POLICY
Data broker’s “staggering” sale of sensitive info exposed in unsealed FTC filing
Judge: Data broker’s motion to sanction FTC “long on hyperbole, short on facts.”
One of the world's largest mobile data brokers, Kochava, has lost its battle to stop the Federal Trade Commission from revealing what the FTC has alleged is a disturbing, widespread pattern of unfair use and sale of sensitive data without consent from hundreds of millions of people.
US District Judge B. Lynn Winmill recently unsealed a court filing, an amended complaint that perhaps contains the most evidence yet gathered by the FTC in its long-standing mission to crack down on data brokers allegedly "substantially" harming consumers by invading their privacy.
The FTC has accused Kochava of violating the FTC Act by amassing and disclosing "a staggering amount of sensitive and identifying information about consumers," alleging that Kochava's database includes products seemingly capable of identifying nearly every person in the United States.
According to the FTC, Kochava's customers, ostensibly advertisers, can access this data to trace individuals' movements—including to sensitive locations like hospitals, temporary shelters, and places of worship, with a promised accuracy within "a few meters"—over a day, a week, a month, or a year. Kochava's products can also provide a "360-degree perspective" on individuals, unveiling personally identifying information like their names, home addresses, phone numbers, as well as sensitive information like their race, gender, ethnicity, annual income, political affiliations, or religion, the FTC alleged.
Beyond that, the FTC alleged that Kochava also makes it easy for advertisers to target customers by categories that are "often based on specific sensitive and personal characteristics or attributes identified from its massive collection of data about individual consumers." These "audience segments" allegedly allow advertisers to conduct invasive targeting by grouping people not just by common data points like age or gender, but by "places they have visited," political associations, or even their current circumstances, like whether they're expectant parents. Or advertisers can allegedly combine data points to target highly specific audience segments like "all the pregnant Muslim women in Kochava’s database," the FTC alleged, or "parents with different ages of children."
"Kochava’s use and disclosure of this precise geolocation information invade consumers’ privacy and cause or are likely to cause consumers substantial injury," the FTC's amended complaint said. "In addition, Kochava collects, uses, and discloses enormous amounts of additional private and sensitive information about consumers. Kochava’s use and disclosure of this data, whether alone or in conjunction with Kochava’s geolocation data, also invade consumers’ privacy and cause or are likely to cause consumers substantial injury."
According to the FTC, Kochava obtains data "from a myriad of sources, including from mobile apps and other data brokers," which together allegedly connects a web of data that "contains information about consumers’ usage of over 275,000 mobile apps."
The FTC alleged that this usage data is also invasive, allowing Kochava customers to track not just what apps a customer uses, but how long they've used the apps, what they do in the apps, and how much money they spent in the apps, the FTC alleged.
Kochava "provides an unprecedented view into a consumer’s personal actions, decisions, and behaviors," the FTC alleged, seeming particularly concerned that Kochava collects barely any information from its customers before providing access to this sensitive information. "Kochava’s practices intrude into the most private areas of consumers’ lives and cause or are likely to cause substantial injury to consumers," the complaint said.
Kochava "could implement safeguards to protect consumer privacy, such as blacklisting sensitive locations from its data feeds or removing sensitive characteristics from its data" at "a reasonable cost and expenditure of resources," but deliberately chooses not to, the FTC alleged. Instead, Kochava "actively promotes its data as a means to evade consumers’ privacy choices," the FTC alleged. Further, the FTC alleged that there are no real ways for consumers to opt out of Kochava's data marketplace, because even resetting their mobile advertising IDs—the data point that's allegedly most commonly used to identify users in its database—won't stop Kochava customers from using its products to determine "other points to connect to and securely solve for identity.”
For these reasons, the FTC is seeking a permanent injunction to stop Kochava from its allegedly unfair use and sale of consumer data.
Winmill wrote in an order to unseal the amended complaint that the FTC still has to prove that Kochava has violated the FTC Act, but its arguments are sufficient to survive Kochava's motion for sanctions, which the judge's order also denied.
According to Winmill, Kochava "has not offered any compelling reason to maintain the amended complaint under seal."
"Certainly, the FTC’s allegations cast Kochava’s services in an unfavorable light," Winmill wrote. "But that is no reason to shield the complaint from public view."
Experts told The Record that the ruling was "a promising turnaround in a landmark FTC action against a major data broker" and noted that unsealing the complaint has now revealed "Kochava’s shocking appetite for the most sensitive details of lives and the ways the company uses that data to profile, target, discriminate, and profit."
