FTC v. Kochava, Inc.

What a Lawyer Should Take From This Case Right Now

• Status: pending, with no final merits ruling or money outcome verified yet. FTC case page
• Last meaningful ruling: Judge B. Lynn Winmill denied Kochava's motion to dismiss the first amended complaint on February 3, 2024. Motion-to-dismiss order
• Core theory: the sale of linkable geolocation and profile data can be unfair under FTC Act Section 5 when it creates substantial privacy injury or significant risk of downstream harm. Motion-to-dismiss order
• Why this matters: "anonymous" data arguments get weaker when the dataset is practically identifiable because multiple data products can be joined together. Second amended complaint

What an Associate Should Understand After 10 Minutes

• Kochava is not alleged to have sold only raw coordinates. The FTC says it sold a stack of products including geolocation data, a database graph, an app graph, and audience segments. Second amended complaint
• The FTC's position is that these products are effectively identifiable when combined, even if the company labels them as non-anonymous or pseudonymous in isolation. Motion-to-dismiss order
• The original complaint struggled because the court wanted a stronger showing of substantial injury. The amended pleading survived because the FTC added facts about privacy invasion and real-world risk of downstream harm. Motion-to-dismiss order
• The July 15, 2024 second amended complaint matters because it tries to preserve effective injunctive relief even after Kochava allegedly shifted part of the broker business to its subsidiary CDS. Second amended complaint

Non-Lawyers Summary

The FTC is suing data broker Kochava for selling precise location and related profile data that can allegedly be used to figure out who visited sensitive places, including reproductive health clinics, houses of worship, shelters, and addiction-recovery facilities. FTC case page

The case matters because the FTC is testing whether selling this kind of linkable location data can itself be an unfair practice under Section 5 of the FTC Act, even before the agency proves each downstream buyer actually harmed a specific person. Motion-to-dismiss order

One-Page Teaching Mode

Tech Translation

• MAIDs: mobile advertising IDs tied to devices. They are not a person's name, but they become powerful when paired with other data products that let buyers infer identity or household. Motion-to-dismiss order
• Precise geolocation: timestamped latitude and longitude that the FTC says can pinpoint a device within less than ten meters and track movements over time. Motion-to-dismiss order
• App graph: usage information from large numbers of mobile apps, which can imply health, religion, sexuality, or other sensitive traits. Motion-to-dismiss order
• Database graph: broad consumer profiles containing names, addresses, phone numbers, demographic traits, and other identifying fields. Motion-to-dismiss order
• Audience segments: sortable groups of users built around traits, behaviors, or locations, which makes targeting easier and weakens arguments that the data is harmless in practice. Second amended complaint
• Why linkage matters legally: this is the bridge from technical facts to legal judgment. The FTC's theory gets stronger when separate data products can be joined into a profile that identifies or targets a real person. Motion-to-dismiss order

Issue Map

Data sold -> data linked -> sensitive inference -> privacy injury / secondary harm -> FTC Act § 5 unfairness theory

Why This Matters

• This is one of the clearest FTC test cases against the location-data broker market. FTC case page
• The real issue is not whether Kochava calls the data "anonymous," but whether the data becomes effectively identifiable when geolocation, mobile advertising IDs, app-use data, household data, and audience segments are combined. Second amended complaint
• The February 2024 order matters because the court let the FTC proceed after the agency added more detail showing both privacy injury and risk of downstream harm. Motion-to-dismiss order
• For litigators and in-house privacy counsel, the case is a practical map for how Section 5 unfairness theories are being used against surveillance-style data practices. FTC case page

