Ever have that feeling that what you were “previously” searching you then only to switch to another app only to then get inundated with ads pertaining to things and subjects that you just searched for? Well, the Federal Trade Commission (FTC) has filed a lawsuit against Kochava, a known data broker, alleging serious violations of privacy and security similar to the situation described earlier. The FTC’s complaint accuses Kochava of collecting, using, and disclosing massive amounts of precise geolocation data from consumers’ mobile devices. Disconcertingly, the FTC alleges that Kochava’s data can be used to trace the movements of individuals to and from sensitive locations, such as reproductive health clinics, places of worship, homeless and domestic violence shelters, and addiction recovery facilities.
The FTC’s lawsuit seeks to halt Kochava’s sale of sensitive geolocation data and require the company to delete the sensitive geolocation information it has collected. The FTC’s complaint also alleges that Kochava had no security processes in place for determining whether to approve a data access request, nor were there controls in place to limit the subsequent use and sale of the data.
The FTC’s complaint against Kochava was initially dismissed by a federal judge in Idaho, who ruled that the FTC had not provided sufficient evidence to back up their claims. However, the court gave the FTC the opportunity to strengthen its arguments and proceed with the case. In response, the FTC filed an amended complaint, which was unsealed in November 2023.
The amended complaint provides a more detailed picture of Kochava’s data practices. It alleges that Kochava collects, uses, and discloses massive amounts of information about consumers, including names, mobile advertising IDs (MAIDs), addresses, phone numbers, email addresses, gender, age, and more. The FTC’s amended complaint also asserts that Kochava amasses and discloses a staggering amount of sensitive and identifying information about consumers.
The FTC’s lawsuit against Kochava is part of a broader effort by the commission to crack down on the sale and use of potentially sensitive information. The FTC has long expressed concern about the potential misuse of location data and has investigated the practices and brought enforcement actions against mobile app operators and data brokers with respect to sensitive data.
The case against Kochava is ongoing, and the outcome could have significant implications for the data broker industry and the privacy rights of all consumers.
