FTC Sues Data Broker for Allegedly Selling Location, Health-Related Data

The commission voted 4-1 to file the complaint against Kochava, with Commissioner Noah Phillips dissenting. Phillips didn’t comment Monday. President Joe Biden issued an executive order in July directing FTC Chair Lina Khan to explore steps to “protect consumers’ privacy when seeking information about and provision of reproductive health care services,” citing the overturning of Roe v. Wade (see 2207080060). Democrats have been vocal about protecting individuals against data abuse related to reproductive health (see 2207220053 and 2205270055).

By selling users’ geolocation data, Kochava is “enabling others to identify individuals and exposing them to threats of stigma, stalking, discrimination, job loss, and even physical violence,” the agency said. The FTC is seeking to end the company’s sale of such data.

Kochava sued the FTC earlier this month in an effort to block the agency’s pursuit of a preliminary injunction. Kochava “operates consistently and proactively in compliance with all rules and laws,” Kochava Collective General Manager Brian Cox said in a statement Monday. The company has engaged with the agency for the past several weeks, trying to educate enforcers about data and hoping for productive conversation, he said: “Unfortunately the only outcome the FTC desired was a settlement that had no clear terms or resolutions and redefined the problem into a moving target. Real progress to improve data privacy for consumers will not be reached through flamboyant press releases and frivolous litigation. It’s disappointing that the agency continues to circumvent the lawmaking process and perpetuate misinformation surrounding data privacy.” Before the legal action, the company launched Privacy Block to block geolocation data from the marketplace, said Cox: He said Kochava “sources 100% of the geo data in our data marketplace from third party data brokers all of whom represent that the data comes from consenting consumers.”

The agency hasn’t provided any rule or statement “with legal force and effect describing the specific geolocation data practices it believes [FTC Act] Section 5 prohibits or permits,” the company said in its filing. The FTC’s allegations “illustrate a lack of understanding” about the company’s services, Kochava said. It claims the agency is wrong in its assertion that Kochava lacks “technical controls to prohibit its customers from identifying consumers or tracking them to sensitive locations.”

The FTC’s lawsuit is part of the agency’s work to “use all of our tools to protect Americans' privacy,” Khan tweeted Monday, noting the agency’s potential privacy rulemaking (see 2208110068). Commissioner Alvaro Bedoya called it a “vital bipartisan vote to protect some of the most sensitive information imaginable.” He noted the data can be used to track people to places associated with medical care, religious worship, mental health and housing assistance.

“Where consumers seek out health care, receive counseling, or celebrate their faith is private information that shouldn’t be sold to the highest bidder,” said FTC Consumer Protection Bureau Director Samuel Levine. The agency alleged the company packaged the consumer data into “customized data feeds that match unique mobile device identification numbers with timestamped latitude and longitude locations.” Citing material from Kochava, the agency said the data feeds “assist clients in advertising and analyzing foot traffic at their stores and other locations. ... People are often unaware that their location data is being purchased and shared by Kochava and have no control over its sale or use.”

Sen. Ed Markey, D-Mass., called the allegations against Kochava “chilling.” It appears the data broker made geolocation data from tens of millions of people available to “almost anyone with an internet connection,” he said in a statement Monday. It appears Kochava “has brought our post-Dobbs nightmare to life,” he said, referring to the Supreme Court's Dobbs v. Jackson ruling that overturned Roe.