The Kochava Location Data Settlement: What It Means for Clinics
After nearly four years of litigation, the FTC's case against data broker Kochava ended in a 2026 court order. What it covers and what it means for clinic websites, apps and ads.
A patient's phone can reveal that they visited your clinic even if they never filled out a form on your website. Apps on that phone may collect precise location data, pass it to data brokers, and from there it can be sold to almost anyone. That is the practice at the center of the FTC's long-running case against Idaho data broker Kochava.
The case ended in 2026 with a stipulated court order rather than a trial. Here is what happened, what the order requires, and what clinics and telehealth companies can take from it for their own websites, apps and advertising.
How the case unfolded
| Date | Event |
|---|---|
| August 29, 2022 | FTC sues Kochava in federal court in Idaho, by a 4 to 1 Commission vote |
| May 4, 2023 | Judge B. Lynn Winmill dismisses the complaint but allows the FTC to amend it |
| June 5, 2023 | FTC files an amended complaint |
| February 3, 2024 | Court denies Kochava's motion to dismiss the amended complaint |
| July 15, 2024 | FTC files a second amended complaint, which also names Kochava's subsidiary Collective Data Solutions (CDS) |
| February 3, 2025 | Court denies a second motion to dismiss |
| May 4, 2026 | FTC announces a proposed settlement, approved by a 2 to 0 Commission vote |
| June 25, 2026 | Judge Winmill signs the stipulated order |
What the FTC alleged
According to the FTC's 2022 announcement, Kochava sold precise location data drawn from hundreds of millions of mobile devices. A data sample the FTC examined included timestamped location data from more than 61 million unique devices in a single week. The FTC said the data could be used to track people to sensitive places, including reproductive health clinics, places of worship and shelters for survivors of domestic violence, and that buyers could get access with little effort and few restrictions.
The core legal theory was unfairness under Section 5 of the FTC Act. The FTC argued that consumers did not know their location was being collected and sold, had not agreed to it, and could not reasonably avoid the resulting harm. Kochava contested the case throughout, and in the final order the companies neither admit nor deny the allegations.
The procedural history matters for anyone following privacy law. In May 2023 the judge found the original complaint had not shown enough likely injury to consumers. In February 2024 the court held that the amended complaint plausibly alleged substantial injury, and in February 2025 it rejected Kochava's argument that Section 5 reaches only tangible injuries. Those rulings let the FTC press an unfairness theory about selling sensitive location data without relying on a specific privacy statute, though the case settled before any final ruling on the merits.
What the 2026 order requires
The order applies to Kochava and to CDS, which took over Kochava's data broker business. Key provisions, as described in the FTC's announcement and the signed order:
- Ban on sensitive location data. The companies may not sell, license, transfer, share or disclose sensitive location data, unless the consumer gave affirmative express consent and the data is used to provide a service the consumer directly asked for.
- Sensitive locations defined. The order covers locations associated with medical facilities, religious organizations, places mainly providing education or childcare to minors, shelters and social services for homeless people or domestic violence survivors, and military or federal law enforcement sites.
- Sensitive location program. The companies must maintain a list of sensitive locations and prevent data tied to them from being sold or disclosed.
- Supplier assessments. They must check that the apps and suppliers feeding them location data actually obtained consumer consent.
- Consumer rights. People can ask which businesses received their precise location data and withdraw consent.
- Retention and old data. The companies need a deletion schedule, and historical location data must be deidentified or made non-sensitive unless consent requirements are met.
- Ten-year term. The order ends 10 years after the court entered it.
The order includes no monetary payment. Commentators at the National Law Review noted that its relief is somewhat narrower than earlier location data orders, which ran 20 years and used broader lists of sensitive places.
Part of a broader pattern
Kochava was the first of several FTC location data cases. In January 2024 the FTC announced orders against X-Mode Social and its successor Outlogic, its first settlement with a data broker over sensitive location data, and against InMarket, which was banned from selling precise location data. In December 2024 it announced orders against Gravy Analytics and its subsidiary Venntel, and against Mobilewalla, both finalized in January 2025.
States have moved too. Washington's My Health My Data Act, whose geofencing provision took effect July 23, 2023, makes it unlawful to set up a virtual boundary within 2,000 feet of a facility providing in-person health care in order to identify or track people seeking care, collect health data, or send them health-related ads.
