The FTC settled charges with data broker Kochava, Inc. and its subsidiary Collective Data Solutions (CDS) over allegations that they sold precise location data from hundreds of millions of mobile devices without consumer consent, enabling tracking of visits to sensitive locations like reproductive health clinics and places of worship. The settlement prohibits the companies from selling or sharing sensitive location data without affirmative express consumer consent, and imposes compliance requirements including a sensitive location data program, supplier consent assessments, incident reporting, and data retention schedules. No monetary penalty was imposed.
Kochava and CDS are banned from selling, licensing, transferring, sharing, or disclosing sensitive location data without consumers’ affirmative express consent, and only if the data is used to provide a consumer-requested service. The companies must implement a sensitive location data program to identify and block sale of data from sensitive locations, a supplier assessment program to verify consumer consent for all location data, submit incident reports to the FTC when third parties violate data sharing contracts, provide consumers with the ability to request the names of entities that purchased their data and withdraw consent, and establish a data retention schedule requiring deletion of data on a set timeline.
In-house legal teams at companies that collect, process, or share precise geolocation data—including mobile app providers, ad tech vendors, and data brokers—should review vendor and data processing agreements to ensure they require affirmative express consumer consent for the collection, sale, or sharing of precise location data, and explicitly prohibit the disclosure of sensitive location data (e.g., health facilities, places of worship) without consent. Vendor agreements with data brokers must include clauses mandating supplier assessment programs to verify consumer consent for all location data, incident reporting obligations for unauthorized third-party data sharing, and enforceable data retention schedules requiring timely deletion of location data. Customer-facing agreements and privacy policies should be updated to disclose location data collection practices, provide consumers with easy mechanisms to withdraw consent, and outline third-party data sharing. All contracts involving location data should also include audit rights and requirements to comply with applicable FTC enforcement orders.
Entity
Kochava, Inc. and Collective Data Solutions (CDS)
Industry
Data Broker"Kochava and its subsidiary, Collective Data Solutions (CDS), which has taken over Kochava’s data broker business"
"May 4, 2026"
"Federal Trade Commission"
"to settle allegations"
"sold location data from hundreds of millions of mobile devices that could be used to trace the movements of individuals"
"collection, use and disclosure of precise location data invaded consumers’ privacy by revealing their movements, including visits to sensitive locations such as health facilities and places of worship"
The FTC issued an advance notice of proposed rulemaking seeking public comment on whether ad-optimization tools offered by online platforms may help scammers impersonate businesses and government agencies. This is a proposed regulatory inquiry, not an enforcement action against a named company; no penalty or remedy was imposed.
$2.5B
A federal court approved a revised order in the FTC's Amazon Prime case under which Amazon will accelerate and expand redress payments under the September 2025 $2.5 billion settlement, which resolved allegations that Amazon enrolled millions of consumers in Prime subscriptions without their consent and knowingly made cancellation difficult. More consumers now qualify for refunds, the maximum payment cap rises from $51 to $200, and all future payments will be distributed automatically starting October 1, 2026, with potential supplemental $149 payments by April 2027. Amazon has already issued more than $845 million in redress payments as of September 2026.
$225.0M
The FTC and the state of Washington filed a joint complaint and proposed stipulated order requiring Amway Corp. and two affiliates—World Wide Group, L.L.C. (WWG) and Leadership Team Development Inc. (LTD)—to pay a $225 million judgment, the largest monetary recovery ever obtained from an MLM in an FTC action, over allegations that they used deceptive earnings claims and unfair tactics to recruit Independent Business Owners. The complaint alleges the companies falsely promised substantial income and recruitment success, pressured IBOs to buy products they could not resell, and instructed IBOs to falsely report sales. Nearly all of the judgment will be used as redress for IBOs who lost money, and the proposed order imposes structural reforms including a 70% resale requirement, independent audits of sales records, and a ban on approved providers charging new IBOs for first-year training.
$100.0M
FleetCor Technologies Inc. (now Corpay Inc.) and its CEO Ronald Clarke agreed to pay $100 million to settle an FTC administrative action alleging the company charged small business customers hidden and unauthorized fees for fuel cards and misrepresented gas savings, fraud-control features, and fees. A federal district court granted the FTC summary judgment on all counts in 2023, and a federal appeals court upheld that judgment and the permanent injunction in 2026. The settlement funds will be used to provide redress to harmed business customers.
FTC staff published FAQs on price transparency to help the automobile industry comply with the FTC Act, reiterating that an advertised vehicle price must be the actual price any consumer can pay, excluding only government-required charges. The guidance follows warning letters the FTC sent to 97 auto dealership groups earlier in 2026 and signals continued litigation against dealers that advertise one price but charge more through undisclosed fees. No specific entity was charged and no penalty was imposed.
The FTC rescinded its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices, which had purported to apply the Health Breach Notification Rule to health apps and connected devices that collect consumer health information. The rescission follows the Commission's 2024 update to the Health Breach Notification Rule, which already covers health apps and connected devices like fitness trackers, and implements an executive order directing agencies to eliminate obsolete guidance documents. No company was charged or penalized; this is a deregulatory action.