• by Wendy Davis , Yesterday

A federal judge in Idaho on Wednesday granted final approval to a settlement requiring data broker Kochava to revise some privacy practices to settle class-action claims over the  alleged sale of app users' location data.

"I think I can easily find that this settlement is fair, reasonable and adequate," U.S. District Court Judge B. Lynn Winmill said at the conclusion of a brief hearing conducted over Zoom (and available to the public via an audio line).

He added that a critical component of the settlement is that it doesn't require class members -- meaning U.S. adults whose data was sold by Kochava without their consent -- to waive their right to seek monetary damages in the future.

Kochava specifically agreed to an injunction that will last for two years, and will require implementation of a "privacy block" feature that aims to prevent the sharing or use of raw location data associated with health care facilities, schools, jails and other sensitive venues.

The settlement also requires the company to allow consumers to opt out of data collection by submitting “a simple web form.” People who opt out will be placed on a “blacklist" that will prevent all use of the data -- including for machine learning purposes.

Another provision obligates Kochava to ensure that any location data it collects from an app will be used “exclusively for the benefit” of that app.

The company also will have to request examples of "consumer consent prompts" from the app developers that supply it with data, and will stop using location data collected from people who did not consent.

The deal also requires Kochava to pay attorneys' fees of around $1.5 million, and $2,500 each to the seven app users who served as lead plaintiffs.

Kochava said in its written motion for final approval that it would not be able to pay a class-wide monetary damage award due to its "limited financial resources and lack of sufficient insurance coverage."

A company spokesperson said Wednesday that protecting consumer data "has always been -- and will remain -- a top priority for Kochava."

The spokesperson added: "This settlement marks a positive step forward for U.S. data privacy, and we look forward to continued progress in this critical area. Kochava remains committed to advocating for clear and effective data privacy regulations that protect consumers and advertisers alike."

The deal resolves several lawsuits brought in 2022 and 2023 over allegations that Kochava obtained and sold precise location data that originated with mobile apps.

The suits were filed soon after the Federal Trade Commission charged Kochava with acting unfairly by allegedly selling data that could expose sensitive information, such as whether people visited doctors' offices or religious institutions.

Among other allegations, the FTC alleged that Kochava sells precise geolocation data as well as mobile advertising IDs -- unique, 32-character identifiers that persist, unless consumers reset them.

Kochava, based in Sandpoint, Idaho, has argued that data it sells isn't personally identifiable, and that the FTC's allegations -- even if proven true -- wouldn't amount to unfair conduct.

Kochava initially rolled out its "privacy block" in 2022, shortly before the FTC sued. At the time, the company said the tool would filter out “health services location data.”

The settlement requires Kochava to filter out a broader range of data -- including locations associated with religious establishments, schools, childcare centers, homeless shelters, jails and offices providing services based on factors like LGBTQ+ status, political affiliation and religious beliefs.

A Kochava spokesperson said the privacy block feature is "updated on an ongoing basis to filter out a variety of potentially sensitive locations."