Key Facts

• [verified] Caption: Federal Trade Commission v. Kochava Inc., Case No. 2:22-cv-00377-BLW (D. Idaho). FTC case page
• [verified] Plaintiff theory: Kochava's sale and use of precise geolocation data and linked consumer-profile products is an unfair practice under 15 U.S.C. § 45. FTC case page
• [verified] Data at issue: precise geolocation, mobile advertising IDs, database-graph profile data, app-graph data, and audience segments. Motion-to-dismiss order
• [verified] Sensitive-location examples identified by the FTC include reproductive health clinics, places of worship, homeless and domestic-violence shelters, and addiction-recovery facilities. FTC case page
• [verified] Current posture: pending. The court denied Kochava's motion to dismiss the first amended complaint in February 2024, and the FTC filed a second amended complaint on July 15, 2024. FTC case page
• [verified] Relief sought: permanent injunctive relief aimed at stopping the sale of sensitive geolocation data and requiring deletion of the sensitive geolocation information the FTC says Kochava collected. FTC case page

Filing-to-Judgment Timeline

What Changed Procedurally

• The original complaint was not enough as pleaded because the court wanted more factual support showing substantial injury. Motion-to-dismiss order
• The first amended complaint added factual allegations about the scale, sensitivity, and linkability of the data and about the real-world risk of misuse. Motion-to-dismiss order
• The February 2024 ruling is not a merits win. It is a pleading-stage decision saying the FTC has a plausible Section 5 claim. Motion-to-dismiss order
• The July 2024 second amended complaint tries to deal with the defendant's alleged business transfer to CDS so the court can still reach ongoing conduct. Second amended complaint

What the Court Actually Held

• What Kochava argued: the FTC still had not cured the defects from the earlier dismissal and had not adequately alleged substantial injury. Motion-to-dismiss order
• What the FTC argued: Kochava's products are not meaningfully anonymous in practice and can expose consumers to both direct privacy invasion and significant risk of secondary harms. Motion-to-dismiss order
• What the judge accepted: the amended allegations plausibly stated both injury theories and were enough to proceed under Section 5(a) and Section 13(b). Motion-to-dismiss order
• What the judge did not decide yet: whether the FTC will prove those allegations on the merits, whether Kochava's factual disputes win later, and what final injunctive relief would be proper. Motion-to-dismiss order

What Is Already True Now

• [verified] The case is pending, not finished. FTC case page
• [verified] The FTC survived a motion to dismiss on the amended allegations. Motion-to-dismiss order
• [verified] The court treated both privacy injury and secondary-harm risk as plausible theories at the pleading stage. Motion-to-dismiss order
• [verified] No final penalty, settlement, or injunction is verified. FTC case page

What Is Still Being Fought Over

• [inferred] Whether the FTC can prove substantial injury on the full record.
• [inferred] Whether Kochava's products are as linkable and identifiable in practice as the FTC alleges.
• [inferred] Whether post-filing product or corporate-structure changes meaningfully reduce the need for injunctive relief.
• [verified] What final remedy, if any, the court would impose.

Facts That Change the Outcome

1. Raw coordinates only vs linked profiles: the FTC's theory is stronger if buyers can combine multiple products into a person-level profile. Motion-to-dismiss order
2. Historic feed vs live or near-live tracking: a richer temporal record makes inference and targeting more plausible. Motion-to-dismiss order
3. Sensitive POIs included or filtered: the case gets sharper when the dataset reveals visits to clinics, shelters, religious sites, or recovery facilities. FTC case page
4. Buyer controls weak vs strong: the FTC stresses minimal barriers and weak use restrictions. That goes directly to foreseeability of downstream misuse. Second amended complaint
5. Affiliate transfer cosmetic vs operationally real: the July 2024 pleading suggests the FTC thinks the business change did not eliminate the challenged conduct. Second amended complaint

Legal Framework

• [verified] 15 U.S.C. § 45(a) (FTC Act Section 5) prohibits unfair or deceptive acts or practices.
• [verified] 15 U.S.C. § 45(n) defines unfairness through substantial injury, reasonable avoidability, and countervailing benefits.
• [verified] 15 U.S.C. § 53(b) is the FTC's injunction vehicle in this case.
• [verified] The February 2024 order treats two injury theories as plausibly available here: substantial invasion of privacy and significant risk of secondary harms from the sale of sensitive, linkable data.
• [inferred] This is a surveillance-data and brokered-data case, not a classic "company got hacked" case. The enforcement hook is the company's own data-use model.

