Is the FTC going soft on data privacy? Is it safe to say that companies need to worry about processing sensitive data only in states with privacy laws? Recent Federal Trade Commission (FTC) decision locks in a sweeping ten‑year consent order against Kochava Inc. and its affiliate, Collective Data Solutions (together, “Kochava”), in connection with the sharing of sensitive location data.
Link to What can companies that process sensitive consumer data learn from this decision? What can companies that process sensitive consumer data learn from this decision?
The Kochava settlement is significant in three key ways: First: It demonstrates that, despite its stated conservative approach to enforcement, the FTC will not hesitate to enforce against practices it views as deceptive or unfair, especially where it comes to sensitive data. Second: It shows how the FTC views processing of sensitive data and provides guidance to companies subject to FTC jurisdiction on how to handle sensitive data generally (not just location data) throughout the US. Third: It sends a clear message to data brokers: monetization and sharing of data is viewed by the Commission more strictly than processing data by itself.
Taken together, these requirements reflect a broader shift in U.S. privacy enforcement, from disclosure and consumer choice toward operational control of how sensitive data is collected, used, and shared.
Link to The Background The Background
Kochava Inc. is a data analytics company that collected and sold vast quantities of precise location data derived from consumers’ mobile devices, including GPS coordinates, cell tower and Wi-Fi-based location signals, linked to persistent identifiers such as mobile advertising IDs. The FTC’s complaint, filed in 2022, alleged that Kochava’s practices constituted unfair acts under Section 5 of the FTC Act, enabling the tracking of consumers at sensitive locations, including medical facilities, religious organizations, and temporary shelters, without consumers’ knowledge or consent.
Link to Practice Points: What did the Order say and What Does it Mean for Your Business Practice Points: What did the Order say and What Does it Mean for Your Business
The order makes clear what has been previously expressed in FTC guidance, and in cases like BetterHelp and GoodRx, namely, that you need “Affirmative Express Consent” to share sensitive data. This formulation tracks the language used in U.S. state privacy laws and the EU General Data Protection Regulation (GDPR). Companies cannot infer consent from hovering, muting, pausing, or closing content. In addition, consent obtained through interfaces that “subvert or impair user autonomy, decision-making, or choice”, the FTC’s way of saying dark patterns, does not count.
Consent also must follow a “Clear and Conspicuous” disclosure that is separate from any privacy policy or terms of service. The definition of “Clear and Conspicuous” has detailed requirements: disclosures must be “difficult to miss,” understandable to ordinary consumers, delivered simultaneously through visual and audible means where applicable, “unavoidable” in interactive electronic media, and never contradicted or mitigated by anything else in the communication.
2. Appoint a Person in Charge and Report to the Board
The order mandates that Kochava appoint a senior officer, such as a Chief Privacy Officer or Chief Compliance Officer, to oversee a dedicated Sensitive Location Data Program. That officer must report directly to the board of directors or an equivalent governing body. The written program must be presented to the board at least every 12 months. Separately, the broader-mandated privacy program requires the designation of personnel to coordinate and be responsible for privacy across all covered information.
Here, the FTC is requiring not only that governance be done, but also that it be seen. The FTC has mandated this before, but mostly in connection with information security programs. More recently, Minnesota’s Consumer Data Privacy Act requires controllers to document their privacy program and to identify a chief privacy officer or other individual with primary responsibility for compliance. In California, the new mandated cybersecurity audits under the CCPA require a comprehensive evaluation of a business’s cybersecurity program, along with formal audit reports and certifications, effectively necessitating documented controls, sustained oversight, and audit‑ready processes to demonstrate compliance.
3. Upstream and Downstream Management in Writing and in Practice
The settlement imposes aggressive upstream controls. Kochava must establish a Supplier Assessment Program to confirm that upstream data suppliers actually obtained consumer consent. Initial assessments must be completed within 30 days for existing data‑sharing agreements and annually thereafter, confirming that consumers have provided Affirmative Express Consent or otherwise specifically consented to the collection, use, and disclosure of location data. If consent cannot be confirmed, the company must cease using the data. For the FTC, this requirement reflects a continuation of its approach to sensitive data collected indirectly for example, in cases such as InMarket and X‑Mode. This requirement goes beyond state privacy laws, which generally emphasize transparency and consumer rights rather than auditing upstream consent practices.
On the distribution side (downstream), the order requires mandatory Third-Party Incident Reporting: within 30 days of discovering that a third party shared Kochava’s precise location data in violation of a contractual requirement, Kochava must report the incident to the FTC, including the date range, the types of information affected, the number of consumers impacted, and the remediation steps taken. This requirement goes beyond prior FTC location data cases.
By comparison, state privacy laws generally approach downstream risk through liability standards. For example, California imposes liability where a business “knew or had reason to believe” that a third party would misuse personal data. CCPA regulations do not require but do provide examples of monitoring and due diligence as means of satisfying this standard. Other states generally take a narrower approach, often tying downstream liability to actual knowledge of a violation.
