The FTC settled charges with data broker Kochava, Inc. and its subsidiary Collective Data Solutions (CDS) over allegations that they sold precise location data from hundreds of millions of mobile devices without consumer consent, enabling tracking of visits to sensitive locations like reproductive health clinics and places of worship. The settlement prohibits the companies from selling or sharing sensitive location data without affirmative express consumer consent, and imposes compliance requirements including a sensitive location data program, supplier consent assessments, incident reporting, and data retention schedules. No monetary penalty was imposed.
Kochava and CDS are banned from selling, licensing, transferring, sharing, or disclosing sensitive location data without consumers’ affirmative express consent, and only if the data is used to provide a consumer-requested service. The companies must implement a sensitive location data program to identify and block sale of data from sensitive locations, a supplier assessment program to verify consumer consent for all location data, submit incident reports to the FTC when third parties violate data sharing contracts, provide consumers with the ability to request the names of entities that purchased their data and withdraw consent, and establish a data retention schedule requiring deletion of data on a set timeline.
In-house legal teams at companies that collect, process, or share precise geolocation data—including mobile app providers, ad tech vendors, and data brokers—should review vendor and data processing agreements to ensure they require affirmative express consumer consent for the collection, sale, or sharing of precise location data, and explicitly prohibit the disclosure of sensitive location data (e.g., health facilities, places of worship) without consent. Vendor agreements with data brokers must include clauses mandating supplier assessment programs to verify consumer consent for all location data, incident reporting obligations for unauthorized third-party data sharing, and enforceable data retention schedules requiring timely deletion of location data. Customer-facing agreements and privacy policies should be updated to disclose location data collection practices, provide consumers with easy mechanisms to withdraw consent, and outline third-party data sharing. All contracts involving location data should also include audit rights and requirements to comply with applicable FTC enforcement orders.
Entity
Kochava, Inc. and Collective Data Solutions (CDS)
Industry
Data Broker"Kochava and its subsidiary, Collective Data Solutions (CDS), which has taken over Kochava’s data broker business"
"May 4, 2026"
"Federal Trade Commission"
"to settle allegations"
"sold location data from hundreds of millions of mobile devices that could be used to trace the movements of individuals"
"collection, use and disclosure of precise location data invaded consumers’ privacy by revealing their movements, including visits to sensitive locations such as health facilities and places of worship"
$49.8M
The FTC and four states alleged that Progress Residential and Pretium Partners misled renters about rental prices and fees, improperly withheld security deposits, and engaged in other unlawful conduct. Under a proposed settlement, the companies will pay $49.75 million and must change their pricing, deposit, and customer-service practices.
The FTC and 22 state attorneys general filed an updated complaint alleging that Amazon secretly added surcharges to advertising auction prices and misled advertisers about the reasons for price increases. The release describes newly unredacted allegations; it does not report a judgment, settlement, or monetary penalty.
$600K
The FTC and Washington alleged that Riverside Payments and affiliates misrepresented savings and cancellation terms, concealed fees and auto-renewing contracts, and obtained consumers’ financial information using false or fraudulent statements. The proposed stipulated order requires a $600,000 payment, customer notice and a period to rescind agreements without penalty, and prohibits deceptive claims while requiring clear disclosures, informed consent for negative-option billing, and a simple cancellation method.
FTC staff announced warning letters to 25 healthcare plan marketers and lead generators about deceptive or unfair claims concerning plan benefits, coverage, costs, and enrollment incentives. The letters do not allege wrongdoing by their recipients or impose penalties; they encourage companies to review their advertisements for compliance.
The FTC summarized enforcement actions and other efforts targeting businesses and individuals allegedly impersonating government agencies or legitimate businesses. The release reports more than $80 million in consumer redress across prior actions and takedowns of 19 websites, but it does not announce a new settlement or impose a specific penalty.
The FTC and state and local co-plaintiffs filed a lawsuit alleging Toast imposed hidden and unauthorized fees, enrolled restaurants in add-ons without consent, obstructed subscription cancellations, and misrepresented customer support availability. The complaint is pending in federal court; the press release announces no monetary penalty or imposed remedy.