The Federal Trade Commission filed a lawsuit against data broker Kochava Inc. for selling geolocation data from hundreds of millions of mobile devices that can be used to track individuals’ movements to and from sensitive locations. Kochava’s data can reveal people’s visits to reproductive health clinics, places of worship, homeless and domestic violence shelters and addiction treatment facilities. The FTC alleges that by selling people’s tracking data, Kochava is enabling others to identify individuals and exposing them to threats of stigma, stalking, discrimination, job loss and even physical violence. The FTC’s lawsuit seeks to stop Kochava from selling sensitive geolocation data and require the company to delete the sensitive geolocation information it has collected.
“Where consumers seek health care, receive counseling or exercise their faith is private information that should not be sold to the highest bidder,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “The FTC is taking Kochava to court to protect people’s privacy and stop the sale of their sensitive geolocation information.”
Idaho-based Kochava buys a vast amount of location information derived from hundreds of millions of mobile devices. The information is packaged into custom data feeds that match unique mobile device identification numbers with time-stamped latitude and longitude locations. According to Kochava, these data sources can be used to help customers advertise and analyze foot traffic in their stores and other locations. People are often unaware that their location data is being purchased and distributed by Kochava and have no control over its sale or use.
In a complaint filed against Kochava, the FTC alleges that the company’s personalized data feeds allow shoppers to identify and track specific users of mobile devices. For example, the location of a mobile device at night is likely to be the user’s home address and can be combined with property data to reveal their identity. In fact, the data broker has defended identifying households as one of the possible uses of its data in some marketing materials.
According to the FTC’s complaint, Kochava’s sale of geolocation data puts consumers at significant risk. The company’s data allows buyers to track people in sensitive locations that may reveal information about their personal health decisions, religious beliefs, and the steps they are taking to protect themselves from abusers. The release of this information can expose them to stigma, discrimination, physical violence, emotional distress and other harms.
The FTC alleges that Kochava fails to adequately protect its data from public exposure. At least until June 2022, Kochava allowed anyone with little effort to obtain a large sample of sensitive data and use it without restrictions. The sample of data the FTC examined included precise time-stamped location data collected from more than 61 million unique mobile devices in the previous week. Using Sample of Kochava’s publicly available data, the FTC complaint details how it is possible to identify and track people in sensitive locations such as:
- Reproductive health clinics: The data can be used to identify people who have visited a reproductive health clinic and therefore expose their private medical decisions. Using the data sample, it is possible to trace a mobile device from a reproductive health clinic to a single family residence to other routinely visited locations. Data may also be used to identify medical professionals who perform or assist in the performance of reproductive health services.
- Places of worship: Data may be used to track consumers to places of worship, and thus reveal consumers’ religious beliefs and practices. The data sample identifies mobile devices that were located in places of worship of Jewish, Christian, Islamic and other religious faiths.
- Homelessness and domestic violence shelters: The data may be used to track consumers who visited a homeless shelter, a domestic violence shelter, or other facilities aimed at at-risk populations. This information can reveal the location of people fleeing domestic violence or other crimes. The data sample identifies a mobile device that appears to have spent the night in a temporary shelter whose mission is to provide shelter for young pregnant women or new mothers at risk. Additionally, because Kochava’s data allows its clients to track people over time, the data can be used to identify their past conditions, such as homelessness.
- Addiction recovery centers: The data can be used to track consumers who have visited addiction recovery centers. The data can show how long consumers have stayed at the center and whether a consumer potentially relapses and returns to a recovery center.
Protecting sensitive consumer data, including location and health data, is a top priority for the FTC. This month, the FTC announced it is considering rules to crack down on abusers commercial surveillance practices that collect, analyze and benefit from information about people. In July, The FTC warned businesses that the agency intends to enforce the law against the unlawful use and sharing of highly sensitive consumer data, including sensitive health data. Last year, the FTC issued a political statement warning health apps and related devices that collect or use consumer health information that they must notify consumers and others when that data is breached as required by the Health Breach Notification Rule. In 2021, the agency also took action against fertility app Flo Health for sharing sensitive health data with third parties.
The Commission’s vote for staff authorization for the complaint against Kočava was 4-1. Commissioner Noah Joshua Phillips voted no. The complaint was filed in the US District Court for the District of Idaho.
NOTE: The Commission files a complaint when it has “reason to believe” that the named defendants are violating or are about to violate the law and it appears to the Commission that a proceeding is in the public interest. The matter will be decided by the court.
