Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 1 of 11 

BRIAN SHULL, IL Bar No. 6293797 

JULIA A. HORWITZ, DC Bar No. 1018561 

Federal Trade Commission 

600 Pennsylvania Avenue, N.W. 

Washington, D.C. 20580 

Phone: (202) 326-3734 

Fax: (202) 326-3062 

bshull@ftc.gov 

jhorwitz@ftc.gov 

ATTORNEYS FOR PLAINTIFF 

UNITED STATES DISTRICT COURT 

FOR THE DISTRICT OF IDAHO 

FEDERAL TRADE COMMISSION, 

Plaintiff, 

v. 

KOCHAVA INC., corporation, 

Defendant. 

Case No. 2:22-cv-377 

COMPLAINT FOR PERMANENT 

INJUNCTION AND OTHER 

RELIEF 

Plaintiff, the Federal Trade Commission (“FTC”), for its Complaint alleges: 

1. The FTC brings this action under Section 13(b) of the Federal Trade Commission 

Act (“FTC Act”), 15 U.S.C. § 53(b), which authorizes the FTC to seek, and the Court to order, 

permanent injunctive relief and other relief for Defendant’s acts or practices in violation of 

Section 5(a) of the FTC Act, 15 U.S.C. § 45(a). Defendant’s violations are in connection with 

acquiring consumers’ precise geolocation data and selling the data in a format that allows entities 

to track the consumers’ movements to and from sensitive locations, including, among others, 

locations associated with medical care, reproductive health, religious worship, mental health, 

1 
 

 

 

 

 

 

 

Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 2 of 11 

temporary shelters, such as shelters for the homeless, domestic violence survivors, or other atrisk populations, and addiction recovery. 

JURISDICTION AND VENUE 

2. This Court has subject matter jurisdiction pursuant to 28 U.S.C. §§ 1331, 1337(a), 

and 1345. 

3. Venue is proper in this District under 28 U.S.C. § 1391 (b)(1), (b)(2), and (c)(2) 

and 15 U.S.C. § 53(b). 

PLAINTIFF 

4. The FTC is an independent agency of the United States Government created by 

the FTC Act, which authorizes the FTC to commence this district court civil action by its own 

attorneys. 15 U.S.C. §§ 41–58. The FTC enforces Section 5(a) of the FTC Act, 

15 U.S.C. § 45(a), which prohibits unfair or deceptive acts or practices in or affecting commerce. 

DEFENDANT 

5. Defendant Kochava Inc. (“Kochava”) is a Delaware corporation with its principal 

place of business at 201 Church Street, Sandpoint, Idaho 83864. Kochava transacts or has 

transacted business in this District and throughout the United States. 

COMMERCE 

6. At all times relevant to this Complaint, Defendant has maintained a substantial 

course of trade in or affecting commerce, as “commerce” is defined in Section 4 of the FTC Act, 

15 U.S.C. § 44. 

DEFENDANT’S BUSINESS ACTIVITIES 

Kochava Sells Precise Location Information for Hundreds of Millions of Mobile Devices 

2 
 

 

 

 

 

 

 

Field name V 

device_id_value 

device_id_type 

activity_timestamp 

latitude 

longitude 

horizontal_accuracy 

ip_address 

Description 

Unique device ID associated with the 

device 

V 

Device type associated wit h t he device ( 

IDFA and ADID only ) 

Timestamp of when the device hits the 

location 

Precise latitude of the device 

Precise longitude of the device 

Horizontal accuracty of the precision of 

the lat and Ion ( in meters) 

IP Address of the device 

Example V Data type 

string 

string 

timestamp 

string 

string 

string 

string 

Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 3 of 11 

7. Kochava is, among other things, a location data broker that provides its customers 

massive amounts of precise geolocation data collected from consumers’ mobile devices. 

Through Kochava’s services, customers can “[l]icense premium data” including the “precision 

location” of a consumer’s mobile device. 

8. Kochava collects a wealth of information about consumers and their mobile 

devices by, among other means, purchasing data from other data brokers to sell to its own 

customers. 