Legal Meaning

This case is useful because it moves the privacy fight away from the weak question "was the data technically anonymous on paper?" and toward the stronger question "can the data realistically be used to identify and target people in sensitive contexts?" The FTC's amended theory says yes, because Kochava allegedly sells not just raw coordinates but a stack of products that can be linked into a detailed person-level profile. Second amended complaint

The February 2024 order matters because the court did not require the FTC to prove actual downstream injury at the pleading stage. Instead, it accepted that Section 5 can reach practices that plausibly create a significant risk of concrete secondary harm and practices that substantially invade privacy on their own. That is a meaningful pleading lesson for future surveillance, adtech, and brokered-data cases. Motion-to-dismiss order

The second amended complaint matters for another reason: it shows the FTC trying to prevent the defendant from narrowing the case by shifting business functions to an affiliate. The pleading focus is not just historical conduct; it is whether the court can still grant effective injunctive relief against an allegedly ongoing data-use model. Second amended complaint

How to Use This Case

• Plaintiff or regulator use: linked data makes re-identification and harm foreseeable, so privacy injury should not be analyzed as if each dataset exists in a silo. Motion-to-dismiss order
• Defense use: argue that inference risk is overstated, products are more segregated than the FTC claims, and post-filing product changes reduce ongoing harm. Motion-to-dismiss order
• Privacy counseling use: do not rely on "de-identified" labeling if downstream linkage is realistic given the actual product architecture. Second amended complaint
• Product review use: focus on what buyers can reconstruct in practice, not only on whether a single exported column contains a name. Motion-to-dismiss order

Monday-Morning Guidance

• In product review, test whether different feeds can be joined into a person-level profile.
• In vendor diligence, ask what fields are sold, how sensitive locations are handled, and what buyer controls exist.
• In litigation hold and discovery planning, preserve product descriptions, buyer-approval workflows, marketing decks, and any internal documents about linkability or de-identification.
• For leadership, frame the risk as surveillance-stack exposure, not just generic privacy-policy risk.

Practical Briefing for In-House / Compliance Teams

• What happened: the FTC sued Kochava over the alleged sale and use of linkable geolocation and profile data tied to sensitive locations and traits. FTC case page
• What laws attach in this case: FTC Act Section 5(a) unfairness, Section 5(n) substantial-injury analysis, and Section 13(b) injunctive relief. Motion-to-dismiss order
• What the operational lesson is: if your product, SDK, broker feed, or vendor stack lets buyers infer clinic visits, religion, family status, or similar sensitive facts, the legal risk is not limited to a breach scenario. Second amended complaint
• What an in-house team should check immediately: data inventory, identity-linkage paths, sensitive-location filtering, buyer controls, deletion practices, affiliate transfers, and marketing statements about anonymity or de-identification.

What Laws Attach

• [verified] 15 U.S.C. § 45(a): the FTC's core unfairness hook in this case. Motion-to-dismiss order
• [verified] 15 U.S.C. § 45(n): the substantial-injury framework the court applied when analyzing privacy injury and risk of secondary harm. Motion-to-dismiss order
• [verified] 15 U.S.C. § 53(b): the FTC's route to seek injunctive relief. Motion-to-dismiss order
• [inferred] Adjacent risk outside this caption: any company handling location, app-use, audience-segment, or identity-graph products should also assess contract, consumer-disclosure, vendor-governance, and state privacy exposure even if those issues are not the operative claims in this public FTC case.

