Kochava

Overview

Kochava is an American mobile measurement and data broker company founded in 2011, headquartered in Sandpoint, Idaho. The company operates as one of the largest mobile attribution and analytics platforms in the advertising industry, providing advertisers with tools to measure the effectiveness of mobile advertising campaigns. Beyond its attribution business, Kochava operates a substantial data marketplace where precise location data collected from mobile apps is packaged and sold to data buyers ranging from advertisers to government agencies.

Kochava's business model sits at the intersection of mobile advertising measurement and data brokerage. The company's SDK, integrated into thousands of mobile apps, collects precise device location data (GPS coordinates), device identifiers, and app usage behavioral data. This data serves dual purposes: attribution analytics for advertising clients, and raw location data products sold through Kochava's marketplace to external buyers.

The company gained significant regulatory and public attention in 2022 when the Federal Trade Commission filed a lawsuit against Kochava, alleging that the company sold "a data feed of app signals that can be used to identify and track the locations of hundreds of millions of mobile devices, including locations at sensitive places such as reproductive health clinics, domestic violence shelters, addiction recovery facilities, and houses of worship."

The FTC lawsuit placed Kochava at the center of debates about the commercialization of precise location data, sensitive location visits, and the potential for location data to be used to identify individuals visiting healthcare facilities, religious institutions, and other sensitive locations. This lawsuit was filed in the context of the Supreme Court's Dobbs decision overturning Roe v. Wade, amid concerns that location data sold by brokers could be used to prosecute individuals seeking abortions in states where the procedure had been criminalized.

Data Collection Practices

Kochava collects precise location data from mobile apps through its SDK and aggregates it into a data marketplace with commercial and government buyers:

Mobile SDK location collection from apps that integrate Kochava's measurement SDK:

• GPS coordinates with precision sufficient to identify specific building entrances
• IP-based geolocation as backup when GPS is unavailable or denied
• WiFi network location inferences
• Device accelerometer and movement patterns
• App installation and usage events
• Device advertising identifiers (IDFA, GAID)
• Timestamps enabling movement pattern and routine reconstruction

Kochava's SDK is integrated into tens of thousands of apps, giving the company location data from a substantial portion of the mobile app ecosystem. Users of apps that include Kochava's SDK may not know the company exists, let alone that it collects and sells their location data.

Data marketplace packages location data collected across the SDK network into commercial products:

• Location history feeds: timestamped latitude/longitude coordinates for device identifiers over time
• Audience segments based on places visited (retail categories, healthcare facility types, religious institutions)
• Movement pattern analytics identifying home and work locations, commuting patterns, and travel
• "Sensitive location" audience segments built from visits to healthcare facilities, places of worship, addiction treatment centers

Identity resolution connects location data to other consumer attributes through device identifier matching and probabilistic cross-device linking. This enables Kochava to associate location history with demographic, psychographic, and behavioral data from other sources.

Government data supply represents a significant and concerning aspect of Kochava's business. Investigative reporting documented that U.S. federal agencies including military and intelligence services purchased location data from Kochava through data brokers, accessing precise location histories for device identifiers without obtaining the warrants that would be required to collect this data through traditional law enforcement channels.

Known Clients & Government Contracts

Kochava's client base includes commercial advertisers and, through data reseller relationships, government agencies:

Commercial advertisers including major consumer brands, McDonald's, Disney, Toyota, The Home Depot, Spotify, Mastercard, Marriott, Southwest Airlines, Mattel, use Kochava's attribution platform to measure mobile advertising campaign effectiveness. These commercial relationships are standard advertising measurement.

U.S. government agencies: Investigative reporting by VICE Motherboard and others documented that U.S. military branches, intelligence services, and law enforcement agencies purchased mobile device location data through Kochava's marketplace and data resellers. These purchases were structured to avoid the legal processes (warrant, subpoena, court order) that government collection of this data through traditional channels would require.

Specific documented instances included:

• U.S. Special Operations Command (SOCOM) purchasing location data through a contractor
• Defense Intelligence Agency (DIA) purchasing location data without warrants
• Customs and Border Protection (CBP) using mobile location data through broker purchases

This pattern, government agencies purchasing through commercial data brokers what they cannot legally collect directly, has been described by privacy advocates as a "data broker loophole" that circumvents Fourth Amendment protections.

Foreign government access through resellers: Data purchased from Kochava's marketplace can be resold by data broker intermediaries to other buyers, including foreign intelligence services. This resale chain makes the ultimate use of Kochava's location data difficult to audit or control.

Privacy Incidents & Litigation

FTC v. Kochava (August 2022): The Federal Trade Commission filed a landmark lawsuit in federal court in Idaho alleging that Kochava violated the FTC Act by selling mobile device location data that could be used to identify visits to sensitive locations including abortion providers, addiction treatment facilities, domestic violence shelters, and houses of worship.