9. Kochava then sells customized data feeds to its clients to, among other purposes, 

assist in advertising and analyzing foot traffic at stores or other locations. Among other 

categories, Kochava sells timestamped latitude and longitude coordinates showing the location of 

mobile devices. For example, in the Amazon Web Services (“AWS”) Marketplace, a website 

through which customers could subscribe to Kochava’s data feed until approximately June 2022, 

Kochava displayed the following table explaining the data it sells: 

10. As noted in Kochava’s explanation, each pair of timestamped latitude and 

longitude coordinates is associated with a “device_id_value,” which is also known as a Mobile 

Advertising ID (“MAID”). A MAID is a unique identifier assigned to a consumer’s mobile 

3 
 

 

 

 

 

 

 

 

 

 

 

 

 

Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 4 of 11 

device to assist marketers in advertising to the consumer. Although a MAID may be changed 

by a consumer, doing so requires the consumer to proactively reset the MAID on the consumer’s 

mobile device. 

11. In describing its product in the online marketplace, Kochava has asserted that it 

offers “rich geo data spanning billions of devices globally.” It has further claimed that its 

location data feed “delivers raw latitude/longitude data with volumes around 94B+ geo 

transactions per month, 125 million monthly active users, and 35 million daily active users, on 

average observing more than 90 daily transactions per device.” 

Kochava Provides Public Access to Consumers’ Location Data 

12. Kochava has sold access to its data feeds on online data marketplaces that are 

publicly accessible. Kochava typically charges a monthly subscription fee of thousands of 

dollars to access its location data feed but has also offered a free sample (the “Kochava Data 

Sample”). Kochava has made the Kochava Data Sample publicly available with only minimal 

steps and no restrictions on usage. 

13. For example, the Kochava Data Sample was available on the AWS Marketplace 

until approximately June 2022. In order to access the Kochava Data Sample on the AWS 

Marketplace, a purchaser needed a free AWS account. A purchaser would then search the AWS 

marketplace for “Kochava,” which resulted in two available datasets appearing – a $25,000 

location data feed subscription and the Kochava Data Sample. 

14. The Kochava Data Sample consisted of a subset of the paid data feed, covering a 

rolling seven-day period. It was formatted as a text file, which could be converted into a 

spreadsheet. Put into a spreadsheet, one day of the Kochava Data Sample contained over 

4 
 

 

2a. Sub.script ion te rms 

© This p,cducl ha.s been published u paft of the Eitt cndcd Provider Program and has been m•kcd by the ptovldc, as conulnlng scosllive 

u l cg«lesor Informal.ion. The Extended Provider Program Is In PrcY1cw and sut)lcct to Section 2 <Jf the AWS ~rvJcc Toms l?I tBctas and 

Previews'). 

&,- $Ub1rittil9 \hi$ sub$<:ription request. ycu agree lh~ yW' 14c of \his P,odu<t Is subject to the pr()Yldcr'S offer terms including pricing 9'\fo,matii:m 

and o.u Subscnpoon Agreement ~ 

Vou also agec 1nd adcnOVlledge that AVIS may share lnfo,matlon about this tr<lnsacllon (lnclLtdlng your p<l)lmcot. t«ms and product US<lgc metrics> 

with the respective seller, reseller Of und«lying provider. a.s 1ppllc.able, In actonbncewkh the AWS Privacy Notice ~ A\YS 'MU Issue lnvoites.lnd 

c:oUcc.t paynel'r.$ rromyou on bcl'Qtr of the provider tlYoughyour A\YS account.. Your use of AWS service~ remilins subject t o the 

AWS Custcml'I' Agreement 0 or other 1sircanent with A\YS governing your use of such services. 

Compjny n .:.1'11(? 

Tl-e k9li entity thot wll 1.,se the product 

Ani.< ornii,;nt 

0 ollt c f 40 ct-aracten maxin-um. 

Name 

rte n3m,e cf the co~ 5 <C)"ltact p,er,on_ 

O ollt cf 40 ct-aracters :'TICX!mum. 

Email addre-s.s 

0 o\lt cf 100 characters maximum. 

lnu-nded use case 

Ycur intended 1,i~ ~for the dlt• product. indul1ins, .any comrrenb tN~ the ?rovidcr might hnd rc:lewnt to .agpl'Qvin;i your,ubs:ript or rcquert. 

O 0111 of .SOO r.ha1acte!" m.:ximum 

Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 5 of 11 

327,480,000 rows and 11 columns of data, corresponding to over 61,803,400 unique mobile 

devices. 

