tracked in the first place.
If they catch a third party sharing this precise data and violating their contractual requirements, they are mandated to submit incident reports directly to the FTC.
This order also creates powerful new rights for the average person holding a smartphone.
Consumers can now demand the names of any individual or business that Kochava or its subsidiary sold their precise location data to.
The companies are also legally required to build an easy, frictionless way for users to withdraw their consent.
State governments previously blocked from regulating interstate data flow will now weaponize this federal precedent, expanding the definition of "sensitive inferences" to target automated pricing models, insurance underwriting, and consumer credit scoring.
Finally, the era of hoarding data forever is over. The companies must establish a strict data retention schedule. They are legally mandated to delete consumer data on an established, predictable timeframe.
