FTC files proposed Kochava order limiting sale of sensitive location data

The Federal Trade Commission filed a stipulated order on June 26, 2026, in its Kochava case. The FTC case page still lists the matter as pending, so this is not yet a final court ruling. The order itself is dated June 25, 2026.

What the order would do

The filing would bar Kochava and its subsidiary, Collective Data Solutions, from selling, licensing, transferring, sharing, or disclosing sensitive location data unless they get affirmative express consent and use the data to provide a service directly requested by the consumer. The order also runs for 10 years after a court enters it.

It would also require a sensitive-location data program, supplier-assessment controls, consumer withdrawal tools, incident reporting for certain third-party violations, and a data-retention schedule. The FTC says stipulated final orders have the force of law only after a district judge approves and signs them.

Why the FTC says this matters

The agency says the data at issue could be used to trace movements, including visits to sensitive places such as health facilities and places of worship. That is the privacy concern the FTC has used to justify stricter limits on how precise location data is collected, shared, and resold.

For consumers, the immediate takeaway is simple: app permissions and consent screens still matter, especially when a company says it handles precise location data. For privacy and ad-tech firms, the filing is another sign that the FTC is pressing for clearer consent, tighter retention rules, and more documentation around sensitive data handling. That is an inference from the order’s requirements, not a new nationwide rule.

What to watch next: whether the court enters the order and, if it does, how Kochava and CDS update their consent, retention, and deletion practices.

Sources

• FTC press release: settlement over sensitive location data