John Z Black
Brunswick, ME • (207) 245-1010 • contact@johnzblack.com
A company called Kochava was tracking which abortion clinics people visited. Not abstractly, not in aggregate. Precise location data, timestamped, tied to mobile device identifiers, packaged and sold to whoever would pay for it.
The FTC sued them in August 2022. On February 27, 2026, that case settled. Kochava is now banned from selling sensitive location data and required to destroy the data it already collected.
Data brokers are companies that collect information about people from dozens of sources (apps on your phone, loyalty programs, location services, online activity), package it, and sell it. Advertisers, insurance companies, law enforcement, political campaigns are all customers. The people whose data is being sold almost never know any of this is happening. Kochava’s product included location data granular enough to show whether a specific device had visited an abortion clinic, a domestic violence shelter, or an addiction rehab center. In states where abortion access is restricted or criminalized, that data isn’t just invasive. It’s potentially dangerous.
This isn’t a one-off enforcement action. In December 2024, the FTC settled with Mobilewalla and Gravy Analytics, two other data brokers selling sensitive location data. Same category of violation. Kochava is the third case in roughly 14 months. That’s an enforcement posture, not just occasional action.
The destruction requirement is notable. In most privacy enforcement contexts, companies pay fines and change practices going forward. The data that’s already out there stays out there. This settlement goes further: the historical records of who visited what clinic have to go. Whether that’s fully verifiable is a different question, but the legal obligation exists. That’s more than consumers have had in most comparable situations.
On the state level, California launched the DROP platform in 2026, a mechanism from the DELETE Act that lets California residents submit a single deletion request to multiple data brokers simultaneously. Before this, opting out meant finding each broker individually, one at a time, across hundreds of companies. Most people gave up. This removes that friction on purpose.
The data broker market hasn’t been fixed. But the legal landscape is shifting, and enforcement cases like Kochava put the whole thing in public record. When people know this market exists, they get angry. That feedback loop is how this gets better over time.