What this means for clinic websites, apps and ads
Most clinics will never sell location data. But the Kochava case shows how location becomes health information once it is tied to a medical facility, and that shapes several everyday decisions.
Your own app
If your practice or telehealth company has a mobile app, every third-party SDK inside it is a possible data path. Analytics, advertising and attribution SDKs may collect location or device identifiers. Businesses often:
- Ask for location permission only when a feature truly needs it, such as finding the nearest office
- Review each SDK's data collection and sharing terms before adding it
- Turn off location collection in SDKs that do not need it
- Make sure the app's privacy disclosures match what the SDKs actually collect
Your website
Websites rarely collect GPS data, but IP addresses, device identifiers and ad pixels can still connect a visitor to a clinic visit or a condition. Pixels on booking confirmation pages or service pages for sensitive treatments can send that link to ad platforms. Keeping ad tracking off forms, booking flows and patient portals reduces the risk, and the FTC's health data cases show the agency treats undisclosed sharing of health signals seriously.
Your advertising
Location-based ad products deserve a careful look:
- Geofenced campaigns around hospitals, other clinics or competitor locations may run into state laws like Washington's, and raise the same concerns the FTC raised about Kochava.
- Audience lists built from "visited a medical facility" data rely on exactly the kind of location data the FTC has restricted.
- Ask any ad vendor where its location audiences come from and how consent was obtained. The Kochava order itself requires supplier consent checks, which is a reasonable bar for anyone buying data.
Your vendors
Booking tools, chat widgets, call tracking and review platforms may collect device or location data too. Contracts should limit what vendors can do with your patients' data, and HIPAA covered entities need business associate agreements with vendors that handle protected health information.
A short checklist
- List every SDK in your app and every tag on your website, and note which ones touch location or device identifiers.
- Remove or disable location collection that no feature needs.
- Keep ad pixels off booking, intake, portal and thank-you pages.
- Review any geofencing or location-audience campaigns with counsel, especially near health facilities.
- Ask data and ad vendors in writing how they obtained consent for location data.
- Update your privacy policy so it matches what your site and app actually collect and share.
Privacy counsel can tell you which federal and state rules apply to your practice and where your current setup stands.
Where NutriCove fits
NutriCove builds websites and web apps for practices and brands, with lead capture, CRM and booking wired in, plus care plans for ongoing updates. When we build or rebuild a site, tracking can be configured so ad pixels stay off forms and booking pages. If you are reviewing what your site or app shares, see how we build practice websites. We do not provide legal advice, so questions about consent and state law should go to your attorney.
Sources
- FTC Sues Kochava for Selling Data that Tracks People at Reproductive Health Clinics, Places of Worship, and Other Sensitive Locations, Federal Trade Commission
- FTC to Ban Kochava and Subsidiary from Selling Sensitive Location Data, Federal Trade Commission
- Stipulated Order for Injunction and Other Relief, FTC v. Kochava, D. Idaho, signed June 25, 2026
- FTC v Kochava, Inc. case page, Federal Trade Commission
- Settlement Resolves FTC Lawsuit Against Kochava Over Sale of Geolocation Data, HIPAA Journal
- District Court Denies Kochava's Motion to Dismiss FTC Complaint Regarding Geolocation Data Sales, ZwillGen
- Judge Denies Kochava's Motion to Dismiss FTC's Suit Over Selling Geolocation Data, Hunton
- FTC Remains on the Location Data Beat as Agency Settles Long-Running Kochava Enforcement, National Law Review
- FTC Order Prohibits Data Broker X-Mode Social and Outlogic from Selling Sensitive Location Data, Federal Trade Commission
- FTC Order Will Ban InMarket from Selling Precise Consumer Location Data, Federal Trade Commission
- FTC Takes Action Against Gravy Analytics, Venntel for Unlawfully Selling Location Data, Federal Trade Commission
- FTC Takes Action Against Mobilewalla for Collecting and Selling Sensitive Location Data, Federal Trade Commission
- New Washington State Geofencing Ban Set to Take Effect in July, Hunton Privacy Blog
This article is general information, not legal or medical advice. Talk to a qualified attorney or licensed professional about your situation.