15. When an AWS purchaser clicked on the “subscribe” button for the Kochava Data 

Sample feed, the purchaser was directed to a screen that included a “Subscription terms” 

notification that stated that the Kochava Data Sample “has been marked by the provider [i.e., 

Kochava] as containing sensitive categories of information:” 

16. Below this notice, a form was displayed, requesting the purchaser’s company 

name, name of the purchaser, email address, and intended use case: 

5 
 

 

 

 

 

 

 

 

 

 

Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 6 of 11 

17. A purchaser could use an ordinary personal email address and describe the 

intended use simply as “business.” The request would then be sent to Kochava for approval. 

Kochava has approved such requests in as little as 24 hours. 

18. Once Kochava approved the request, the purchaser was notified by email and then 

gained access to the data, along with a data dictionary explaining the categories of data provided. 

19. The Kochava Data Sample included precise location data gathered in the seven 

days prior to the date Kochava approved the subscription request. 

Kochava’s Data Can Be Used to Identify People and Track Them to Sensitive Locations 

20. Precise geolocation data associated with MAIDs, such as the data sold by 

Kochava, may be used to track consumers to sensitive locations, including places of religious 

worship, places that may be used to infer an LGBTQ+ identification, domestic abuse shelters, 

medical facilities, and welfare and homeless shelters. For example, by plotting the latitude and 

longitude coordinates included in the Kochava data stream using publicly available map 

programs, it is possible to identify which consumers’ mobile devices visited reproductive health 

clinics. Further, because each set of coordinates is time-stamped, it is also possible to identify 

when a mobile device visited the location. Similar methods may be used to trace consumers’ 

visits to other sensitive locations. 

21. The location data provided by Kochava is not anonymized. It is possible to use 

the geolocation data, combined with the mobile device’s MAID, to identify the mobile device’s 

user or owner. For example, some data brokers advertise services to match MAIDs with 

“offline” information, such as consumers’ names and physical addresses. 

6 
 

 

 

 

 

 

 

 

 

HOUSEHOLD MAPPING: 

Group devices by dwelling time and frequency at shared locations to map individual devices to households. 

Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 7 of 11 

22. Even without such services, however, location data can be used to identify people. 

The location data sold by Kochava typically includes multiple timestamped signals for each 

MAID. By plotting each of these signals on a map, much can be inferred about the mobile 

device owners. For example, the location of a mobile device at night likely corresponds to the 

consumer’s home address. Public or other records may identify the name of the owner or 

resident of a particular address. Indeed, Kochava has recognized that its data may be used to 

track mobile devices to home addresses. In its marketing on the AWS Marketplace, it has 

suggested “Household Mapping” as a potential use case of the data: 

23. Kochava employs no technical controls to prohibit its customers from identifying 

consumers or tracking them to sensitive locations. For example, it does not employ a blacklist 

that removes from or obfuscates in its data set location signals around sensitive locations 

including, among others, locations associated with medical care, reproductive health, religious 

worship, mental health, temporary shelters, such as shelters for the homeless, domestic violence 

survivors, or other at-risk populations, and addiction recovery. 

Kochava’s Practices Cause and Are Likely to Cause Substantial Injury to Consumers 

24. As described above, the data sold by Kochava may be used to identify individual 

consumers and their visits to sensitive locations. The sale of such data poses an unwarranted 

intrusion into the most private areas of consumers’ lives and causes or is likely to cause 

substantial injury to consumers. 

7 
 

 

 

 

 

 

Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 8 of 11 

25. For example, the data may be used to identify consumers who have visited an 

abortion clinic and, as a result, may have had or contemplated having an abortion. In fact, in just 

the data Kochava made available in the Kochava Data Sample, it is possible to identify a mobile 

device that visited a women’s reproductive health clinic and trace that mobile device to a singlefamily residence. The data set also reveals that the same mobile device was at a particular 

location at least three evenings in the same week, suggesting the mobile device user’s routine. 

The data may also be used to identify medical professionals who perform, or assist in the 

performance, of abortion services 

26. As another example, the data could be used to track consumers to places of 

worship, and thus reveal the religious beliefs and practices of consumers. In fact, the Kochava 

Data Sample identifies mobile devices that were located at Jewish, Christian, Islamic, and other 

religious denominations’ places of worship. 

27. As another example, the data could be used to track consumers who visited a 

homeless shelter, domestic violence shelter, or other facilities directed to at-risk populations. 

