FTC sues Kochava for allegedly selling geolocation information from millions of mobile devices

The Federal Trade Commission has filed a lawsuit against Idaho-based data broker Kochava for allegedly selling geolocation data from hundreds of millions of consumer mobile devices.

Kochava Collective's general manager Brian Cox told FOX Business the agency has a "fundamental misunderstanding" of its data marketplace business and other data businesses and that the firm "operates consistently and proactively in compliance with all rules and laws, including those specific to privacy."

According to the FTC complaint, Kochava allowed anyone with little effort to obtain a large sample of sensitive data and use it without restriction until at least June 2022. The data can allegedly be used to trace consumers' movements to and from sensitive locations, including abortion clinics, places of worship, homeless and domestic violence shelters and addiction recovery centers.

The government's defacto privacy watchdog argues the sale of the data exposes consumers to "threats of stigma, stalking, discrimination, job loss, and even physical violence." The suit seeks to halt Kochava's sale of sensitive geolocation data and require the company to delete the sensitive geolocation information it has already collected.

According to Cox, Kochava is "constantly monitoring and proactively adjusting" its technology to block geo data from sensitive locations. The company recently launched a new capability prior to the FTC's lawsuit that blocks geo data from sensitive locations via Privacy Block.

"Real progress to improve data privacy for consumers will not be reached through flamboyant press releases and frivolous litigation," he added. "It’s disappointing that the agency continues to circumvent the lawmaking process and perpetuate misinformation surrounding data privacy."

T-MOBILE SETTLES SUIT OVER MASSIVE HACKING FOR $350M

Kochava acquires consumers' location data from other third party data brokers, complies the information into customized feeds and markets it commercial clients. Kochava typically charges a monthly subscription fee of thousands of dollars to access its location data feed but also offers a free sample.

The data, which is not anonymized, includes timestamped latitude and longitude coordinates which are associated with a Mobile Advertising ID, a unique identifier assigned to a mobile device to assist marketers in advertising to the consumer.

The FTC notes that Kochava's own description of its product claims its location feed "delivers raw latitude/longitude data with volumes around 94B+ geo transactions per month, 125 million monthly active users, and 35 million daily active users, on average observing more than 90 daily transactions per device."

SEPHORA TO PAY $1.2 MILLION IN SETTLEMENT OVER CALIFORNIA CONSUMER PRIVACY LAW

"Consumers are suffering, have suffered, and will continue to suffer substantial injury as a result of defendant’s violations of the FTC Act," the complaint said. "Absent injunctive relief by this court, defendant is likely to continue to injure consumers and harm the public interest."

"We hoped to have productive conversations that led to effective solutions with the FTC about these complicated and important issues and are open to them in the future," Cox said. "Unfortunately the only outcome the FTC desired was a settlement that had no clear terms or resolutions and redefined the problem into a moving target."

CLICK HERE TO READ MORE ON FOX BUSINESS

The litigation follows an announcement earlier this month that the FTC is exploring rules to crack down on harmful commercial surveillance practices that collect, analyze, and profit from information about people. 

The FTC voted 4-1 authorizing staff to file the complaint against Kochava in the U.S. District Court for the District of Idaho.