On August 29, 2022, the FTC sued data broker Kochava, alleging it sold geolocation data from hundreds of millions of mobile devices that could trace people to and from sensitive locations, including reproductive health clinics, places of worship, shelters and addiction recovery facilities. The FTC said a publicly available sample covered more than 61 million devices. For private practices, the case showed that location-based advertising built on broker data can raise serious privacy concerns, especially near healthcare locations.
Location is one of the most revealing things a phone knows. Where a person sleeps suggests their home. Where they go on weekday mornings suggests their job. Where they visit once and never again, or visit every week for months, can suggest a medical condition, a recovery program or a life change they have told almost no one about.
In August 2022, the Federal Trade Commission put that concern at the center of a lawsuit. It sued a data broker, Kochava, alleging that the location data it sold could be used to trace people to sensitive places, including reproductive health clinics and addiction recovery facilities. For marketers, the case was a reminder that a popular advertising tactic, targeting people by where their phones have been, sits on top of a data market most patients never see.
This retrospective covers what the FTC alleged in 2022 and what it means for a private medical practice today. For related privacy chapters, see the 2022 Meta Pixel hospital findings, the HHS tracking bulletin of 2022, the 2023 FTC and HHS warning letters and Washington’s My Health My Data Act.
What actually happened in 2022
August 29: the lawsuit. The FTC announced it had filed a lawsuit against Idaho-based data broker Kochava for selling geolocation data from hundreds of millions of mobile devices.
Sensitive locations. The FTC alleged the data could reveal visits to reproductive health clinics, places of worship, homeless and domestic violence shelters, and addiction recovery facilities, exposing people to risks including stigma, stalking, discrimination and job loss.
How identification worked. According to the complaint, the data feeds matched device identifiers with timestamped locations. A device’s location at night is likely the user’s home, which could be combined with property records to uncover identity.
A public sample. The FTC alleged that until at least June 2022, anyone could obtain a large data sample with little effort. The sample it examined included precise, timestamped location data from more than 61 million unique mobile devices in the previous week.
Recovery centers. The FTC said the data could show how long people stayed at an addiction recovery center and whether they returned, suggesting a possible relapse.
The broader push. The FTC noted that it had warned businesses in July 2022 that it would enforce the law against illegal use and sharing of sensitive data, including health data, and that it was exploring rules on commercial surveillance. The commission vote to file was 4-1, and the case was left for the court to decide.
Why it mattered for private practices
Many practices never buy location data directly. But some marketing tactics depend on it. Geofencing, which serves ads to phones that have entered a defined area, can be set up around a competitor’s clinic, a hospital, a gym or a neighborhood. Some vendors sell audiences based on visits to certain kinds of places. The data behind those audiences often flows through brokers.
The Kochava case showed what that data can reveal. A geofence around a healthcare facility is, by design, a list of people who visited a healthcare facility. When the facility treats a sensitive condition, that list becomes sensitive too.
For practices, the risk is both legal and reputational. A patient who learns they were targeted with ads because their phone was detected at a clinic is unlikely to feel well served. And regulators had made clear in 2022 that health-related location data was a priority.
What typical agencies did
Some agencies continued to pitch geofencing around competitor clinics and hospitals as a clever tactic, without asking where the location data came from or whether the targeting complied with platform policies and privacy law. Some bought audience segments from vendors with little visibility into how the data was gathered.
Others never used location data at all and relied on broad radius targeting from major ad platforms, which is generally based on location settings and signals the platforms manage under their own policies.
The careful approach separated ordinary geographic targeting, such as showing ads to people in a practice’s service area, from targeting based on visits to sensitive places. The first is routine. The second deserves serious scrutiny.
What it means for a private practice today
Privacy laws and platform rules have evolved since 2022. These steps keep location-based marketing on solid ground.
1. Know your data sources
Ask every vendor where any location or audience data comes from, how consent was obtained and what it reveals.
2. Avoid sensitive geofences
Do not target people based on visits to healthcare facilities, recovery centers, shelters or similar locations.
3. Prefer service-area targeting
Target the geography you serve through major ad platforms rather than broker-built visit audiences.
4. Check platform policies
Major platforms restrict health-related targeting. Confirm campaigns comply before launch.
5. Review state laws
Some states now restrict geofencing near healthcare facilities or regulate consumer health data. Get legal advice.
6. Document decisions
Keep a record of targeting choices and the reasoning behind them.
Geography versus surveillance
Not all location-based marketing is the same, and treating every kind as equally risky can lead practices to abandon useful, ordinary tools along with the problematic ones. A practice in a particular city has every reason to show ads to people who live or work nearby. Major ad platforms support this with radius and region targeting based on signals they manage, such as a user’s location settings and general area. That is ordinary geographic advertising, and it is how most local businesses reach their market.
Targeting people because their phone was detected at a specific sensitive place is different. It uses fine-grained movement data to infer something about a person’s life. In healthcare, those inferences can be about pregnancy, addiction, mental health or serious illness. Even if a practice’s intent is benign, the mechanism treats a patient’s movements as a marketing signal.