This information could reveal the location of consumers who are escaping domestic violence or 

other crimes. In addition, because Kochava’s data allows its customers to track consumers over 

time, the data could be used to identify consumers’ past conditions, such as homelessness. In 

fact, the Kochava Data Sample identifies a mobile device that appears to have spent the night at a 

temporary shelter whose mission is to provide residence for at-risk, pregnant young women or 

new mothers. 

8 
 

 

 

 

 

 

 

 

 

 

 

Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 9 of 11 

28. As another example, the data could be used to track consumers who have visited 

addiction recovery centers. The data could show how long consumers stayed at the center and 

whether a consumer relapses and returns to a recovery center. 

29. Identification of sensitive and private characteristics of consumers from the 

location data sold and offered by Kochava injures or is likely to injure consumers through 

exposure to stigma, discrimination, physical violence, emotional distress, and other harms. 

30. These injuries are exacerbated by the fact that, as described above, Kochava lacks 

any meaningful controls over who accesses its location data feed, including the Kochava Data 

Sample. 

31. The collection and use of their location data are opaque to consumers, who 

typically do not know who has collected their location data and how it is being used. Indeed, 

once information is collected about consumers from their mobile devices, the information can be 

sold multiple times to companies that consumers have never heard of and never interacted with. 

Consumers have no insight into how this data is used – they do not, for example, typically know 

or understand that the information collected about them can be used to track and map their past 

movements and that inferences about them and their behaviors will be drawn from this 

information. Consumers are therefore unable to take reasonable steps to avoid the abovedescribed injuries. 

32. The harms described above are not outweighed by countervailing benefits to 

consumers or competition. Defendant could implement safeguards to remove data associated 

with sensitive locations from its data feeds. Such safeguards could be implemented at a 

reasonable cost and expenditure of resources. 

9 
 

 

 

 

 

 

Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 10 of 11 

* * * 

33. Based on the facts and violations of law alleged in this Complaint, the FTC has 

reason to believe that Defendant is violating or is about to violate laws enforced by the 

Commission. 

VIOLATIONS OF THE FTC ACT 

34. Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), prohibits “unfair or deceptive acts 

or practices in or affecting commerce.” 

35. Acts or practices are unfair under Section 5 of the FTC Act if they cause or are 

likely to cause substantial injury to consumers that consumers cannot reasonably avoid 

themselves and that is not outweighed by countervailing benefits to consumers or competition. 

15 U.S.C. § 45(n). 

Count I 

Unfair Sale of Sensitive Data 

36. In numerous instances, Defendant has sold, licensed, or otherwise transferred 

precise geolocation data associated with unique persistent identifiers that reveal consumers’ 

visits to sensitive locations, including, among others, locations associated with medical care, 

reproductive health, religious worship, mental health, temporary shelters, such as shelters for the 

homeless, domestic violence survivors, or other at-risk populations, and addiction recovery. 

37. Defendant’s actions cause or are likely to cause substantial injury to consumers 

that consumers cannot reasonably avoid themselves and that is not outweighed by countervailing 

benefits to consumers or competition. 

10 
 

 

 

 

 

 

 

 

 

 

 

Case 2:22-cv-00377-DCN Document 1 Filed 08/29/22 Page 11 of 11 

38. Therefore, Defendant’s acts or practices as set forth in Paragraph 35 constitute 

unfair acts or practices in violation of Section 5 of the FTC Act, 15 U.S.C. § 45(a), (n). 

CONSUMER INJURY 

39. Consumers are suffering, have suffered, and will continue to suffer substantial 

injury as a result of Defendant’s violations of the FTC Act. Absent injunctive relief by this 

Court, Defendant is likely to continue to injure consumers and harm the public interest. 

PRAYER FOR RELIEF 

Wherefore, Plaintiff requests that the Court: 

A. Enter a permanent injunction to prevent future violations of the FTC Act by 

Defendant; and 

B. Award any additional relief as the Court determines to be just and proper. 

Respectfully submitted, 

Dated: August 29, 2022 /s Brian Shull 

BRIAN SHULL 

JULIA A. HORWITZ 

Federal Trade Commission 

600 Pennsylvania Avenue, N.W. 

Washington, D.C. 20580 

(202) 326-3734 (Shull) 

(202) 326-2269 (Horwitz) 

bshull@ftc.gov 

jhorwitz@ftc.gov 

Attorneys for Plaintiff 

FEDERAL TRADE COMMISSION 

11