Deadline and Action Clock

• [verified] Current public case status: pending. The FTC case page does not provide a final compliance deadline, injunction date, settlement deadline, or money-payment deadline. FTC case page
• [verified] Last dated public event on the FTC case page: July 15, 2024 second amended complaint. FTC case page
• [inferred] Internal action deadline: immediate. In-house teams should not wait for a final ruling before reviewing whether products or vendors expose sensitive-location or sensitive-trait inference risk.
• [inferred] Board or executive briefing trigger: as soon as the business depends on data products that can be marketed as anonymous but reconstructed as person-level surveillance in practice.
• [inferred] Contracting trigger: before onboarding or renewing any vendor that sells or consumes precise geolocation, app graph, household graph, or audience-segment data.

Strategic Implications

• For litigators: the pleading win shows that privacy injury can be framed as both direct invasion and foreseeable secondary-harm risk, especially when the data is granular, persistent, and readily linkable.
• For in-house privacy and adtech counsel: this is a warning that "de-identified" rhetoric is weak if product design, auxiliary datasets, or marketing materials show the data can be tied back to real people.
• For data brokers and app-ecosystem businesses: the case suggests the FTC will look hard at audience segmentation, location feeds, app-use data, and household identity graphs as one surveillance stack rather than as isolated products.
• For deal, diligence, and governance work: changes in corporate structure or subsidiary routing may not eliminate exposure if the core data practices continue.

Hypothetical Variations

• If the data were aggregated only and could not be linked back to devices or households, the FTC's identifiability theory would be weaker.
• If sensitive locations were reliably filtered and buyers could not reverse-engineer them, the risk framing would narrow.
• If identifier reset mechanisms actually broke historical linkage, the privacy-injury story would be less forceful.
• If buyer controls were strong, verified, and technically enforced, foreseeability of downstream misuse would be harder to plead.

Common Mistakes Junior Lawyers Make Here

• Treating "anonymous" as the end of the analysis instead of asking whether the data is practically identifiable.
• Assuming privacy injury requires proof of actual downstream violence or discrimination at the pleading stage.
• Confusing survival of a motion to dismiss with a final merits victory.
• Citing Kochava too broadly as settled law instead of a pending case with a useful pleading-stage order.

Bench / Clerk / Student Bridge

• Technical event -> legal consequence: if multiple datasets can be linked into a person-level profile, the legal question shifts from abstract data handling to practical identifiability and privacy injury. Motion-to-dismiss order
• What the court is really evaluating: not whether modern data products look anonymous in a marketing deck, but whether the alleged product design plausibly exposes consumers to substantial privacy invasion or significant risk of secondary harms. Motion-to-dismiss order
• Why this helps clerks and students: the case shows how a court translates data architecture into pleading-stage unfairness analysis without requiring a full technical expert record on day one.
• Why this helps judges: Kochava is a reminder to isolate posture, theory, and proof burden. The February 2024 order is about plausibility, not final fact-finding. Motion-to-dismiss order

Questions to Ask the Client or Vendor

• What exact data fields are sold?
• Can the dataset be linked to a person, household, or repeat device over time?
• Are sensitive locations filtered, and how do you know that filtering actually works?
• Who can buy the data, and what approval or access controls exist?
• What contractual restrictions govern downstream use?
• What changed after regulatory scrutiny began, and can you prove those changes technically and operationally?

Source Drill

• FTC case page: proves posture, timeline items, case status, and the relief the FTC says it seeks. It does not prove the truth of each allegation. FTC case page
• February 2024 motion-to-dismiss order: proves what the court found plausible at the pleading stage and what arguments survived dismissal. It does not prove the FTC will win on the merits. Motion-to-dismiss order
• July 2024 second amended complaint: proves the FTC's latest factual theory, including the CDS affiliate allegations. It does not prove those facts are established. Second amended complaint

Watch Next

• summary judgment briefing
• injunction briefing
• settlement posture
• any appeal on legal theory or relief scope
• whether the court narrows the theory after the alleged business changes

Current Status / Final Outcome

As of the FTC case page last updated on July 15, 2024, the case status is listed as Pending. There is no verified final judgment, settlement, civil penalty, or merits ruling beyond the February 2024 denial of the motion to dismiss. FTC case page

Money / Penalties / Damages

How to Explain This Case to a Partner in 90 Seconds

Kochava is a pleading-stage Section 5 unfairness case against a data broker. The FTC says Kochava sold a linked surveillance stack, not harmless isolated data points, and that the products together could identify or target people who visited sensitive places. The court let the amended complaint proceed because the FTC plausibly alleged both privacy injury and significant risk of downstream harm. The case is still pending, so the safe use is as a procedural and framing tool, not as a final merits holding.

