Kochava

Overview

Kochava is an independent mobile measurement and attribution platform for app advertisers and publishers. Its web SDK primarily appears on advertiser landing pages and mobile web properties where it performs ad click attribution, deep linking, and web-to-app conversion tracking. Kochava's core value proposition is "truth in measurement" — providing advertisers with an independent view of which ad networks and creatives are actually driving installs and in-app conversions, separate from the self-reported data provided by ad networks themselves. Founded in 2011 and headquartered in Sandpoint, Idaho, Kochava serves major app advertisers across gaming, finance, e-commerce, and media verticals.

What This Script Does

Kochava web SDK loads from cdn-marketing.kochava.com or go.kochava.com. The SDK initializes with an app GUID that identifies the advertiser account and app.

Click attribution and URL parameter capture: When a user arrives on a landing page from an ad click, the inbound URL contains Kochava click parameters (e.g., ?kochava-click-id=abc123&network_id=456&campaign_id=789). The SDK reads these parameters and sends them to control.kochava.com for attribution recording. The click ID, network ID, campaign ID, creative ID, and timestamp are stored server-side and associated with the browser fingerprint.

Attribution cookies and storage:

• kochava_device_id (30-day expiry, first-party) — a UUID stored after an attributed ad click to maintain attribution context during the conversion window
• kochava_session_id (session-scoped) — tracks the current session for event grouping
• ko_click_id (30-day expiry, first-party) — stores the click identifier from the originating ad for last-click attribution matching

Conversion event tracking: When a conversion occurs on the web (sign-up form completion, purchase, app store redirect), the SDK fires a conversion event to imp.kochava.com containing the event type, event value (revenue, sign-up tier), the stored click ID, and page metadata. Kochava matches this conversion event to the stored click record to produce an attributed conversion.

Deep linking: Kochava's deep link SDK (dl.kochava.com) detects the visitor's device type and operating system, then routes the visitor to the appropriate app store (Apple App Store, Google Play Store) or directly opens the installed app via a universal link or app scheme. Deep link resolution involves a redirect through Kochava's infrastructure that captures device signals (user agent, IP, device model via user agent parsing) before routing.

Network requests: Attribution data flows to control.kochava.com, conversion events fire to imp.kochava.com, and deep links resolve through dl.kochava.com. All requests include the Kochava app GUID, device signals, and attribution identifiers.

Consent & Compliance

Kochava is classified under marketing and analytics consent categories. Attribution cookies, click ID storage, and conversion tracking all serve advertising measurement purposes — determining which ad spend generated which conversions — and are non-essential tracking activities.

Under GDPR and the ePrivacy Directive, kochava_device_id and ko_click_id (30-day persistent first-party cookies) require consent before being set. The transmission of click IDs and conversion data to Kochava's servers constitutes personal data processing for advertising attribution purposes, requiring a lawful basis. The deep link redirect through Kochava's infrastructure (which captures IP address, device type, and user agent) also constitutes personal data processing.

Under CCPA/CPRA, attribution data sharing with Kochava constitutes sharing personal information with a third-party advertising measurement platform. This requires disclosure in privacy policies and opt-out mechanisms for California residents.

Regulatory context: In 2022, the US FTC filed a complaint against Kochava alleging that Kochava's data marketplace sold precise geolocation data (sourced from its mobile SDK, not web scripts) that could reveal sensitive location patterns including visits to health clinics and places of worship. Kochava challenged the complaint and litigation was ongoing as of late 2024. This enforcement action concerned Kochava's data brokerage business rather than its web attribution SDK, but it highlights the company's broader data practices and reinforces the importance of careful vendor disclosure.

Kochava is headquartered in Sandpoint, Idaho. EU/EEA data transfers for web attribution rely on Standard Contractual Clauses. Kochava participates in the EU-US Data Privacy Framework.

Should You Block This Without Consent?

Yes. Kochava's web SDK sets attribution cookies, reads ad click parameters, and transmits conversion data to a third-party advertising measurement platform. These are non-essential advertising activities that require prior consent under GDPR and ePrivacy. Block until the visitor grants marketing consent.