Run a free scan

Kochava: know where your app’s location data goes after the SDK sends it

An analytics or attribution SDK in your app can be the start of a data broker’s product. The FTC’s case against Kochava describes precise location points tied to advertising IDs, gathered partly through an SDK in thousands of apps, and sold in feeds that could trace a phone from a clinic to a home. Nearly four years of litigation ended in June 2026 with a ban on selling sensitive location data.

US District Court, D. Idaho · FTC Act Section 5 (unfairness) · Stipulated order entered 25 June 2026

The problem

The FTC alleged that Kochava sold timestamped latitude and longitude points, each tied to a mobile advertising ID (MAID), from millions of devices, and also sold data linking those IDs to names, addresses, emails and phone numbers (Second Amended Complaint ¶¶ 3–4, 16–17). Using only Kochava’s free sample, the FTC said it followed one device from a women’s reproductive health clinic to a single-family home (¶ 42). These are allegations; Kochava neither admitted nor denied them (Order, Findings ¶ 3).

Case record

Court
US District Court, District of Idaho; Judge B. Lynn Winmill
Case number
2:22-cv-00377-BLW
Parties
FTC v. Kochava Inc. and Collective Data Solutions, LLC
Counsel
FTC: Brian Shull, Julia A. Horwitz, Elizabeth C. Scott ([SAC](https://www.ftc.gov/system/files/ftc_gov/pdf/86-SecondAmendedComplaint.pdf)); defence not stated in the cited record
Law
FTC Act Section 5(a), unfairness under Section 5(n)
Stage
Stipulated order entered 25 June 2026 ([Dkt. 138](https://www.ftc.gov/system/files/ftc_gov/pdf/Kochava-Order.pdf))
Amount
None; injunctive relief only
Source review
17 October 2026

What the regulator alleged

What the regulator alleged
CountWhat the law requiresFacts allegedResult
I: unfair use and sale of sensitive dataNo practice causing substantial injury that consumers cannot reasonably avoid and that is not outweighed by benefits (15 U.S.C. § 45(n))Defendants used and disclosed precise location, app usage and identifying data revealing sensitive information, without consumers' knowledge or consent ([SAC ¶¶ 46, 132–134](https://www.ftc.gov/system/files/ftc_gov/pdf/86-SecondAmendedComplaint.pdf))Original complaint dismissed with leave to amend; amended claim survived a motion to dismiss on 3 February 2024; then settled

The court’s 2024 ruling held the FTC had plausibly alleged substantial injury from the privacy intrusion itself and from the risk of harm by third parties. It found that the amended complaint alleged Kochava "itself makes inferences about consumers" rather than only selling raw data (Dkt. 71 at 13–14).

Technical issue

  • Tools or vendors: Kochava’s precise location feed, its "Database Graph" identity profiles and its "App Graph", built partly from the Free App Analytics SDK installed in at least "10,000 apps globally" (SAC ¶¶ 23–25, 61–63).
  • What data: latitude, longitude, timestamp, horizontal accuracy, IP address and MAID; app names, usage time and in-app spend linked to the MAID (¶¶ 16, 31–32, 64).
  • The SDK licence: developers using the free SDK granted Kochava a "perpetual, irrevocable, worldwide, transferrable unrestricted license" to the data it collected (¶ 62).
  • Scale: Kochava advertised "94B+ geo transactions per month" and 125 million monthly active users. One day of the free sample on AWS Marketplace held over 327 million rows covering more than 61.8 million devices (¶¶ 33–36).
  • Access: the sample required only a free AWS account and Kochava’s approval, alongside a USD 25,000 paid feed, until about June 2022 (¶¶ 35–40).
  • How it came to light: FTC staff analysis of the public sample, which identified devices at places of worship and a shelter for at-risk pregnant women and new mothers (¶¶ 42–44).

Inth’s technical interpretation: a MAID plus repeated precise coordinates is an identity, because night-time points show where a device sleeps. For app teams the lesson is upstream: an SDK’s licence terms decide where your users' location goes next, and the app store permission prompt says nothing about that.

Illustrative pattern, not the defendant’s code. Generic SDK and consent calls.

// Bad: attribution SDK starts with precise location and the ad ID on launch
import adSdk from 'some-attribution-sdk';
adSdk.init({ appId: APP_ID, collectLocation: 'precise', collectAdId: true });
navigator.geolocation.watchPosition((p) => adSdk.track('loc', p.coords));

Illustrative pattern, not the defendant’s code. Generic SDK and consent calls.

