FTC sues data broker Kochava over sensitive geolocation data

The Federal Trade Commission is suing an adtech company for selling geolocation information from mobile devices used to track individuals' movements, the agency announced Monday.

Driving the news: The FTC voted 4-1 to authorize the suit in an Idaho federal court against data broker Kochava, Inc., for selling data from hundreds of millions of phones that traced the movements of people around sensitive locations like reproductive health clinics, domestic violence shelters and addiction recovery centers.

• Kochava, based in Idaho, allowed "anyone with little effort to obtain a large sample of sensitive data and use it without restriction" until at least June 2022, according to the agency, which says that violates laws against unfair and deceptive practices.

Why it matters: The FTC is making good on a pledge to protect sensitive health information in light of the Supreme Court's Dobbs decision overturning a constitutional right to abortion.

• The Biden administration also asked the agency "to consider taking steps" to protect personal data around reproductive health care.
• The Federal Communications Commission is also investigating mobile carriers' practices around disclosing to consumers how they use location data, per Reuters.

What they're saying: "Where consumers seek out health care, receive counseling, or celebrate their faith is private information that shouldn’t be sold to the highest bidder," Samuel Levine, director of the FTC’s bureau of consumer protection, said in a release.

• "The FTC is taking Kochava to court to protect people’s privacy and halt the sale of their sensitive geolocation information."
• The FTC's complaint says such identification data "is likely to injure consumers through exposure to stigma, discrimination, physical violence, emotional distress, and other harms."

The other side: "This lawsuit shows the unfortunate reality that the FTC has a fundamental misunderstanding of Kochava’s data marketplace business and other data businesses," Brian Cox, general manager of Kochava Collective, the company's data marketplace, said in a statement. "Kochava operates consistently and proactively in compliance with all rules and laws, including those specific to privacy."

• Cox said Kochava had introduced a new capability called Privacy Block to "block geo data from sensitive locations," and that the company had been working with the FTC to explain its business model.

Context: Kochava sued the FTC earlier this month, saying the FTC was wrongfully alleging it of being in violation of consumer protection laws, per the Washington Post.

Details: The FTC says that a publicly accessible sample of Kochava's data collected from more than 61 million mobile devices makes it possible to identify and track individual users' travel relating to sensitive locations, such as from a reproductive health clinic to a single-family residence or at a place of worship or a homeless shelter.

Be smart: There are many data brokers out there. An FTC win with this case could open the door to many more lawsuits, especially as the agency considers new rules covering commercial surveillance.

Editor's note: This story has been updated with additional comment from Kochava.