The FTC's complaint alleged that by selling this data, Kochava enabled buyers to:

• Identify individuals who visited reproductive health clinics (including abortion providers), a severe privacy harm in states that have criminalized abortion
• Identify individuals attending religious services, implicating First Amendment freedoms
• Identify individuals seeking addiction treatment, creating stigma and discrimination risks
• Identify individuals at domestic violence shelters, potentially enabling abusers to locate survivors

Kochava filed a counter-lawsuit claiming it was unfairly targeted, arguing that its location data products were industry-standard and that the FTC was attempting to regulate through litigation rather than rulemaking. The case has proceeded through federal courts with significant implications for the data broker industry.

Government Data Purchase Controversies: Investigative reporting documenting government agencies purchasing Kochava location data triggered Senate investigations and FTC policy review. Senator Ron Wyden cited Kochava specifically in calls for legislation closing the data broker loophole that allows government agencies to purchase commercially what they cannot legally collect directly.

Post-Dobbs Reproductive Health Data Concerns: Following the Supreme Court's Dobbs decision, civil society organizations and state attorneys general raised specific concerns about Kochava's location data products enabling prosecution of individuals seeking abortions in states that had criminalized the procedure. This concern was central to the FTC's lawsuit timing.

CPPA Investigation: The California Privacy Protection Agency opened investigations into multiple data brokers including Kochava regarding compliance with California's Consumer Privacy Act (CCPA/CPRA), including rights to know what data is collected, rights to deletion, and requirements for sensitive data handling.

Threat Score Analysis

Kochava receives a composite threat score of 76/100, reflecting its FTC-documented sale of sensitive location data including reproductive health clinic visits, and its documented supply of location data to government agencies without legal process:

• Data Collection (85/100): Kochava collects precise GPS location data from tens of thousands of mobile apps, building location histories for hundreds of millions of device identifiers. The FTC documented collection of location data for visits to reproductive health clinics, domestic violence shelters, addiction treatment centers, and religious institutions, among the most sensitive location categories.

• Third-Party Sharing (90/100): Kochava's core business is selling location data through its marketplace. Data is sold to commercial advertisers and, through reseller channels, to government agencies. The FTC's lawsuit specifically targets this data selling as the primary privacy harm.

• Breach History (35/100): No major documented security breaches. Kochava's primary accountability failures are regulatory (FTC lawsuit) and ethical (selling sensitive location data) rather than security incidents.

• Government Contracts (55/100): Documented government purchases of Kochava location data represent significant government contracts. The pattern of government agencies purchasing location data through commercial data brokers to avoid warrant requirements is a significant and documented accountability failure.

• Transparency (30/100): Kochava's data practices are disclosed in privacy policies accessible through SDK documentation, but end users of apps that integrate Kochava's SDK typically have no awareness that their location data is being collected and sold. Kochava's opt-out mechanism requires awareness of the company's existence, which most users lack.

Weighted calculation: (85 * 0.25) + (90 * 0.25) + (35 * 0.20) + (55 * 0.15) + (30 * 0.15) = 21.25 + 22.5 + 7.0 + 8.25 + 4.5 = 63.5, adjusted to 76 due to the FTC-documented sale of sensitive location data including abortion clinic visits and the company's role as a supplier of warrantless location surveillance to government agencies.

Transparency & Accountability

Kochava's response to the FTC lawsuit has been unusually aggressive for a data broker facing regulatory action:

Rather than engaging in settlement negotiations or compliance improvements, Kochava filed a counter-lawsuit against the FTC in its home district (Idaho), arguing that the agency's lawsuit was an unconstitutional attempt to regulate data practices through litigation rather than through notice-and-comment rulemaking. This legal strategy reflects Kochava's calculation that a court victory could establish favorable precedent for the data broker industry broadly.

Kochava has also published public communications defending its data practices, arguing that it sells data consistent with industry norms and that its location data products are properly anonymized. Privacy researchers dispute the anonymization claim, noting that precise location histories, particularly when they include visits to home and work addresses, are effectively re-identifiable to specific individuals without additional data.

The company offers an opt-out mechanism (through the Kochava Collective opt-out portal) allowing individuals to submit device identifiers for exclusion from data sales. However, exercising this opt-out requires awareness that Kochava exists, awareness that most mobile app users lack.

Kochava's Idaho headquarters creates an interesting regulatory context: Idaho has not enacted comprehensive consumer privacy legislation, and the FTC's federal lawsuit in Idaho federal court represents the primary regulatory accountability mechanism. The outcome of FTC v. Kochava will have significant implications for whether selling sensitive location data constitutes an unfair trade practice under Section 5 of the FTC Act.

The broader industry implication of the Kochava case is its relevance to dozens of similar data brokers that aggregate and sell mobile location data. A ruling against Kochava's practices would effectively prohibit the commercial location data marketplace in its current form.