4. Disclose Your Recipients Or Give the Right to Delete
In this case, the FTC also requires Kochava to provide consumers with a clear and conspicuous means to request the identity of any recipient of their precise location data. However, the order provides an alternative: instead of providing consumers with recipients, Kochava can offer consumers a mechanism to submit deletion requests to all recipients, provided that it also contractually requires those recipients to honor the request and provides the consumers with written confirmation of deletion within 90 days.
This approach contrasts with the approach in states such as Oregon and Rhode Island, which require disclosure of specific third parties, not just categories.
5. Data Retention Cannot Be Indefinite
Within 60 days, Kochava must publicly post a retention schedule detailing the purposes for collecting each type of covered information, the specific business needs for retention, and a set timeframe for deletion. Before collecting any new type of consumer data, the schedule must be updated, and the order expressly precludes indefinite retention. U.S. state privacy laws similarly impose retention limitations tied to purpose. While they generally do not mandate fixed timelines, they require businesses to retain personal data only as long as reasonably necessary for the disclosed purpose and, in many cases, to disclose retention periods or the criteria used to determine them. In California, for example, businesses must disclose retention periods at the notice‑at‑collection stage and in their privacy policies.
In addition, per the order, all “Historical Location Data,” defined as precise location data collected without affirmative express consent prior to the order, must be deidentified or otherwise rendered non‑sensitive within 90 days. Kochava may retain such historical data only if it has records demonstrating that consumers provided valid consent.
The Bigger Picture: How does the Order Map to State Privacy Law Trends.
The Kochava order effectively sets a baseline for compliance expectations across all fifty states; not just in the states that have more aggressive enforcement, and not just in the states that have comprehensive privacy laws by signaling how the FTC expects companies to handle sensitive data. It also does not exist in a vacuum. Rather, it operates alongside a broader trend in which state legislatures are converging on stricter treatment of sensitive data generally, and location data in particular.
Outright Bans on the Sale of Sensitive Data.
While the Kochava settlement should be read in the context of sensitive data processing generally, it is important to recognize that precise geolocation data has received particularly close scrutiny from regulators. State privacy laws largely treat precise geolocation data as sensitive data and require opt‑in consent for its processing or sharing. However, several states are moving beyond consent-based frameworks toward outright restrictions. Virginia and Oregon now prohibit the sale of precise geolocation data, while Maryland goes further by banning the sale of sensitive data entirely, regardless of consent. Proposed legislation in California (AB 1542) (that was passed by the California legislature and awaits Governor Newsom’s signature) reflects a similar direction. Other states reinforce this trend by tightening consent and scope requirements, for example, Minnesota restricts even small businesses from selling sensitive data without consent, and Vermont applies its law at very low thresholds for sensitive data processing.
Disclosure Requirements in Privacy Notices.
Though many of the state privacy laws require disclosing whether you collect sensitive data, Texas stands out for requiring specific disclosures for this. Under the Texas Data Privacy and Security Act, any company that sells sensitive personal data must include a conspicuous notice in the same location as its privacy notice stating: “NOTICE: We may sell your sensitive personal data.”
Assumed vendor compliance is not compliance: The Healthline Enforcement
July 1, 2025, settlement with Healthline Media, totaling $1.55 million, targeted the company’s sharing of article titles with advertising partners, information that could reveal consumers’ medical diagnoses or highly sensitive health concerns. The settlement required Healthline to cease sharing data that could infer health conditions, implement functioning opt-out mechanisms, and ensure that its contracts with third parties include CCPA‑mandated privacy protections. Like the Kochava order, the Healthline case underscores that assumed vendor compliance is not compliance. Regulators required Healthline not only to include contractual protections, but also to perform ongoing diligence to verify that downstream partners remain within applicable contractual frameworks.
Five states now regulate data broker activity through dedicated statutes: California, Vermont, Texas, Oregon, and Nevada, with Connecticut set to join beginning in 2027. These laws apply to companies that qualify as data brokers, a definition broader than many expect, and generally require registration and public disclosures.
California has gone further through the Delete Act by creating a centralized deletion mechanism, the Delete Request and Opt-Out Platform (DROP), which allows consumers to submit a single request directing all registered brokers to delete their data. Connecticut’s newly enacted law adopts a similar model, requiring the state to launch a comparable deletion mechanism by 2028.
Regulators have made clear that data broker activity is an enforcement priority. The California Privacy Protection Agency has established a dedicated Data Broker Enforcement Strike Force and emphasized that it intends to bring “the same level of intensity” to investigations in this sector. California has already been active in enforcing its registration requirement, bringing multiple actions against unregistered data brokers, including at least seven enforcement cases since late 2024, with additional actions ongoing as part of broader investigative sweep
Link to The Takeaway The Takeaway
The FTC Kochava settlement provides a detailed federal enforcement template for sensitive location data governance in the United States, and increasingly for sensitive data more broadly. It emphasizes affirmative consent, governance obligations, retention limitation, and upstream and downstream obligations. At a time when state legislatures are moving in the same direction, the order provides a concrete compliance baseline that effectively operates nationwide.
It also underscores that the FTC, notwithstanding perceptions of a more restrained posture, continues to pursue aggressive enforcement, particularly in matters involving sensitive data and the monetization of personal information by data brokers.