The FTC Just Banned a Company for Selling Your Location to Anyone Who'd Pay

They Knew Where You Were. They Sold It.

Every day, apps on your phone quietly collect your location. Every movement. Every stop. Every place you visit. They sell this data to brokers — companies you've never heard of, who have no relationship with you, who owe you nothing.

One of those brokers was Kochava.

On May 4, 2026, the Federal Trade Commission permanently banned Kochava and its subsidiary from selling sensitive location data without explicit consumer consent. It's the result of a years-long investigation that exposed just how detailed — and dangerous — this data really is.

What Kochava Was Selling

Kochava aggregated location data from hundreds of millions of mobile devices and packaged it for sale. Buyers could purchase histories showing exactly where a device had been — tied to a persistent identifier that followed the device across time.

The FTC's investigation found this data included visits to:

• Abortion clinics and reproductive health providers
• Domestic violence shelters
• Religious sites — mosques, churches, synagogues
• Mental health facilities
• Addiction treatment centers
• Immigration and legal aid offices

This isn't abstract. A location history that shows someone visited a domestic violence shelter is a weapon in the hands of their abuser. A history showing clinic visits can be used in states that criminalize abortion. A pattern of mosque attendance can be used to discriminate, surveil, or target.

And Kochava was selling it to anyone who'd pay.

How Your Data Got There

You didn't sign up for Kochava. You've probably never heard of them. But here's how your data ended up in their database:

Step 1 — You downloaded an app A weather app, a game, a flashlight. Many apps contain third-party SDKs — code libraries from data brokers embedded by developers in exchange for payment.

Step 2 — The app asked for location permission Maybe it needed your location for a legitimate reason. Maybe it didn't. You tapped "Allow" and forgot about it.

Step 3 — The SDK started collecting The broker's SDK inside the app began recording your location in the background, even when you weren't using the app.

Step 4 — The data was sold Your location history — timestamped, tied to your device's advertising ID — was bundled with millions of others and sold on the open market.

This is legal. It happens at massive scale. Kochava is one company. There are hundreds more.

What the FTC Ban Actually Does

The ruling requires Kochava to:

• Stop selling sensitive location data without explicit consumer consent
• Delete historical data that was collected without proper consent
• Implement a data deletion program for consumer requests

What it doesn't do: it doesn't affect the dozens of other data brokers operating the same model. It doesn't give you back the data that's already been sold. It doesn't undo what buyers already know about you.

This ruling matters as a precedent. But it's not a solution.

How to Limit Location Data Collection Right Now

1. Audit app permissions on your phone Go to Settings → Privacy → Location Services. Every app with "Always" access is collecting your location continuously. Revoke anything that doesn't genuinely need it.

2. Set location to "While Using" instead of "Always" For apps that need location (maps, ride-sharing), use "While Using App" only. Never "Always."

3. Reset your advertising ID regularly Your advertising ID is the persistent identifier data brokers use to track you. Resetting it breaks the linkage.

• iPhone: Settings → Privacy → Tracking → reset advertising identifier
• Android: Settings → Google → Ads → reset advertising ID

4. Opt out of data broker databases Services like DeleteMe, Privacy Bee, or the California DELETE Act (if you're in CA) let you submit removal requests to major data brokers. It's tedious but effective.

5. Use a VPN selectively A VPN masks your IP-based location, but doesn't stop in-app location collection. Use both layers.

The Bigger Picture

The FTC ban on Kochava is significant — but it took years of litigation to achieve, and Kochava is one player in a multi-billion dollar industry that operates with almost no regulation in most U.S. states.

Your location data is being collected right now, by apps you've forgotten you installed, through SDKs you didn't know existed, and sold to buyers you'll never identify.

The only reliable defense is reducing what you give away in the first place.

Stay invisible. Follow HackDecoded.

Sources

• ftc.gov
• therecord.media