CLE / Training Use

• Why a training buyer would want this: it already packages the case into posture, tech translation, legal framework, practical use, and open questions instead of forcing a team to assemble those pieces manually.
• Credibility signals: the page separates what the FTC alleges, what the court held, what remains open, and what sources support each point. That structure makes it easier to use in CLE, onboarding, or internal training without overstating the law.
• Suggested teaching objectives: explain why linked data changes the privacy analysis; show how Section 5 unfairness works at the pleading stage; teach how to distinguish a plausible claim from a final holding; connect product design to regulatory exposure.
• Best training format: a 20 to 30 minute module using the issue map, tech translation, what the court actually held, and the hypotheticals section as the core teaching sequence.
• What this replaces: ad hoc slide assembly from press releases, scattered docket notes, and secondary commentary that often blurs allegation, ruling, and outcome.

Discussion Questions for Training

• At what point does "pseudonymous" data become legally meaningful as identifiable data?
• Which facts in Kochava matter most to the unfairness analysis, and which are merely atmospheric?
• How should a court think about privacy injury when downstream harm is foreseeable but not yet proven consumer by consumer?
• If a company changes products after suit is filed, what evidence would you want to test whether the change is real?

Update Ledger

• [verified] [2026-04-20] Tracker baseline refreshed from the FTC case page and the publicly posted February 2024 order and July 2024 second amended complaint.
• [update-needed] [future date] Add any summary-judgment, injunction, settlement, or appeal developments if the docket moves.
• [update-needed] [future date] Update the money table only if a court order, settlement, or penalty document states a final number.

PDF Review Notes

No local PDF artifacts matched this case in the workspace, but the footer now links the FTC-hosted motion-to-dismiss order PDF and second amended complaint PDF.

• [verified] The February 2024 order is the key pleading-stage document for the legal theory.
• [verified] The July 15, 2024 second amended complaint is the best current public pleading for the FTC's factual allegations.
• [verified] If you add district-court docket PDFs later, tie each one to the timeline row it supports.

Practical Takeaways

• The commodity version is: "The FTC sued a data broker over location data."
• The useful version is: "The real legal fight is whether supposedly anonymized data stops being anonymous once a broker sells enough linked fields to let buyers reconstruct who a person is, where they go, and what that implies about health, religion, family status, or sexuality."
• This is a Section 5 unfairness case about surveillance economics, not just a privacy-policy wording case.
• If you are advising on adtech, SDKs, or brokered data, ask whether the product can be used to identify visits to sensitive places and whether a buyer could realistically tie the dataset back to a human being.

Sources and Verification Notes

• [verified] Module anchor(s): artifacts/modules/01e-enforcement-agencies.md
• [verified] FTC case page: https://www.ftc.gov/legal-library/browse/cases-proceedings/ftc-v-kochava-inc
• [verified] Motion-to-dismiss order PDF: https://www.ftc.gov/system/files/ftc_gov/pdf/71-OpiniononMTD.pdf
• [verified] Second amended complaint PDF: https://www.ftc.gov/system/files/ftc_gov/pdf/86-SecondAmendedComplaint.pdf
• [verified] FTC press release dated August 29, 2022: https://www.ftc.gov/news-events/news/press-releases/2022/08/ftc-sues-kochava-selling-data-tracks-people-reproductive-health-clinics-places-worship-other
• [inferred] Any status change after July 15, 2024 should be rechecked directly against the court docket or FTC case page before publication as final.