All Vendors
attribution

Kochava

Kochava is a mobile attribution and data brokerage vendor that provides omnichannel measurement across mobile, web, and CTV while simultaneously operating a location data marketplace — a combination that led to an FTC lawsuit for selling geolocation data that tracked individuals to reproductive health clinics, places of worship, and domestic violence shelters.

10 IOCs
0
Vendor Risk Score

How This Briefing Works

This report opens with key findings, then maps the gaps between what Kochava discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.

Key Findings

Analysis pending. Findings will appear here once intelligence collection is complete.

Disclosure Gaps

Claims vs. Observed Behavior

3 gaps

pending_verification

HIGH
They Claim

“Privacy Profiles limit SDK data collection”

Observed Behavior

Feature exists per documentation, but effectiveness depends on default configurations and whether privacy blocks cover all sensitive data categories beyond the settlement requirements

pending_verification

HIGH
They Claim

“Radical data transparency with raw data access”

Observed Behavior

Transparency about data collection does not address the risk of that data being resold or used beyond the measurement relationship; awaiting scanner verification of actual SDK data collection scope

pending

UNKNOWN
They Claim

“Awaiting full scanner observation”

Observed Behavior

Analysis based on FTC filings, court documents, public documentation, and settlement terms. Runtime SDK behavior and current data sharing practices require direct observation.

Customer Impact

What This Means For You

Regulatory Risk: The active FTC lawsuit creates direct exposure. Organizations using Kochava may need to disclose this relationship in privacy impact assessments and could face questions from regulators about their role in the data supply chain the FTC has challenged. The class-action settlement's two-year injunction provides only temporary protection. Revenue Risk: Attribution measurement is standard MMP functionality, but the reputational risk of association with an FTC-targeted data broker may affect brand perception, particularly for privacy-conscious customer segments. Marketing teams may face internal governance challenges justifying continued use. Data Exposure: The documented data brokerage operations mean device-level data collected through the attribution SDK has been commercially available to unknown third parties. Even with settlement restrictions, historical data exposure cannot be reversed, and the collection infrastructure persists. Competitive Intelligence: Like all MMPs, attribution postbacks share conversion data with ad network partners. The additional data marketplace dimension means device-level signals may reach a broader set of buyers beyond the advertising ecosystem.
Recommended Actions

What To Do About It

Role-specific actions based on observed behavior

Recommended Actions for Kochava

  • →- Immediately assess whether your Kochava SDK deployment contributes location data to the data brokerage pipeline and implement Privacy Profiles to restrict collection to attribution-only signals. - Review your organization's data processing agreements with Kochava for clauses permitting secondary use, resale, or aggregation of data collected through your application. - Evaluate migration to an MMP that does not operate data brokerage operations alongside measurement services, given the structural conflict of interest. - Document your Kochava relationship in privacy impact assessments and be prepared to address regulator inquiries about data supply chain participation. - Monitor the ongoing FTC case and the class-action settlement injunction expiration timeline to anticipate changes in Kochava's data practices.

Negotiation Leverage

  • →Leverage Points: The FTC lawsuit and class-action settlement significantly weaken Kochava's negotiating position. The company faces reputational pressure and regulatory scrutiny that creates strong incentive to accommodate customer privacy demands. The competitive MMP market (AppsFlyer, Adjust, Singular, Branch) provides credible migration alternatives, giving you walk-away power.
  • →Key Questions: (1) Is any data collected through our SDK deployment used for, or contributed to, Kochava's data marketplace operations (Kochava Collective / Collective Data Solutions)? (2) What specific data fields does the SDK collect by default, and which can be disabled without breaking attribution functionality? (3) How has the corporate restructuring into Collective Data Solutions affected data flows from the MMP product? (4) What protections exist after the two-year settlement injunction expires? (5) Can you contractually guarantee that no data from our SDK deployment will be resold or used for purposes beyond our measurement relationship?
  • →Contract Protections: Demand explicit contractual prohibition on any secondary use or resale of data collected through your SDK deployment. Require notification if data practices change post-settlement. Include audit rights with third-party verification capability. Negotiate termination clauses tied to adverse regulatory outcomes in the FTC case. Consider requiring data escrow or deletion verification.
IOC Manifest

IOC Manifest

10 INDICATORS

Indicators of compromise across 2 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.

No indicators in this category

Ecosystem

Ecosystem & Supply Chain

Kochava integrates with major ad networks, DSPs, and media platforms for attribution postbacks. The platform also connects to its own data marketplace infrastructure (Kochava Collective / Collective Data Solutions, LLC) which has historically sold device-level data to third parties. CTV measurement integrations extend the data collection surface to connected TV environments. The dual MMP-plus-data-broker model means Kochava's ecosystem is broader than typical attribution vendors — data collected for measurement purposes flows into a separate commercial pipeline. Partner integrations include standard ad networks (Google, Meta, TikTok) plus data buyers, location intelligence firms, and other entities in the data brokerage supply chain.
Evidence

Evidence Artifacts

Artifacts collected during analysis, available with evidence-tier access.

HAR Capture

Complete network capture with all requests and responses

IOC Manifest

10 detection signatures across scripts, domains, cookies, and network endpoints

Vendor Details