Loading story…
New York has begun enforcing the Algorithmic Pricing Disclosure Act, requiring companies to disclose when they use algorithms and personal data to adjust prices for consumers. This legislation aims to increase transparency around 'surveillance pricing,' where businesses leverage customer data such as location, browsing history, and online behavior to set individualized prices. The Federal Trade Commission (FTC) has also highlighted concerns about these practices, warning that companies could use a wide range of personal data to influence pricing decisions, potentially leading to unfair or discriminatory outcomes for consumers.
Separately, the data broker Kochava has agreed to significant changes in its business operations as part of a legal settlement, including ceasing the sale or sharing of sensitive geolocation data and implementing an opt-out mechanism for consumers. The settlement, which awaits final judicial approval, follows FTC allegations that Kochava's sale of precise location data violated rules against unfair and deceptive practices. These developments reflect a broader regulatory push in the United States to address privacy risks and increase accountability for companies that collect, use, and monetize consumer data for pricing and marketing purposes.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
New York state moved to curb 'surveillance pricing,' a practice in which companies use personal data to set individualized prices, reflecting broader regulatory pressure on data brokers and commercial surveillance practices. The development was reported as part of a wider push against data-driven consumer targeting.
Kochava agreed to change its business practices to settle the FTC's case, including limits on selling or licensing precise geolocation data and requirements tied to sensitive-location information. The settlement marked a resolution of the long-running dispute over the broker's handling of location data.
A federal judge dismissed the FTC's case against Kochava, finding problems with how the complaint was pleaded while allowing the regulator an opportunity to continue pursuing the matter through an amended complaint.
The U.S. Federal Trade Commission filed a lawsuit against data broker Kochava alleging that the company sold sensitive precise geolocation data that could be used to track people to locations such as medical facilities, places of worship, shelters and other sensitive sites.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Federal Trade Commission reached a proposed settlement with data broker **Kochava** and its subsidiary **Collective Data Solutions** that would prohibit them from selling, sharing, or disclosing sensitive location data without consumers’ **affirmative express consent**. The FTC said Kochava sold precise geolocation data tied to hundreds of millions of mobile devices, along with related information such as mobile device IDs, app usage data, and demographic details, in ways that could expose visits to sensitive locations including **health care facilities** and **places of worship**. The proposed order, approved by the FTC in a 2-0 vote and filed in federal court in Idaho, requires Kochava to limit sensitive location data use to consumer-requested services, verify suppliers’ consent practices, notify the FTC about certain improper third-party disclosures, tell consumers who purchased their precise location data, allow consent to be withdrawn, and follow a retention and deletion schedule. The case stems from an FTC lawsuit first filed in 2022, and while the settlement does not impose a fine, it formalizes restrictions that overlap with commitments Kochava had already made in a separate class-action settlement to stop monetizing sensitive location data collected through app SDKs.
Jul 2, 2026
A U.S. congressional investigation by the Joint Economic Committee’s Democratic minority estimated that identity theft tied to breaches at **four major data brokers** has cost American consumers roughly **$20 billion**, and highlighted how some brokers obscured legally required “opt-out” pages (including use of `no-index` tactics that made deletion/opt-out pages harder to find). The report, prompted by investigative reporting, said several large brokers subsequently engaged with congressional staff and changed practices to make it easier for consumers to control the collection and sale of their personal data. California regulators separately escalated enforcement of opt-out requirements under state privacy law, with the **California Privacy Protection Agency (CPPA)** fining **PlayOn Sports** **$1.1 million** over allegations that its *GoFan* ticketing platform used tracking technologies for targeted advertising without providing a compliant, easy-to-use opt-out mechanism. The CPPA said users—including large numbers of high school students—were effectively forced to “agree” to tracking to access paid tickets and services, and that directing users to industry opt-out programs (e.g., Network Advertising Initiative / Digital Advertising Alliance) did not satisfy California’s requirement that companies provide their **own** opt-out tool and clear disclosures.
Jun 29, 2026
The European Commission unveiled a digital omnibus package aimed at cutting compliance burdens for businesses while keeping core protections for **data protection, cybersecurity, safety, and fairness** intact. The proposal would simplify rules across AI, cyber, and data regulation, including delaying some obligations for high-risk AI systems until standards and support tools are ready, creating a **single entry point** for cybersecurity incident reporting, and making targeted adjustments to the GDPR and the Data Act. Brussels said the measures could save companies up to **€5 billion** in administrative costs by 2029, alongside broader plans such as a data union strategy to expand access to high-quality data for AI and strengthen safeguards for sensitive non-personal data. In the United States, policy advocates renewed calls for Congress to pass the **SECURE Data Act** as a federal privacy framework to replace the current patchwork of state laws with a single national standard. The proposal would emphasize data minimization, require affirmative consent for sensitive personal information, add protections around automated profiling and children’s data, and rely on enforcement by the **Federal Trade Commission** and state attorneys general. Together, the developments reflect parallel efforts on both sides of the Atlantic to streamline digital compliance while establishing clearer privacy and data-governance rules for businesses and emerging technologies.
Jul 28, 2026