FTC alleges data broker exposes users to violent threats by selling location data

The Federal Trade Commission (FTC) alleges data broker Kochava exposes people to threats of stalking, discrimination and violence by selling geolocation data revealing visits to sensitive locations, including reproductive health clinics, according to a complaint filed Monday.

The data sold by Idaho-based Kochava can be used to identify specific places an individual visited by plotting latitude and longitude coordinates, the FTC alleged in its lawsuit. 

The location data is also not anonymized, meaning it is possible to identify a mobile device’s user or owner. 

The FTC alleged that the sale of geolocation data puts consumers at risk by revealing information about visits to sensitive locations. In addition to reproductive health clinics, the agency said the data can be used to track visits to places of worship, homeless or domestic violence shelters and addiction recovery centers. 

The potential risks are “exacerbated by the fact that” Kochava “lacks any meaningful controls over who accesses its location data feed,” the complaint alleges. 

“Where consumers seek out health care, receive counseling, or celebrate their faith is private information that shouldn’t be sold to the highest bidder,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a statement. “The FTC is taking Kochava to court to protect people’s privacy and halt the sale of their sensitive geolocation information.”

Brian Cox, general manager of Kochava Collective, said in a statement the lawsuit “shows the unfortunate reality that the FTC has a fundamental misunderstanding of Kochava’s data marketplace business and other data businesses.” 

“Real progress to improve data privacy for consumers will not be reached through flamboyant press releases and frivolous litigation. It’s disappointing that the agency continues to circumvent the lawmaking process and perpetuate misinformation surrounding data privacy,” Cox said. 

He also said the company sources its geo data from third-party data brokers, “all of whom represent that the data comes from consenting consumers,” and that Kochava announced a new Privacy Block feature for geo data from sensitive locations that it is in the process of implementing. 

Kochava sued the FTC earlier this month after the agency threatened legal action against the company, The Washington Post reported at the time.

In its complaint, the data broker denied the FTC’s allegations and said they illustrate a “lack of understanding” of its services, according to the Post. 

The FTC voted 4-1 to bring the case against Kochava. Commissioner Noah Phillips, a Republican who said he will be resigning from the agency in the fall, voted not to bring the case. 

The FTC’s lawsuit comes as lawmakers and regulators are pushing to ramp up data privacy protection. 

Democrats have widely been pushing for more data privacy protection over reproductive health data after the Supreme Court ruled to overturn Roe v. Wade, triggering state abortion bans or strict restrictions across the country. 

More broadly, there’s been bipartisan support in Congress to push forward a comprehensive data privacy bill. A proposal advanced out of a House committee in July, but the Senate version lacks support from Commerce Committee Chairwoman Maria Cantwell (D-Wash.), threatening its chances of moving forward.

Updated: 4:01 p.m.