FTC Sues Idaho Company for Selling Sensitive Tracking Data

“Where consumers seek out health care, receive counseling, or celebrate their faith is private information that shouldn’t be sold to the highest bidder,”

Samuel Levine,

director of the FTC’s Bureau of Consumer Protection, said in a statement.

Kochava had no immediate comment. The company recently filed its own pre-emptive lawsuit against the FTC, anticipating the agency’s suit but saying the FTC was ignoring privacy improvements Kochava has made to its practices.

In a statement at that time, Kochava said that the FTC doesn’t understand how its business works, and that the company recently took steps to improve consumer privacy, including removing health services location data from its marketplace.

The FTC lawsuit against Kochava, and other investigations like it that are under way, reflect a major shift in privacy policy under Chairwoman

Lina Khan.

The FTC’s tougher stance could lead to big changes to the data broker business and the broader online advertising industry, with their reliance on consumer information harvested online.

“The massive exploitation of consumer geolocation data, stealthily gathered by apps and mobile devices, has become a fundamental feature of the commercial surveillance system,” said

Jeff Chester,

executive director of the Center for Digital Democracy, a group that advocates for online privacy and consumer protections. The commission has placed online data companies on notice they risk legal action and public exposure.”

Connected devices such as smartphones and fitness trackers gather a trail of location data on their users that finds its way into an under-the-radar marketplace, from big tech firms to data aggregators and brokers. They buy and sell the information, often to personalize ads or measure whether ads drove users to purchase.

The FTC complaint against Kochava, filed in U.S. District Court in Idaho, accuses the company of unfairly selling sensitive data and cites the FTC Act’s prohibition on “unfair or deceptive acts or practices in or affecting commerce.”

Kochava’s “data may be used to identify consumers who have visited an abortion clinic and, as a result, may have had or contemplated having an abortion,” as well as medical professionals who provide abortions, the FTC complaint said.

The FTC said that data available on Kochava’s website as a free sample were sufficient to “identify a mobile device that visited a women’s reproductive health clinic and trace that mobile device to a single-family residence”—thereby inferring the user’s home address.

The Supreme Court’s June decision in Dobbs v. Jackson Women’s Health Organization, and the following wave of state laws banning or restricting abortion, has drawn attention from the FTC and others to the $10 billion-plus market for people’s mobile-phone location data.

In the wake of the ruling, several companies with user location data, including Google owner

Alphabet Inc.,

revised their policies to obscure visits to sensitive locations, including facilities that provide abortions.

The FTC complaint also calls out Kochava’s data on visits to houses of worship, homeless shelters, domestic violence shelters and addiction recovery centers. “The release of this data could expose them to stigma, discrimination, physical violence, emotional distress, and other harms,” the FTC said in a press release.

Kochava said in its earlier statement that the federal agency’s threatened lawsuit against it was a “manipulative attempt…to give the appearance that it is protecting consumer privacy despite being based on completely false pretenses.”

The FTC is investigating a range of companies that handle health data, seeking to force them to agree to tough settlements restricting their use and sale of sensitive data, according to people familiar with the matter.

In the wake of the Dobbs decision, President Biden issued an executive order encouraging the FTC to take new actions to protect consumers’ privacy when they seek information about reproductive health.

In July, the FTC also warned businesses publicly that it intended to go after illegal use and sharing of highly sensitive consumer data, including sensitive health data. In 2021, the agency also took action against fertility app Flo Health for sharing sensitive health data improperly with third parties.

The commission also recently announced that it would begin the lengthy process of considering rules to protect the privacy of a range of consumer data.

Write to John D. McKinnon at [email protected] and Patience Haggin at [email protected]