// Fixed: no location to ad or attribution SDKs; ad ID only after consent
import adSdk from 'some-attribution-sdk';
adSdk.init({ appId: APP_ID, collectLocation: 'none', collectAdId: false });
if (consent.has('marketing')) adSdk.setCollectAdId(true);
// Location stays in first-party features the user asked for, never in ad payloads

Timeline

Timeline
DateEvent
29 August 2022Complaint filed ([FTC](https://www.ftc.gov/legal-library/browse/cases-proceedings/ftc-v-kochava-inc))
2023Original complaint dismissed with leave to amend (Dkt. 24); amended 5 June 2023 ([Order](https://www.ftc.gov/system/files/ftc_gov/pdf/Kochava-Order.pdf); [Dkt. 71](https://www.ftc.gov/system/files/ftc_gov/pdf/71-OpiniononMTD.pdf))
3 February 2024Motion to dismiss amended complaint denied ([Dkt. 71](https://www.ftc.gov/system/files/ftc_gov/pdf/71-OpiniononMTD.pdf))
15 July 2024Second amended complaint adds Collective Data Solutions ([SAC](https://www.ftc.gov/system/files/ftc_gov/pdf/86-SecondAmendedComplaint.pdf))
4 May 2026Proposed stipulated order; Commission vote 2-0 ([FTC](https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-ban-kochava-subsidiary-selling-sensitive-location-data-settle-charges-they-sold-location-data))
25 June 2026Order entered ([Dkt. 138](https://www.ftc.gov/system/files/ftc_gov/pdf/Kochava-Order.pdf))

Outcome

The stipulated order binds Kochava and Collective Data Solutions for 10 years (Order § XVIII). Several duties apply to Kochava itself only if it sells or uses precise location data directly.

  • § II: no selling, licensing or sharing of location data tied to sensitive locations: medical facilities, religious organisations, schools and childcare for minors, shelters for homeless people or domestic-violence survivors, and military or federal law-enforcement sites (Definition M). The exception needs a direct relationship, affirmative express consent and a service the consumer asked for.
  • § III: a programme to maintain the list of sensitive locations and block related data.
  • § VI: a supplier assessment programme to confirm consent for location data bought from others, and to stop using data where consent is not confirmed.
  • §§ VII–X: consumers can ask which recipients got their data (or have deletion requests passed to them), withdraw consent, and have data deleted within 30 days.
  • §§ XI–XII: a published retention schedule; historical location data deidentified or rendered non-sensitive within 90 days unless consent records exist.
  • § IV: customers who received precise location data in the past two years get a copy of the order.

There is no monetary judgment, and the order is not a finding that Kochava broke the law.

What it cost

What it cost
ItemAmount or term
Civil penalty or redressNone ([FTC release](https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-ban-kochava-subsidiary-selling-sensitive-location-data-settle-charges-they-sold-location-data))
Order term10 years from entry
Compliance programmesSensitive-location, supplier assessment and privacy programmes
Defence costsNot stated in the cited record

Why it matters

Unlike the other FTC orders in this library, Kochava was litigated before it settled, and the February 2024 ruling held that the privacy intrusion itself could plausibly be a substantial injury under Section 5. The same company’s SDK is at the root of the private pen-register theory in Greenley v. Kochava. See IP addresses and device identifiers and FTC Act and HBNR.

How Inth catches this

  • Code audit: tracker and SDK detection flags a pull request that adds an attribution or analytics SDK to an app, and data flow mapping traces location coordinates and the advertising ID into that SDK’s calls.
  • Website audit: not applicable to native app SDK traffic; it observes websites.
  • Consent banner: not applicable to native app SDKs as described here; it governs web tags.
  • Evidence: Code audit findings keep the commit, file, data flow and the owner’s decision.

Inth cannot see what an SDK vendor or data broker does with data after receipt, or check the consent a broker claims from its suppliers; that needs contracts and vendor disclosures.

Checks for your own systems

In the repository

  • List every SDK in your mobile builds (Gradle, CocoaPods, npm) and whether it can read location or the ad ID.
  • Find code that passes coordinates, IP addresses or the ad ID into third-party SDK calls.
  • Check SDK configuration flags for location and ad-ID collection and their defaults.

In the app and network

  • Run the app through a proxy on a test device; filter for SDK hosts and look for latitude, longitude or ad-ID fields.
  • Repeat with location permission granted and denied, and with ad tracking limited.

With the people responsible

  • Read each SDK’s licence: can the vendor resell or reuse collected data, and does that survive termination?
  • Confirm your privacy notice names the SDK vendors that receive location or device IDs.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Kochava’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.