• by Wendy Davis , 9 hours ago

The data broker Kochava has negotiated a privacy settlement with Federal Trade Commission lawyers over the alleged sale of geolocation data, according to court papers filed Thursday.

The deal has not yet officially been approved by a majority of FTC commissioners, and details of the settlement aren't yet available.

If finalized, the deal will resolve claims by the FTC that Kochava wrongly sells the type of geolocation data that could expose sensitive information -- such as whether people visited doctors' offices or religious institutions.

A company spokesperson said Thursday that Kochava "has always operated consistently and proactively in compliance with all rules and laws, including those specific to privacy."

The FTC alleged in an August 2022 lawsuit that Kochava sells precise geolocation data as well as mobile advertising IDs -- unique, 32-character identifiers that persist, unless consumers proactively reset them.

Kochava sought to have the charges dismissed, arguing that this data isn't “personally identifiable,” and that the allegations against it -- even if proven true -- wouldn't violate the FTC Act's prohibition on "unfair" business practices. 

U.S. District Court Judge B. Lynn Winmill in Idaho rejected requests by Kochava to throw out the case.

“Kochava allegedly provides its customers with vast amounts of essentially non-anonymized information about millions of mobile device users’ past physical locations, personal characteristics (including age, ethnicity, and gender), religious and political affiliations, marital and parental statuses, economic statuses, and more,” Winmill wrote in a 2024 ruling.

“This alleged invasion of privacy -- which is substantial both in quantity and quality -- plausibly constitutes a 'substantial injury' to consumers,” he added.

After the FTC sued Kochavca, consumers brought a class-action lawsuit against the company.

Kochava settled that matter last year by agreeing to follow certain privacy practices in the future.

Among other settlement terms, Kochava said that for at least two years it will implement a "privacy block" feature that aims to prevent the sharing or use of raw location data associated with health care facilities, schools, jails and other sensitive venues.