The FTC settled charges with data broker Kochava, Inc. and its subsidiary Collective Data Solutions (CDS) over allegations that they sold precise location data from hundreds of millions of mobile devices without consumer consent, enabling tracking of visits to sensitive locations like reproductive health clinics and places of worship. The settlement prohibits the companies from selling or sharing sensitive location data without affirmative express consumer consent, and imposes compliance requirements including a sensitive location data program, supplier consent assessments, incident reporting, and data retention schedules. No monetary penalty was imposed.
Kochava and CDS are banned from selling, licensing, transferring, sharing, or disclosing sensitive location data without consumers’ affirmative express consent, and only if the data is used to provide a consumer-requested service. The companies must implement a sensitive location data program to identify and block sale of data from sensitive locations, a supplier assessment program to verify consumer consent for all location data, submit incident reports to the FTC when third parties violate data sharing contracts, provide consumers with the ability to request the names of entities that purchased their data and withdraw consent, and establish a data retention schedule requiring deletion of data on a set timeline.
In-house legal teams at companies that collect, process, or share precise geolocation data—including mobile app providers, ad tech vendors, and data brokers—should review vendor and data processing agreements to ensure they require affirmative express consumer consent for the collection, sale, or sharing of precise location data, and explicitly prohibit the disclosure of sensitive location data (e.g., health facilities, places of worship) without consent. Vendor agreements with data brokers must include clauses mandating supplier assessment programs to verify consumer consent for all location data, incident reporting obligations for unauthorized third-party data sharing, and enforceable data retention schedules requiring timely deletion of location data. Customer-facing agreements and privacy policies should be updated to disclose location data collection practices, provide consumers with easy mechanisms to withdraw consent, and outline third-party data sharing. All contracts involving location data should also include audit rights and requirements to comply with applicable FTC enforcement orders.
Entity
Kochava, Inc. and Collective Data Solutions (CDS)
Industry
Data Broker"Kochava and its subsidiary, Collective Data Solutions (CDS), which has taken over Kochava’s data broker business"
"May 4, 2026"
"Federal Trade Commission"
"to settle allegations"
"sold location data from hundreds of millions of mobile devices that could be used to trace the movements of individuals"
"collection, use and disclosure of precise location data invaded consumers’ privacy by revealing their movements, including visits to sensitive locations such as health facilities and places of worship"
The FTC referred a complaint against REPS & Company Inc. and company executives, alleging they bypassed ticket-issuer security controls and purchasing limits to acquire millions of tickets for resale. The complaint was filed by the Department of Justice, and the case will be decided by the court; the press release does not report a penalty or other remedy imposed.
The FTC sued Digital Forensics Corporation LLC and affiliated defendants, alleging they misled sextortion victims with promises of investigative and monitoring services that often were not provided, and used fake positive reviews. A federal court granted the FTC’s request to temporarily halt the defendants’ activities; the complaint remains for the court to decide.
The FTC alleged that Greenway Auto Group advertised vehicle prices thousands of dollars below the amounts consumers actually paid and used mailers falsely suggesting recipients had won cash prizes. Greenway agreed to an order requiring transparent pricing and prohibiting deceptive prize mailers and other misrepresentations; the press release does not state a monetary penalty.
The FTC sent warning letters to 24 large healthcare services companies, cautioning that incomplete, inaccurate, or untimely pricing information for scheduled medical care may be unfair or deceptive. The letters urge recipients to review their price-disclosure practices and take corrective action; they announce no fine or formal order.
$1.9M
The FTC alleged that Premier Franchising Group LLC and Franchise Fastlane LLC made deceptive and unsubstantiated claims about the Premier Martial Arts franchise opportunity and violated the Franchise Rule. The proposed settlements require the companies to pay a combined $1.85 million to compensate franchisees, prohibit certain misrepresentations, and require Franchise Rule compliance; certain franchisees may also cancel their agreements without penalty.
The FTC, Utah, and Nevada sued Lens.com Inc., alleging that it advertised artificially low contact lens prices while hiding mandatory checkout charges and misleading consumers about its AutoRefill subscription. The complaint seeks to stop the alleged practices; the court has not yet decided the case, and no penalty or remedy has been imposed.