• by Wendy Davis , January 31, 2025

Mobile data broker Kochava has agreed to revise some privacy practices to settle class-action claims over the alleged sale of location data, according to court papers filed Thursday,

Among other changes, the company has agreed to implement a feature aimed at blocking the sharing or use of raw location data associated with health care facilities, schools, jails and other sensitive venues.

The proposed settlement terms, filed Thursday with U.S. District Court Judge B. Lynn Winmill in Coeur D'Alene, Idaho, also requires the company to allow consumers to opt out of data collection by submitting “a simple web form,” and place opted-out consumers on a blacklist that Kochava says will “prevent all future ingestion, use, and/or sale” of their data.

Another provision requires Kochava to ensure that any location data it collects from an app will be used “exclusively for the benefit” of that app -- unless the data was collected with consumers' express consent.

The settlement calls for the company to pay attorneys' fees of up to $1.5 million, and awards of up to $17,500 for the lead plaintiffs, but doesn't otherwise provide for monetary damages.

According to the court papers, the data broker told the plaintiffs that it “lacks adequate insurance coverage for the claims,” and “that its financial condition both precluded a monetary settlement and virtually guaranteed Kochava would cease to operate” if it lost the case.

If finalized, the deal will resolve several lawsuits dating to 2022 and 2023 over allegations that Kochava obtained and sold precise location data that originated with mobile apps.

The suits were filed soon after the Federal Trade Commission charged Kochava with acting unfairly by allegedly selling data that could expose sensitive information, such as whether people visited doctors' offices or religious institutions.

Among other allegations, the FTC alleged that Kochava sells precise geolocation data as well as mobile advertising IDs -- unique, 32-character identifiers that persist, unless consumers reset them.

Kochava, based in Sandpoint, Idaho, has argued that data it sells isn't personally identifiable, and that the FTC's allegations -- even if proven true -- wouldn't amount to unfair conduct.

A company spokesperson said the agreement “memorializes” Kochava's filtering tool -- dubbed Privacy Block -- “as a sensible and practical tool.”

“The settlement is a step in the right direction for U.S. data privacy and we look forward to continued progress in this arena,” the spokesperson stated.

Kochava rolled out Privacy Block in 2022, shortly before the FTC sued. At the time, the company said the tool would filter out “health services location data.”

The settlement agreement requires Kochava to filter out a broader range of data -- including locations associated with religious establishments, schools, childcare centers, homeless shelters, jails and offices providing services based on factors like LGBTQ+ status, political affiliation and religious beliefs.

Kochava told Winmill in October that it had settled the class-action suits, but didn't file a proposed agreement until Thursday.

The company is continuing to fight the FTC's charges.