A federal judge in Idaho has ordered Sandpoint-based data broker Kochava and its subsidiary to cease collecting and selling sensitive consumer location data without explicit user consent, closing out more than four years of litigation with the Federal Trade Commission.
U.S. District Court Judge B. Lynn Winmill issued the ruling on June 25, finding that Kochava and its subsidiary Collective Data Solutions had engaged in unfair acts and practices in violation of Section 5 of the FTC Act. The court’s order prohibits both companies from selling, sharing, or disclosing sensitive location data without first obtaining clear, affirmative consent from consumers.
What the Court Found
Kochava’s business model centered on purchasing mobile device location data from third-party sources and aggregating it into packages available for sale. The company made geolocation data accessible through the Amazon Web Services Marketplace until June 2022. That data included precise latitude and longitude coordinates, timestamps, and mobile advertising identifiers — collectively pulled from hundreds of millions of mobile devices.
The FTC first raised allegations against Kochava in August 2022, arguing the data it sold was sensitive enough to reveal personal details consumers never intended to share publicly. Among the concerns: the data could be used to identify whether individuals visited abortion clinics, domestic violence shelters, homeless shelters, addiction recovery facilities, or other health-related locations.
In a May 4 news release, the FTC argued that “consumers had no way of avoiding the harm resulting from its collection and disclosure,” underscoring the agency’s position that ordinary mobile users had no realistic means of protecting themselves from the data pipeline Kochava had established.
The court’s findings aligned with the agency’s position, concluding that the data collection and disclosure practices were carried out without consumer knowledge or meaningful consent.
Compliance Requirements Under the Order
Beyond simply barring future sales of sensitive location data without consent, the court’s order sets specific compliance benchmarks. Kochava and Collective Data Solutions have 90 days from the June 25 order date to establish and implement a formal sensitive location data program.
The order also requires corporate accountability from the top. A senior officer — either a chief privacy officer or chief compliance officer — must report directly to corporate leadership on compliance matters at minimum every 12 months. The requirement is designed to ensure data privacy obligations are treated as a boardroom concern rather than a back-office function.
The ruling caps a legal battle that stretched across four years and drew attention far beyond Bonner County, as the case touched on broader questions about the commercial data industry and the limits of consumer privacy protections under federal law.
Broader Implications for Data Privacy
The Kochava case reflects growing federal scrutiny of data brokers who aggregate and sell location information sourced from third parties rather than collected directly. Because the data was not gathered through a direct consumer relationship, many users had no practical awareness their movements were being tracked, packaged, and sold.
The types of locations flagged in the litigation — medical clinics, shelters, and recovery centers — represent places where disclosure of a visit could expose someone to significant personal risk, whether legal, professional, or physical. The court’s focus on these categories signals that regulators and judges are increasingly sensitive to the real-world consequences of granular location data in the commercial marketplace.
For Bonner County, the ruling puts one of the region’s prominent technology companies under a lasting federal compliance framework. Kochava has been a notable presence in Sandpoint’s business community, and how the company structures its data practices going forward will be shaped directly by the court’s mandates.
Questions about digital privacy and the reach of public records in the digital age continue to surface across North Idaho and the broader region. A recent ruling involving a Spokane Valley councilman’s social media posts similarly tested where public and private information begin and end in the modern era.
What Comes Next
With the court order now in effect, Kochava and Collective Data Solutions face a 90-day clock to build and implement a compliant sensitive location data program. Senior officers will be required to report on compliance at least annually. The FTC’s enforcement action effectively sets a legal precedent for how mobile data brokers must handle sensitive consumer information going forward, and federal regulators appear prepared to hold companies to those standards well beyond the courtroom.