The distinction is worth stating clearly in an agency agreement: the practice wants to reach people in its service area, not people identified by where they have been.
State laws moved after 2022
The Kochava case was not the only response. Several states have since passed laws addressing consumer health data and, in some cases, geofencing around healthcare facilities. Washington’s My Health My Data Act, for example, includes restrictions on geofences around certain healthcare locations. Other states have taken related approaches. The details differ, and a practice operating in or advertising to multiple states should get advice on each.
The trend is consistent, even if the specific rules are not uniform from state to state. Lawmakers and regulators have treated health-related location data as sensitive, and the room for aggressive location targeting near healthcare has narrowed.
The patient’s view
Imagine a patient who visits a specialist for a private concern, then begins seeing ads from a competing clinic offering the same treatment. They may not know how it happened, but they will sense that something tracked them. That feeling attaches to the brand doing the advertising.
Premium practices compete on trust. A marketing approach that could make a prospective patient feel watched works against the very thing the practice is trying to build. The better path is to earn attention with helpful content, strong reviews, a clear website and ads shown to the right geography, not to people identified by their movements.
Reaching local patients the durable way
The appeal of geofencing is that it promises to find people who are already interested. But there are reliable ways to reach high-intent local patients that do not depend on movement data at all.
Search is the clearest. A person who types a treatment and a city into Google has told the search engine exactly what they want and where. A practice with a strong Google Business Profile, a fast website with genuinely useful service pages and steady, authentic reviews is positioned to appear when that happens. Paid search can add reach for the same intent, targeted by geography and keywords rather than by where someone’s phone has been.
Referral relationships are another. Primary care physicians, complementary specialists, fitness professionals and past patients send people who already trust the practice. Strengthening those relationships with clear communication and good outcomes compounds over years.
Finally, there is the practice’s own audience. Educational content, events and a consented email list keep the practice in front of people who chose to hear from it. None of these approaches require buying data about anyone’s movements, and all of them build assets the practice owns. They also survive changes in privacy law and platform policy, because they rest on what patients chose to share rather than on what a device revealed.
A vendor checklist for location data
When an advertising vendor proposes any location-based audience, a short set of questions clarifies the risk. What exactly defines the audience: a geographic area, or devices detected at specific places? Where does the underlying data come from, and did the people involved consent to this use? Are any healthcare, recovery or other sensitive locations included in the targeting or the source data? Can the vendor provide written confirmation of how its data complies with platform policies and applicable state laws? What happens to the data after the campaign ends?
A vendor that answers clearly and in writing is easier to trust. A vendor that cannot explain its data sources, or describes them only as proprietary, is a risk the practice inherits. For most premium practices, the simplest decision is to avoid visit-based audiences around any healthcare location and rely on service-area targeting and first-party relationships instead.
Those first-party relationships are worth investing in. Patients who opt in to a practice’s email list, follow its social accounts or return for repeat visits provide a consented, durable audience. Marketing to them with genuinely useful information builds loyalty without any reliance on movement data from brokers.
What 2022 does not tell us
The FTC filed a complaint in 2022; it did not establish that Kochava violated the law. The case concerned a data broker, not medical practices or their agencies, and we have no public data showing how often practices used broker location data. What 2022 does show is that regulators viewed health-related location data as highly sensitive and were willing to act.
The premium practice advantage
A premium practice grows by earning trust, not by tracking movements. See our approach to predictable growth, our call handling and lead leakage work, our full services, who we help and how we approach Google Maps and AI search visibility. Our team works from Austin with practices nationwide.
The bottom line
In August 2022, the FTC sued Kochava over location data that could track people to clinics, shelters and recovery centers. For private practices, the lesson was to target the geography you serve, avoid sensitive geofences and know where every audience comes from.
Check if your market is open. We take one practice per specialty per market. Request a market check or call (716) 400-0084.
Put this playbook to work: see how it applies to med spa marketing.
Frequently asked questions
What did the FTC allege against Kochava?
That the data broker sold precise geolocation data from hundreds of millions of mobile devices that could be used to trace people to sensitive locations and identify them.
Which sensitive locations did the FTC name?
Reproductive health clinics, places of worship, homeless and domestic violence shelters, and addiction recovery facilities.
How large was the data sample the FTC examined?
The FTC said the sample included precise, timestamped location data from more than 61 million unique mobile devices in the previous week, and that it was available with little effort until at least June 2022.
Was the case decided in 2022?
No. The FTC filed a complaint in August 2022, and the commission noted that the case would be decided by the court.
Why does this matter to medical practices?
Some location-based advertising, such as geofencing around clinics or competitors, relies on device location data. The case highlighted how sensitive that data can be near healthcare locations.
What should a practice ask its agency?
Where any location data used in campaigns comes from, whether it involves sensitive places, and how it complies with platform policies and privacy laws.