The US Federal Trade Commission (FTC) sued Idaho-based data broker Kochava this week for selling geolocation data from hundreds of millions of mobile devices that could be used to track consumers.
The FTC said consumer data could be used to trace people’s movements to and from sensitive locations.
According to the company website Kochava is an industry lead for standard secure, real-time data solutions. The company helps people-based marketers establish identity, define and activate audiences, as well as measure and optimize their marketing across connected devices.
The alleged data sale gained special interest following the supreme court ruling in June that overturned the Roe v Wade decision that guaranteed a constitutional right to an abortion. Since then, privacy advocates and the public have called for more limits to the data tech companies collect over concerns that other entities could access confidential user search history, geolocation and other information revealing potential medical intentions.
But the lawsuit, which seeks to halt Kochava’s sale of sensitive geolocation data and require the company to delete the sensitive information it has collected, addresses issues beyond tracking those pursuing medical care. In the suit, FTC alleges the company allows people to customize their data feed to filter for mobile devices at specific times and locations. This would make it easy to track a user over time or try to, for instance find out their private locations or intentions.
For example, “the location of a mobile device at night likely corresponds to the consumer’s home address,” the suit said. “Public or other records may identify the name of the owner or resident of a particular address.”
The FTC also alleges that, the company advertises “Household Mapping” as one of the ways to use its data. Until recently, the company also made its data available for purchase by the public as well as “allowed anyone with little effort to obtain a large sample of sensitive data and use it without restriction”.
For instance, a sample of Kochava’s data – which included 327,480,000 rows and 11 columns of data, corresponding to more than 61,803,400 unique mobile devices – was available on a trial basis on Amazon Web Services Marketplace as of June 2022 for anyone to access.
Following the lawsuit, the general manager of Kochava Brian Cox, released a statement that states the FTC “has a fundamental misunderstanding” of how the data marketplace business works and the company works in compliance with all rules and regulations including those specific to privacy.
“We hoped to have productive conversations that led to effective solutions with the FTC about these complicated and important issues and are open to them in the future”.
“Unfortunately, the only outcome the FTC desired was a settlement that had no clear terms or resolutions and redefined the problem into a moving target. Real progress to improve data privacy for consumers will not be reached through flamboyant press releases and frivolous litigation.”
A statement by Samuel Levine, director of the FTC’s Bureau of Consumer Protection reads, “Where consumers seek out health care, receive counselling, or celebrate their faith is private information that shouldn’t be sold to the highest bidder. The FTC is taking Kochava to court to protect people’s privacy and halt the sale of their sensitive geolocation information”.
The FTC says Kochava buys vast amount of location information from other data brokers across hundreds of millions of mobile devices that is analysed and packaged into customized data. They then sell that data to clients including retailers.
Whatever the outcome of the lawsuit, the key takeaway remains that not only does the cooperate world need to rethink how it collects, manages, and uses consumer data, but also further public awareness on the exchange and use of personal data is required.