Exposed: Kochava

Kochava is a mobile attribution and analytics company that the FTC sued in August 2022 for selling precise geolocation data that could be used to track individuals to sensitive locations including abortion clinics, places of worship, domestic violence shelters, and addiction recovery centers. The FTC complaint alleged that Kochava data marketplace allowed anyone to purchase a data feed containing device identifiers and GPS coordinates that could be used to identify and track specific individuals based on where they go in the physical world. This capability was especially alarming in the post-Dobbs environment where location data could be used to identify people seeking reproductive healthcare. Kochava collects location data from mobile apps through its SDK and data partnerships, aggregating billions of location data points into a database that maps the real-world movements of millions of mobile device users. The company HealthKit product specifically marketed health-related location data segments to advertisers, including visits to hospitals, pharmacies, and medical facilities. Kochava argued it sold aggregate data and that individuals could not be identified, but researchers and the FTC demonstrated that the precision of the GPS data, combined with home and work location patterns, made individual identification trivially easy. The case represents a critical test of whether the FTC has authority to prevent the sale of location data that endangers vulnerable populations, and it has become a landmark privacy enforcement action in the mobile data industry.