Run a free scan

Greenley v. Kochava: the app SDK ruling that started California’s pen register lawsuits

Know what every third-party SDK in your app collects and who it sells to. This 2023 ruling, about a data broker’s SDK, became the authority that later website pen register complaints cited.

US District Court, Southern District of California · CIPA §638.51 · Order on motion to dismiss, 27 July 2023

The problem

David Greenley alleged that Kochava, a data broker, gave app developers a software development kit and, in return, the SDK "surreptitiously intercept[ed] location data" from app users. Kochava then sold "customized data feeds" for advertising and foot-traffic analysis (Order, ECF 27 at 2, citing Am. Compl. ¶¶ 6–7, 83). Kochava denied the claims.

Case record

Court
US District Court, S.D. Cal.
Case number
3:22-cv-01327-BAS-AHG
Parties
David Greenley (later Shahnaz Zarif and Sheri Bate) v. Kochava, Inc.
Counsel
Not stated in the opened orders
Laws
CIPA §§ 638.51, 631, 632; Penal Code §502; Cal. Const. art. I §1; UCL; unjust enrichment
Stage
Motion to dismiss granted in part; later dismissed without prejudice by agreement
Amount
None. Each side bore its own costs and fees
Source review
17 October 2026

What was alleged

What was alleged
ClaimWhat the law requiresFacts allegedResult
CIPA §638.51 (pen register)Installing a device or process that records addressing or signalling information, without a court orderThe SDK, embedded in apps, collected and correlated device data through "fingerprinting"Survived
CIPA §631Reading the contents of a communication in transit without consentThe SDK collected search terms, in-app activity and ad clicksSurvived
Penal Code §502Access without permissionKochava advertised collecting data "even after a consumer thinks [he has] disabled all tracking by apps on an iPhone"Survived
Constitutional privacySerious invasion of a privacy interestLocation data, including visits to "sensitive locations"Survived
CIPA §632, UCL, unjust enrichmentConfidential communication; unlawful practice; a standalone claimSame factsDismissed with leave to amend

Technical issue

  • Tools or vendors: Kochava’s SDK inside third-party apps.
  • Where: iOS and Android apps that integrated the SDK.
  • What data: geolocation linked to device fingerprints, search terms, click choices, purchase decisions and in-app activity (Am. Compl. ¶¶ 75–80, 125, as summarised in ECF 27 at 2–3).
  • When: in the background while apps ran, including after users had turned off app tracking in iOS, as alleged.
  • How it came to light: the complaint relied on Kochava’s own statements and on the Federal Trade Commission’s August 2022 lawsuit against Kochava in Idaho (ECF 27 at 3). See FTC v. Kochava.

Inth’s technical interpretation: an SDK runs with your app’s permissions. If your app holds location permission, a bundled SDK can read location too, and the app store sees your app, not the vendor, as the collector. The SDK’s data flows are your data flows.

Illustrative pattern, not the defendant’s code. ThirdPartyDataSDK is a generic name, not a real API.

// Bad: data SDK starts at launch and inherits location access
func application(_ app: UIApplication,
                 didFinishLaunchingWithOptions opts: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {
  ThirdPartyDataSDK.start(appId: "APP_ID")
  locationManager.startUpdatingLocation()
  return true
}

Illustrative pattern, not the defendant’s code. The consent check is generic.

import AppTrackingTransparency

// Fixed: no data SDK unless the user allowed tracking and opted in
func startDataSDKIfAllowed() {
  ATTrackingManager.requestTrackingAuthorization { status in
    guard status == .authorized, consent.has("marketing") else { return }
    ThirdPartyDataSDK.start(appId: "APP_ID", collectLocation: false)
  }
}

Timeline

Timeline
DateEvent
September 2022Complaint filed, a week after the FTC sued Kochava
21 November 2022First amended complaint
27 July 2023Motion to dismiss granted in part, denied in part; transfer denied
3 November 2023Two new plaintiffs added
8 April 2024Case stayed for mediation ([ECF 65 order](https://www.govinfo.gov/content/pkg/USCOURTS-casd-3_22-cv-01327/pdf/USCOURTS-casd-3_22-cv-01327-3.pdf))
17 October 2024Dismissed without prejudice on joint motion ([ECF 87](https://www.govinfo.gov/content/pkg/USCOURTS-casd-3_22-cv-01327/pdf/USCOURTS-casd-3_22-cv-01327-4.pdf))

Outcome

The court found no earlier decision interpreting §638.51 ("it seems no court has interpreted this provision"). It read the definition as "specific as to the type of data a pen register collects" but "vague and inclusive as to the form of the collection tool", so courts "should focus less on the form of the data collector and more on the result." A process "can take many forms. Surely among them is software that identifies consumers, gathers data, and correlates that data through unique 'fingerprinting'" (ECF 27 at 26–28). That a warrantless pen register might not offend the Fourth Amendment was "immaterial"; the claim is installation without a court order.

The order is reported at 684 F. Supp. 3d 1024. It is a district court ruling on the pleadings, not a finding that Kochava did anything, and it binds no other court. The case ended in October 2024 by stipulated dismissal without prejudice; no class was certified and no settlement terms are in the cited record.

What it cost

What it cost
ItemAmount
Damages or settlementNot stated in the cited record
Costs and feesEach side bore its own ([ECF 87](https://www.govinfo.gov/content/pkg/USCOURTS-casd-3_22-cv-01327/pdf/USCOURTS-casd-3_22-cv-01327-4.pdf))

Why it matters

Greenley’s "process" reading carried over to websites. Shah v. Fandom and Mirmalek v. Los Angeles Times relied on it for ad trackers. Los Angeles judges were less receptive: Casillas v. Transitions Optical called Kochava a data broker whose conduct "was very different" from an ordinary website. The Court of Appeal’s 2026 tentative in Rose v. Variety Media agreed the statute is technology-neutral but read "pen register" more narrowly than Greenley’s focus on results.

SB 690 status: SB 690 (Stats. 2026, ch. 976), signed on 30 September 2026 and operative on 1 January 2027 (the default effective date for a 2026 statute), lets only the Attorney General sue a private actor over §638.51 conduct on a website, online application or mobile application. It reaches pending claims in actions filed on or after 1 January 2025, and leaves §631, §632 and §632.7 untouched (bill text). This action was filed in 2022 and dismissed in 2024, so SB 690 does not change it. The §631 and constitutional privacy theories that also survived here are untouched by SB 690.

How Inth catches this

  • Code audit: flags a pull request that adds a third-party data, attribution or identity SDK to the app’s dependencies, and traces location and device identifiers from the platform API into the SDK’s calls.
  • Website audit: observes websites, not native apps, so it would not see this SDK.
  • Consent banner: Inth Consent’s helpers are for website tags; for an app SDK the consent check has to live in your app code.
  • Evidence: the Code audit finding history (commit, pull request, owner, approval) for each SDK added.

Inth cannot see what an SDK vendor does with data on its own servers, or whether it sells it; that needs the vendor contract and its disclosures.

Checks for your own systems

In the repository

  • List every SDK in Podfile.lock, Package.resolved and build.gradle, with its vendor and purpose.
  • Check which SDKs start before the tracking prompt or consent screen.
  • Search for location, advertising ID and device-fingerprint calls inside vendor code paths.

In the browser and network

  • Run the app through a proxy on a test device, deny tracking, and list every vendor host the app still contacts.

With the people responsible

  • Ask each SDK vendor whether it sells or licenses data collected through your app.
  • Compare your App Store and Play privacy labels with what the SDKs actually send.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Kochava’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.