Kochava

United States · www.kochava.com · 23 vendors

Kochava Inc. is an omnichannel measurement and attribution platform that provides secure, real-time data solutions for advertisers and publishers. The company helps marketers understand, measure, and optimize their marketing performance across various channels and devices. Its services include mobile app attribution, analytics, and fraud prevention, empowering clients with actionable insights for campaign management and ROI optimization.

Resilience scores

Disruption prediction

Kochava has an estimated 10% probability of disruption in the next 6 months.

5 of Kochava's 23 vendors monitored for disruptions.

Technology vendors

Services catalogue

3 services in catalogue across 3 categories; runs on 23 sub-vendors.

Insights

Last updated 2026-08-13 · revision 1

23 direct vendors, 177 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Kochava exhibits a very high level of migration readiness, primarily due to its highly modern and cloud-native internal tech stack. The extensive use of Amazon Web Services (AWS), containerization technologies like Kubernetes and Docker, and distributed systems such as Apache Kafka and Apache Cassandra, along with programming languages like Go and Python, indicates an architecture that is inherently flexible, portable, and well-suited for cloud migration or shifting between cloud environments. The adoption of Terraform for infrastructure-as-code further enhances this readiness by enabling automated and repeatable infrastructure deployments. However, the assessment is constrained by a lack of information regarding specific regulatory environments, data residency requirements, and the company's financial stability, which could all influence the feasibility and complexity of a migration project. The vendor relationship data presents some ambiguity; while "Total Vendors: 0" is stated, there are "Total Services: 10" from vendors with headquarters in the United States, United Kingdom, and Japan. The exact number of unique vendors is not specified, making it challenging to precisely quantify vendor lock-in risk. Despite these unknowns, the robust and modern technical foundation positions Kochava very favorably for any future migration initiatives.

Compliance

7 in-scope frameworks identified; showing 3.

GDPR (source) — Partially Compliant

Kochava explicitly acknowledges GDPR applicability and has implemented a compliance framework as a Data Processor. However, risk remains HIGH for several reasons: (1) Kochava processes personal data (device IDs, IP addresses) at massive scale across EU/EEA users on behalf of thousands of global clients, creating significant exposure; (2) The Privacy Shield framework referenced on their privacy page was invalidated by the Schrems II ruling (CJEU, July 2020), meaning their stated transfer mechanism is legally defunct — though they also mention Standard Contractual Clauses (SCCs) as an alternative; (3) Kochava was sued by the FTC in 2022 for selling sensitive location data, raising questions about the adequacy of their data minimization and purpose limitation practices under GDPR; (4) AdTech/MMP companies are under heightened scrutiny from EU Data Protection Authorities (e.g., IAB TCF enforcement by Belgian DPA); (5) The scale of processing (10+ billion events daily) amplifies the consequence of any compliance gap. Fines can reach €20M or 4% of global annual turnover.

Evidence: https://www.kochava.com/support-privacy/, https://www.privacyshield.gov/participant?id=a2zt0000000GnEHAA0&status=Active, https://www.kochava.com/opt-out-do-not-sell-request-process/, https://www.kochava.com/consent-management-platform/, https://www.kochava.com/website-visitor-privacy-policy/

IAB Transparency and Consent Framework — Partially Compliant

Kochava is an active IAB member and has implemented the IAB CCPA Compliance Framework. However, the IAB TCF (primarily relevant for EU/EEA digital advertising) has faced significant regulatory scrutiny — the Belgian DPA ruled the TCF non-compliant with GDPR in 2022, and the IAB Europe was fined. As an MMP operating in the EU digital advertising ecosystem, Kochava's reliance on TCF-based consent signals for GDPR lawful basis is legally uncertain. Risk is MEDIUM because Kochava acts as a Data Processor (not Controller) and its GDPR obligations are primarily fulfilled through client contracts, but the broader TCF compliance uncertainty affects the ecosystem in which Kochava operates.

Evidence: https://www.kochava.com/support-privacy/, https://www.kochava.com/consent-management-platform/, https://iabtechlab.com/standards/ccpa/

CPRA — Compliant

Kochava explicitly acknowledges CCPA applicability and states compliance in its capacity as a 'service provider.' The company is an active member of the IAB and has implemented the IAB CCPA Compliance Framework within its native measurement SDKs. However, risk remains MEDIUM because: (1) the FTC v. Kochava lawsuit (2022) alleged sale of sensitive consumer location data, which directly implicates CCPA's 'Do Not Sell' provisions and sensitive data protections under CPRA; (2) CPRA (effective January 1, 2023) introduced new requirements around sensitive personal information, data minimization, and purpose limitation that may require additional compliance measures; (3) Kochava's business model involves processing large volumes of consumer behavioral data, which is a high-scrutiny area for California regulators.

Evidence: https://www.kochava.com/support-privacy/, https://www.kochava.com/ccpa-faq/, https://www.kochava.com/opt-out-do-not-sell-request-process/, https://oag.ca.gov/privacy/ccpa

Financials

Three-year financials

Financial Resilience Score: 6/10

Kochava is a private, founder-led company that has operated since 2011 without any known dilutive venture capital funding or exit event. This 14+ year track record of independence suggests either sustained profitability or highly disciplined capital management, both of which are positive resilience indicators. The company's product suite spans multiple offerings (MMP attribution, marketing mix modeling, ad-fraud prevention, deep linking, data marketplace, and AI-based StationOne), producing recurring enterprise SaaS revenue with high switching costs due to thousands of pre-built ad network integrations. Its Sandpoint, Idaho headquarters provides a structural cost advantage versus San Francisco-based competitors. However, resilience is materially constrained by several risks. The ongoing FTC lawsuit filed August 2022 over sensitive geolocation data sales represents a significant legal and reputational threat, particularly to the Kochava Collective data marketplace business line. The company also faces existential pressure from privacy regulations (Apple's ATT, SKAdNetwork/AdAttributionKit, Google Privacy Sandbox) that have disrupted the entire MMP category and require continuous R&D reinvestment. Competition from well-capitalized rivals like AppsFlyer, Adjust (owned by AppLovin), Branch, Singular, and the walled gardens of Meta/Google adds pricing pressure. Financial opacity is another concern—no audited financials, no SEC filings, and no verified revenue disclosure means external stakeholders cannot verify solvency or margins. Third-party revenue estimates range widely ($60M-$120M) and are unreliable. Given the mix of longevity/independence strengths against material legal, regulatory, and competitive risks, a moderate resilience score is warranted.

Key strengths: 14+ years of operation as founder-led private company without dilutive funding, Enterprise SaaS recurring revenue with Fortune 500 customers, High switching costs via thousands of ad network integrations, Diversified product suite across attribution, MMM, fraud, deep linking, and AI, Low-cost Sandpoint, Idaho operating base vs. SF-based competitors, Global presence with offices in US, Ireland, Spain, UK, Singapore, and China

Risk factors: Ongoing FTC lawsuit (filed August 2022) over geolocation data sales, Privacy regulation disruption (iOS ATT, SKAdNetwork, Google Privacy Sandbox), Competition from AppsFlyer, Adjust/AppLovin, Branch, Singular, and Meta/Google, Complete financial opacity—no audited statements or SEC filings, Revenue tied to cyclical global digital ad spending, Reputational risk from data marketplace business under regulatory scrutiny

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report