> Kochava and the GDPR: device identifiers, consent for IDFA and GAID, US data transfers and how to run mobile attribution for European users lawfully. > > Canonical: https://www.flowconsent.com/en/services/advertising/kochava Advertising # Kochava Marketing · [Official website](https://www.kochava.com) Kochava is a US-based mobile measurement partner (MMP) used by app publishers to attribute installs, track campaign performance, and route conversion postbacks to ad networks. It processes device identifiers (IDFA, GAID), IP, install timestamps and post-install events. European app developers face significant compliance hurdles: GDPR consent, Apple ATT, the 2022 FTC complaint against Kochava for geolocation data sale, and the cross-border transfer to the United States. [Block Kochava until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=advertising) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Advertising](https://www.flowconsent.com/en/services/advertising) - Consent Marketing - Prior consent Required - Documented cookies 3 - Third-party domains 4 - Servers Kochava Inc., Sandpoint, Idaho, United States. AWS US regions primary infrastructure Overview ## What does Kochava do? ## **What is Kochava** Kochava is an established mobile measurement partner (MMP) competing with AppsFlyer, Adjust and Branch. It provides SDKs for iOS, Android, web, CTV and server-to-server APIs to attribute app installs and post-install events to specific ad campaigns, partners and creatives. ## **Data collected** Kochava processes IDFA (iOS), GAID (Android), device model, OS, IP, language, app version, install/open timestamps, in-app events, purchases and (if enabled) geolocation. Postbacks to media partners include user identifiers needed for attribution. The web SDK additionally sets first-party cookies. ## **GDPR, ePrivacy, ATT and UMP** Advertising identifiers are personal data under GDPR. Their collection requires consent under Art. 6(1)(a) and Art. 5(3) ePrivacy. On iOS, the Apple ATT prompt is an additional gate; without ATT permission Kochava receives a zeroed IDFA. On Android, Google's UMP framework is the recommended consent mechanism. Implement consent before initialising the Kochava SDK and pass the user's decision to the SDK via setIntelligentConsent. ## **FTC lawsuit context** In August 2022 the US FTC filed suit against Kochava over alleged sale of precise geolocation data tied to mobile advertising IDs, claiming it could be used to identify visits to sensitive locations (medical clinics, places of worship, shelters). European DPAs have referenced this case when evaluating MMP risk. Disable Kochava's data marketplace / audience export features when operating in the EU unless you have a documented Art. 9 GDPR basis. ## **Data transfers** Kochava processes data in the US. Transfers covered by 2021 SCCs and DPF (where applicable). Run a Transfer Impact Assessment, especially given the FTC case. Document downstream media partner postbacks separately. ## **Compliance checklist** 1\. Sign Kochava DPA. 2. Implement ATT/UMP and a GDPR CMP. 3. Disable data marketplace features. 4. Run a DPIA covering identifiers, geolocation and partner postbacks. 5. Document all media partner integrations. 6. Disclose Kochava in app store privacy nutrition labels. Compliance ## Kochava and the GDPR Kochava is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for advertising identifiers and install attribution; ATT (App Tracking Transparency) required on iOS in addition to GDPR consent - Risk level high - Applicable regulations GDPR, ePrivacy Directive, Apple ATT, Google UMP, FTC ruling against Kochava (2022, geolocation data sale) ### Impact assessment (DPIA) Kochava processes mobile advertising identifiers (IDFA, GAID), device fingerprint, IP, install and post-install events, in-app purchase data, geolocation if SDK is configured to collect it, and partner-shared user identifiers. Key DPIA considerations: (1) advertising IDs are personal data and require explicit consent in the EU; (2) Apple ATT and Google UMP add a layer of platform-level consent on top of GDPR; (3) the FTC sued Kochava in 2022 for allegedly selling sensitive geolocation data, which heightens scrutiny; (4) US transfer triggers Chapter V; (5) post-install event attribution often combines several personal data flows from media partners. A full DPIA is essential, plus a documented decision on whether to enable Kochava's data marketplace features. ### Sample text for your banner > With your consent, we use Kochava to measure the effectiveness of our advertising campaigns. Kochava processes your device advertising identifier (IDFA on iOS, GAID on Android), IP, and app event data on its servers in the United States. You can refuse this processing during the App Tracking Transparency prompt (iOS) or via our in-app privacy settings. Cookies and trackers ## What Kochava sets and contacts - Tracking method Mobile measurement and attribution platform with SDKs for iOS, Android, web and CTV. Server-to-server postbacks, web SDK that sets first-party cookies, device identifiers (IDFA, GAID) and fingerprinting - Server location Kochava Inc., Sandpoint, Idaho, United States. AWS US regions primary infrastructure - Data transferred outside the EU Device identifiers, IP, advertising IDs, install events and post-install behavioural data are transferred to Kochava in the US. Transfers covered by 2021 SCCs. Kochava also receives signals from media partner SDKs which may have their own transfer chains. ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------ | ----------------------- | -------- | --------------------------------------------------------------------------------------------------- | | koc\_uid | Marketing / Advertising | 1 year | Persistent visitor identifier set by the Kochava web SDK to attribute web installs and conversions. | | koc\_session | Functional | Session | Session identifier used to group events from the same browsing session. | | koc\_consent | Strictly necessary | 1 year | Stores the visitor's consent decision for Kochava tracking. | ### Third-party domains contacted (4) - `kochava.com` - `control.kochava.com` - `click.kochava.com` - `imp.control.kochava.com` Questions ## Frequently asked questions about Kochava Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies and identifiers does Kochava use? Mobile: IDFA (iOS), GAID (Android), device fingerprint, IP. Web SDK: koc\_uid (visitor ID), koc\_session. All non-essential, all require consent. ### Do I need consent for Kochava? Yes. GDPR consent for advertising identifier collection plus Apple ATT (iOS) or Google UMP (Android). The SDK must be initialised only after consent is granted. ### What is the legal basis? Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for advertising identifiers and behavioural attribution. Without consent, fall back to deterministic but non-personal attribution. ### Is data transferred to the US? Yes. Kochava processes all data in the US. SCCs and DPF cover the transfer. Run a TIA. Document the 2022 FTC lawsuit context in your risk assessment. ### Do I need a DPIA? Yes. Mobile attribution combines advertising IDs, behavioural events, US transfer and (potentially) geolocation, satisfying multiple Art. 35(3) GDPR criteria. ### How do I implement Kochava in compliance? Sign the DPA, integrate a CMP and ATT/UMP, disable data marketplace, document all partner postbacks, run a DPIA, retain proof of consent for the relevant period. ### What alternatives exist? EU-friendly mobile attribution: Adjust (Germany, EU hosting available), Singular (US, EU options), AppsFlyer (Israel, EU options). Self-attribution via Apple SKAdNetwork or Google Privacy Sandbox can reduce personal data flows. ### How do I update my app store privacy and policies? In your privacy notice, identify Kochava as a processor and (for marketplace features) controller; list IDFA/GAID, IP, events; disclose US transfer; document FTC litigation context. In app store privacy nutrition labels, declare device IDs and usage data collection linked to user. Same category ## More services: Advertising [See the whole category](https://www.flowconsent.com/en/services/advertising) ### [Bench Media](https://www.flowconsent.com/en/services/advertising/bench) [Bench is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Bench provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Bench helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/advertising/bench) [Marketing](https://www.flowconsent.com/en/services/advertising/bench) · ### [A8.net](https://www.flowconsent.com/en/services/advertising/a8-net) [A8.net is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. A8.net supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, A8.net ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/advertising/a8-net) [Marketing](https://www.flowconsent.com/en/services/advertising/a8-net) · ### [Tracify](https://www.flowconsent.com/en/services/advertising/tracify) [Tracify is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Tracify integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Tracify makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/advertising/tracify) [Marketing](https://www.flowconsent.com/en/services/advertising/tracify) · ### [Booking.com widget](https://www.flowconsent.com/en/services/advertising/booking-com-widget) [Booking.com widget is an online scheduling and booking platform that enables businesses to automate appointment management and reduce no-shows. It provides a customizable booking interface, calendar synchronization, and automated reminders via email and SMS. Booking.com widget supports multiple service types, staff scheduling, and payment collection. With timezone detection and availability management, Booking.com widget simplifies scheduling across any industry and business size.](https://www.flowconsent.com/en/services/advertising/booking-com-widget) [Marketing](https://www.flowconsent.com/en/services/advertising/booking-com-widget) · ### [ReadyPlanet](https://www.flowconsent.com/en/services/advertising/readyplanet) [ReadyPlanet is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. ReadyPlanet enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, ReadyPlanet empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/readyplanet) [Marketing](https://www.flowconsent.com/en/services/advertising/readyplanet) · ### [Aarki](https://www.flowconsent.com/en/services/advertising/aarki) [Aarki is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Aarki enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Aarki empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/aarki) [Marketing](https://www.flowconsent.com/en/services/advertising/aarki) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)